Restoring original visitor IPs: Logging visitor IP addresses with mod_cloudflare

Restoring original visitor IPs: Logging visitor IP addresses with mod_cloudflare

Posted by Cloudflare on 2019-11-28 09:30:00

Overview

Cloudflare includes the original visitor IP address in the X-Forwarded-For and CF-Connecting-IP headers.

  • These headers can restore the originating IP of your visitors or include them in your logs.
  • However, the configuration process depends on what web server you’re using.

See Restoring Original Visitor IPs: Option 1 for more information on installing mod_cloudflare.

Restoring visitor IPs by web server type

See below for instructions on how to configure mod_cloudflare to log original visitor IPs based on your web server type:

Nginx

1. Use the following Nginx module and the following configuration parameters:

set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;

use any of the following two

real_ip_header CF-Connecting-IP;
#real_ip_header X-Forwarded-For;

That list of prefixes needs to be updated regularly, and we publish the full list in Cloudflare IP addresses.

2. To Include the original visitor IP in your logs, add the variables $http_cf_connecting_ip and $http_x_forwarded_for in the log_format directive.

Also see: Cloudflare and Nginx