Another test

default.conf

-geo $allow {
+geo $remote_addr $giveaccess {
+    proxy 172.23.2.2;
     default 0;
     10.0.0.0/8 1;
     172.16.0.0/16 1;
@@ -26,11 +27,9 @@ server {
     location ~ ^/(contacts) {
         root   /usr/share/nginx/web;
         error_page 403 /errors/403/;
-        real_ip_header X-Forwarded-For;
-        if ($allow = 0) {
+        if ($giveaccess = 0) {
             return 403;
         }
-        set_real_ip_from 172.23.2.2;
     }
 
     # static json and png data files