Using CloudFlare DNS results in all user IPs being CloudFlare based

Comments

• WSS Member

  August 2017

  That's the way a proxy-style filter works.
• Aidan Member

  August 2017

  Take a look at the following:
  https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs

  Thanked by 2MasonR Ramsterdam
• MasonR Community Contributor

  August 2017 edited August 2017

  You should be able to configure your webserver to restore the actual user's IP address using the HTTP headers.

  See: https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs

  edit: Damn @Aidan, you're too quick for me.

  Thanked by 1Ramsterdam
• alilet Member

  August 2017

  Wow didn't know that.

  This is a new forum and a couple of days ago I saw 5, 6 new signups all from Russia having .ru email address (they are all bots/spammers) but when I checked their IP, it was pointing to CloudFlare so I thought that may be they are from within CloudFlare network i.e. they might be working there haha

  But today I noticed my own IP is CloudFlare that's when I knew something is wrong.
• Iam Member

  August 2017 edited August 2017

  I use it in my code:

  if (!isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
     $visitorIP = $_SERVER['REMOTE_ADDR'];
  } else {
     $visitorIP = $_SERVER['HTTP_CF_CONNECTING_IP'];
  }
• WSS Member

  August 2017

  UGH.

  There are so many reasons why not to blindly trust a server global.

  Or PHP.
• MasonR Community Contributor

  August 2017

  @WSS said: Or PHP.

  
• Iam Member

  August 2017

  @WSS said:
  UGH.

  There are so many reasons why not to blindly trust a server global.

  Or PHP.

  Yes but its work I have simple use case using it. Only allow Google robot to crawl the site by using some kind of trap. If any robot follow the hidden link, check the header, if it said "google" than check the IP again arin, ripe etc. if yes it Google than let him pass.
• WSS Member

  August 2017

  @Iam said:

  @WSS said:
  UGH.

  There are so many reasons why not to blindly trust a server global.

  Or PHP.

  Yes but its work I have simple use case using it. Only allow Google robot to crawl the site by using some kind of trap. If any robot follow the hidden link, check the header, if it said "google" than check the IP again arin, ripe etc. if yes it Google than let him pass.

  What's that do to page load time? 30, 40 seconds?
• Iam Member

  August 2017

  WSS said: What's that do to page load time? 30, 40 seconds?

  Less than 1 second actually credit to this https://perishablepress.com/blackhole-bad-bots/ I just improve the codes for my own use case.

  Just visit the demo page to see the page load.
• alilet Member

  August 2017

  I updated my nginx.conf and it worked. I can see real IPs in mybb forum now.

  Thanked by 1Aidan
• user54321 Member

  August 2017

  you can do that a lot more efficient https://support.google.com/webmasters/answer/80553?hl=en

  Thanked by 1Iam
• xve Member

  August 2017

  Install https://www.cloudflare.com/technical-resources/#mod_cloudflare and it will show real ips.
• Iam Member

  August 2017 edited August 2017

  @user54321 said:
  you can do that a lot more efficient https://support.google.com/webmasters/answer/80553?hl=en

  Yes noticed about that earlier. Planning to block DMCA bot either