Skip to main content How to use the real_ip_header in Nginx Proxy Manager, whilst using still using access lists for Cloudflare? : r/selfhosted
r/selfhosted icon
Go to selfhosted
•

How to use the real_ip_header in Nginx Proxy Manager, whilst using still using access lists for Cloudflare?

I run all of my services behind cloudflare, and to stop non-cloudflare-proxied traffic reaching them, I created an access list of the cloudflare endpoints, and added the rule to all of my services. It worked before, but I then wanted to see the real client IP in my logs, so I added: 

real_ip_header CF-Connecting-IP;

to them, in the advanced tab. Now, the requests get blocked, presumably because it uses the real-ip to filter traffic. Is there any way to get the real client IP, while still filtering non-cloudflare traffic?

The everything app, for work. Get everyone working in a single platform designed to manage any type of work.
Learn More
clickup.com
Thumbnail image: The everything app, for work. Get everyone working in a single platform designed to manage any type of work.
Sort by:
Best
Open comment sort options
[deleted]
•

Comment deleted by user

 • • Edited

This is unnecessary since NPM fetches the Cloudflare IPv4 and IPv6 addresses automatically during runtime. It then sets the set_real_ip_from for all common cloud provider or CDN IPs.

See https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/docker/rootfs/etc/nginx/conf.d/include/ip_ranges.conf

More replies
•

Not possible. You either can use access lists and not set the real_ip_header or vice versa.

Use a firewall in front of NPM and whitelist cloudflare IPv4 and IPv6 only. Then set NPM to use real_ip_header CF-Connecting-IP; in a proxy host's advanced section.

•

What about blocking all except cloudflare at the firewall? Probably safer than letting your app server handle it

•

Sorry, I probbaly didn't make it clear! I block the non-cloudflare traffic in nginx-proxy-manager, and not in the web servers for the individual services.

More replies
•

But Cloudflare has a huge list of IPs. A lot of scammers use Cloudflare and AWS .

Can you filter based on an http header or something?

More replies
•

I don’t want to block any ingress requests but i want to capture the real IP address instead of cloudflare proxy using nginx as reverse proxy. Could someone suggest a way for it ??

Don't settle for second-best. 🏆 RunMyJobs by Redwood leads with a 95 G2 satisfaction score — significantly higher than AutoSys, Control-M, Automic and others. Learn why.
Read More
redwood.com
Thumbnail image: Don't settle for second-best. 🏆 RunMyJobs by Redwood leads with a 95 G2 satisfaction score — significantly higher than AutoSys, Control-M, Automic and others. Learn why.
•

Are you able to upload a picture of what that config looks like. I am currently trying to figure that out for fail2ban, and not sure if I set up the option correctly. Thanks!

•

I just created an access list of all the cloudflare IPs (listed here: https://www.cloudflare.com/ips-v4), and then applied it to all of my cloudflare-proxied services in nginx proxy manager:

Created access list:

https://i.ibb.co/VmsQstT/Screenshot-2022-12-27-at-12-36-45.png

Named rule:

https://i.ibb.co/jrmQdmF/Screenshot-2022-12-27-at-12-36-53.png

Applied rule to services:

https://i.ibb.co/fkkT5Mk/Screenshot-2022-12-27-at-12-37-31.png

More replies More replies
•

Late reply, but use the solution discussed here: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1358