[keycloak-user] Using both proxy address forwarding and an ip-access-control filter

Hello Everyone, When using both proxy address forwarding (https://www.keycloak.org/docs/latest/server_installation/index.html#ident...) and also using request filtering (http://lists.jboss.org/pipermail/keycloak-user/2016-September/007855.html ), does the filter get applied before or after the IP Address is harvested from X-Forwarded-For header? It seems like the filter is getting applied before the IP Address is pulled from the header which makes using both kind of pointless. Thanks for your help, John