Nginx hotlinking prevention while Cloudflare enable

bdspice

Hi.
I want to prevent hotlinking to a specific folder and recursive. But Cloudflare hotlinking not fit for me. So i config nginx server block. Anti-hotlinking working now.But while allowed site is Cloudflare enabled, the site not able to bypass hotlinking.not even in DNS only mood. So i added all ipv4 from https://www.cloudflare.com/ips/ to allow list. still its not working. here is my config file

server {
    listen  80;
    server_name s2.site.com www.s2.com;
    location / {
        root  /home/site;
        index index.php  index.html index.htm;
        try_files $uri $uri/ =404;
    }
    error_page  500 502 503 504  /50x.html;
    location = /50x.html {
        root  /usr/share/nginx/html;
    }

location /movie/ {
    valid_referers none blocked site.com *.site.com *.google.com *.googleusercontent.com *.bing.com *.facebook.com *.twitter.com *.pinterest.com 103.21.244.0/22 103.22.200.0/22 103.31.4.0/22 104.16.0.0/13 104.24.0.0/14 108.162.192.0/18 131.0.72.0/22 141.101.64.0/18 162.158.0.0/15 172.64.0.0/13 173.245.48.0/20 188.114.96.0/20 190.93.240.0/20 197.234.240.0/22 198.41.128.0/17;
    if ($invalid_referer) {
        return 403;
    }
}

location /series/ {
    valid_referers none blocked site.com *.site.com *.google.com *.googleusercontent.com *.bing.com *.facebook.com *.twitter.com *.pinterest.com 103.21.244.0/22 103.22.200.0/22 103.31.4.0/22 104.16.0.0/13 104.24.0.0/14 108.162.192.0/18 131.0.72.0/22 141.101.64.0/18 162.158.0.0/15 172.64.0.0/13 173.245.48.0/20 188.114.96.0/20 190.93.240.0/20 197.234.240.0/22 198.41.128.0/17;
    if ($invalid_referer) {
        return 403;
    }
}


   location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
      fastcgi_param SCRIPT_FILENAME /home/site/$fastcgi_script_name;
        fastcgi_index index.php;
        include fastcgi_params;
   }
}

anyone experinced this before? cloudflare has many confilct with nginx. like rocket loader, always use https not working with reverse proxy.