diff --git a/packages/matrix-application-server/src/__testData__/config.json b/packages/matrix-application-server/src/__testData__/config.json
index a26b81936..362b7f797 100644
--- a/packages/matrix-application-server/src/__testData__/config.json
+++ b/packages/matrix-application-server/src/__testData__/config.json
@@ -12,5 +12,6 @@
     },
     "push_ephemeral": true,
     "rate_limiting_window": 10000,
-    "rate_limiting_nb_requests": 100
+    "rate_limiting_nb_requests": 100,
+    "trust_x_forwarded_for": false
 }
\ No newline at end of file
diff --git a/packages/matrix-application-server/src/config.json b/packages/matrix-application-server/src/config.json
index d5d9b7aa7..419a84d83 100644
--- a/packages/matrix-application-server/src/config.json
+++ b/packages/matrix-application-server/src/config.json
@@ -5,5 +5,6 @@
     "namespaces": { "users": [] },
     "push_ephemeral": true,
     "rate_limiting_window": 600000,
-    "rate_limiting_nb_requests": 100
+    "rate_limiting_nb_requests": 100,
+    "trust_x_forwarded_for": false
 }
\ No newline at end of file
diff --git a/packages/matrix-application-server/src/index.ts b/packages/matrix-application-server/src/index.ts
index 239772384..abb83ecbc 100644
--- a/packages/matrix-application-server/src/index.ts
+++ b/packages/matrix-application-server/src/index.ts
@@ -18,6 +18,7 @@ export interface Config {
   push_ephemeral?: boolean
   rate_limiting_window?: number
   rate_limiting_nb_requests?: number
+  trust_x_forwarded_for?: boolean
 }
 
 export { type ClientEvent } from './interfaces'
diff --git a/packages/matrix-application-server/src/routes/index.ts b/packages/matrix-application-server/src/routes/index.ts
index bd7808bab..53980fdea 100644
--- a/packages/matrix-application-server/src/routes/index.ts
+++ b/packages/matrix-application-server/src/routes/index.ts
@@ -30,7 +30,10 @@ export default class MASRouter {
   constructor(private readonly _appServer: MatrixApplicationServer) {
     this.rateLimiter = rateLimit({
       windowMs: this._appServer.conf.rate_limiting_window,
-      limit: this._appServer.conf.rate_limiting_nb_requests
+      limit: this._appServer.conf.rate_limiting_nb_requests,
+      validate: {
+        trustProxy: this._appServer.conf.trust_x_forwarded_for
+      }
     })
     this.defaultAuthMiddleware = auth(
       this._appServer.appServiceRegistration.hsToken,