IP address detection settings

I have a question concerning IP address detection settings.

Some background: I recently removed Jetpack as my host informed me that Jetpack would no longer be included with my plan. Thus, I began modifying settings on my other plugins (including AIOS) to make up for it. Yesterday, I began receiving 403 errors out of the blue, leaving me locked out of admin. I contacted my host and they stated that AIOS settings were the issue. After some troubleshooting, I determined that the IP whitelist setting under Brute Force was the issue. I did some more digging and realized this may be due to the IP address detection settings.

Previously, I’ve left the default setting (REMOTE_ADDR) selected without issue. However, the address returned by REMOTE_ADDR does not match my IP (I use a VPN, but I’ve had no issues with the setting until yesterday). The other 2 options I can select for the server variable, HTTP_X_FORWARDED_FOR and HTTP_X_REAL_IP, each return the correct IP. However, I am not sure which would be better (or if I should actually change this setting at all). From a security and functionality standpoint, which option is best for my case? Thanks.

The page I need help with: [log in to see the link]