/ Register

Want to subscribe to topics you're interested in?
Become a Member

Cloudflare Getting Real IP From Behind Two Proxies

Discussion in 'System Administration' started by BamaStangGuy, Oct 17, 2019.

Previous Thread Next Thread
Loading...
Page 1 of 2
  1. Oct 17, 2019 #1
    BamaStangGuy

    BamaStangGuy Active Member

    668
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    3:52 PM
    I currently have the following setup:

    Client > CloudFlare > Ezoic > Orgin Server

    The problem is that now the real ip address of the user is not shown in nginx logs. How can I keep the real ipand forward it to my orgin server?

    I have a list of all exoic ip address ranges. I currently have cloudflare.conf uncommented.
     
    Last edited: Oct 17, 2019
  2. Oct 17, 2019 #2
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    Do you mean Ezoic?
     
  3. Oct 17, 2019 #3
    eva2000

    eva2000 Administrator Staff Member

    50,461
    11,661
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,082
    Local Time:
    6:52 AM
    Nginx 1.25.x
    MariaDB 10.x
    X-FORWARD-FOR not working for you Using the X-Forwarded-For (XFF) Header ? who's IP address are you seeing in your nginx logs ? cloudflare or ezoics ?

    Centmin Mod official Getting Started Guide step 5 outlines how to remedy this already as ezoic is like cloudflare in both they are proxies, so you need to setup X-FORWARD-FOR at nginx level as outlined at Nginx Cloudflare & Incapsula (reverse proxy HttpRealIpModule) - CentminMod.com LEMP Nginx web stack for CentOS which has examples for Cloudflare and Incapsula which is close to ezoic for the setup of set_real_ip_from and real_ip_header X-Forwarded-For directives.
     
  4. Oct 17, 2019 #4
    BamaStangGuy

    BamaStangGuy Active Member

    668
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    3:52 PM
    What am I missing then? I have uncommented the cloudflare.conf file and it includes:

    Code:
    include /usr/local/nginx/conf/cloudflare_customips.conf;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;
real_ip_header CF-Connecting-IP;
    and then I added the following line below the cloudflare.conf include in nginx.conf
    include /usr/local/nginx/conf/cloudflare.conf;
    include /usr/local/nginx/conf/ezoic.conf;

    which exoic.conf includes:
    Code:
    <more ips>
set_real_ip_from 34.218.119.32/27;
set_real_ip_from 34.245.205.0/27;
set_real_ip_from 34.245.205.64/27;
set_real_ip_from 35.172.155.192/27;
set_real_ip_from 35.172.155.96/27;
real_ip_header X-Forwarded-For;
    Which produces errors about duplicate real_ip_header
     
  5. Oct 17, 2019 #5
    BamaStangGuy

    BamaStangGuy Active Member

    668
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    3:52 PM
    Same thing happens if I just use cloudflare.conf with incapsula.conf
     
  6. Oct 17, 2019 #6
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    To correct this, all you have to do is implement an XFF header.

    Using the X-Forwarded-For (XFF) Header

    Not sure about the exact edits needed for Centminmod ...

    I would like also to have some specific edits for that...
     
    Last edited: Oct 17, 2019
  7. Oct 17, 2019 #7
    eva2000

    eva2000 Administrator Staff Member

    50,461
    11,661
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,082
    Local Time:
    6:52 AM
    Nginx 1.25.x
    MariaDB 10.x
    you can't use cloudflare real ip setup if ezoic is in front of your server, you need ezoic setup if it's in front of your server
     
  8. Oct 18, 2019 #8
    BamaStangGuy

    BamaStangGuy Active Member

    668
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    3:52 PM
    The client IP address isn't transferred from CloudFlare to Ezoic. That is the issue.
     
  9. Oct 18, 2019 #9
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    I have the same setup also....

    Using Cloudflare and the Cloudflare app of Ezoic ...

    George if you want to check it is easy.

    Just use Cloudflare and enable from there at the apps the Ezoic app...
     
  10. Oct 20, 2019 #10
    ndha

    ndha Member

    82
    10
    8
    Sep 28, 2014
    Ratings:
    +29
    Local Time:
    3:52 AM
    Latest
    10
    In my setup for 2 proxies using CF Nameservers, i use like this:
    First Proxy is DDOS Protected IP/ DMCA Ignore IP
    Second is Cloudflare
    Third is main IP.

    in First, i use proxy.conf and cloudflare.conf
    Second, i use the First ip ex: proxy.conf and protectedip.conf

    So, i put the First ip in CF A Record.

    It can be use too with Incapsula > CF > Real IP or CF > Incapsula > Real IP.
     
  11. Oct 21, 2019 #11
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    Last edited: Oct 21, 2019
  12. Oct 22, 2019 #12
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    If anyone can get this working please post here...

    thank you
     
  13. Oct 23, 2019 #13
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    Can we just edit the cloudflare set real ip config and add there the Ezoic ip's ?
     
  14. Oct 23, 2019 #14
    BamaStangGuy

    BamaStangGuy Active Member

    668
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    3:52 PM
    No, already tried that.
     
  15. Oct 24, 2019 #15
    Xon

    Xon Active Member

    173
    61
    28
    Nov 16, 2015
    Ratings:
    +229
    Local Time:
    4:52 AM
    1.15.x
    MariaDB 10.3.x
    You need to add;
    Code:
    real_ip_recursive on;
    Remove;
    Code:
    real_ip_header CF-Connecting-IP;
    Clouldflare sends a standard X-Forwarded-For anyway.

    I uses to do this for a setup using Cloudflare => Linode loadblancer => real server.
     
  16. Oct 24, 2019 #16
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    at cloudflare.conf ?
     
  17. Oct 24, 2019 #17
    eva2000

    eva2000 Administrator Staff Member

    50,461
    11,661
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,082
    Local Time:
    6:52 AM
    Nginx 1.25.x
    MariaDB 10.x
    nice (y)

     
  18. Oct 24, 2019 #18
    eva2000

    eva2000 Administrator Staff Member

    50,461
    11,661
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,082
    Local Time:
    6:52 AM
    Nginx 1.25.x
    MariaDB 10.x
    in include /usr/local/nginx/conf/cloudflare_customips.conf which is placed in cloudflare.conf so csfcf.conf cronjob doesn't override contents of cloudflare.conf include file.
     
  19. Oct 24, 2019 #19
    BamaStangGuy

    BamaStangGuy Active Member

    668
    192
    43
    May 25, 2014
    Ratings:
    +272
    Local Time:
    3:52 PM
    Yes, this appears to be working for me now.
     
  20. Oct 24, 2019 #20
    pamamolf

    pamamolf Well-Known Member

    4,022
    421
    83
    May 31, 2014
    Ratings:
    +816
    Local Time:
    11:52 PM
    Nginx-1.17.x
    MariaDB 10.3.x
    Ok so i must remove the real_ip_header CF-Connecting-IP from:

    Code:
    /usr/local/nginx/conf/cloudflare.conf
    and add the real_ip_recursive on; at:

    Code:
    /usr/local/nginx/conf/cloudflare_customips.conf
    ?

    Also i must whitelist the Ezoic ip's there like:

    Code:
    set_real_ip_from 34.218.119.32/27;
set_real_ip_from 34.245.205.0/27;
set_real_ip_from 34.245.205.64/27;
set_real_ip_from 35.172.155.192/27;
set_real_ip_from 35.172.155.96/27;
real_ip_recursive on;
     
Previous Thread Next Thread
Loading...
Page 1 of 2

.