You should never ever auto redirect users based on their IP addresses or browser language settings! On this way you let Google think all of your site's language versions are much less important, as the english version, because 99,99% of all googlebot's visits your redirect it to the english version. Just because the most of time googlebot comes with IP address from US and without language setting.
Its true, googlebot can have a language parameter and it can come from another IP as from US, but it is absolutely rare situation.
It seems to be single one absolutely googlebot-conform kind of multi-language sites management, namely cookie-based:
- on the first visit you give the user a possibility to select language and/or region and set the cookie with the choice.
- On further visits you check the cookie and show corresponding language/region site's version.
Googlebot doesn't work with cookies - it will use only your hreflang attributes to crawl your site.
X-default should always show the fallback page for all new users, who hasn't yet specified the language/region choice on your site - this is in most cases your startpage, as in Google's example:
http://example.com/en-gb: For English-speaking users in the UK
http://example.com/en-us: For English-speaking users in the USA
http://example.com/en-au: For English-speaking users in Australia
http://example.com/: The homepage shows users a country selector and is the default page for users worldwide
<link rel="alternate" href="http://example.com/en-gb" hreflang="en-gb" />
<link rel="alternate" href="http://example.com/en-us" hreflang="en-us" />
<link rel="alternate" href="http://example.com/en-au" hreflang="en-au" />
<link rel="alternate" href="http://example.com/" hreflang="x-default" />