If the proxies are honest then X-Forwarded-For is as good as it gets. If they don't add that header - or falsify it - there's nothing you can do.