Getting Real IP Addresses Using CloudFlare, Nginx, and Varnish
By Daniel Miessler on March 6th, 2012: Tagged as System Administration

Logs from Splunk
CloudFlare is a great service that proxies your site’s traffic in order to offer performance gains and filtering options. It can compress and cache static content such as CSS files, JavaScript, and image files and then geographically optimize how they’re given to your users (think CDN).
One annoying issue, however, is the fact that because it’s a proxy you see incoming requests as coming from CloudFlare servers rather than the original client. So if you’re doing any cool data analytics on your server your source IP information will be borked.
There’s an easy way to fix it, however.
I run Nginx as my main webserver, and Ubuntu’s version of the app includes support for the http-real-ip module, which allows you to specify a set of proxy server IPs and the original IP header within the forwarded traffic so you can map it properly.
So, using Nginx, edit your nginx.conf file and add the following to your http section:
http {
set_real_ip_from 204.93.240.0/24;
set_real_ip_from 204.93.177.0/24;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
real_ip_header CF-Connecting-IP;
Restart Nginx and you’ll start seeing original IPs in your logs.
Varnish
If you’re like me and you have Varnish in front of Nginx, there’s one more layer of complexity. With Varnish passing to Nginx you’ll get a source IP of 127.0.0.1 for all requests to Nginx, which is the same problem as above with CloudFlare.
Luckily, the fix is just as simple: just add 127.0.0.1 to the list of proxy IPs so that Nginx pulls the CF-Connecting-IP header out of the Varnish requests just like those from CloudFlare.
http {
set_real_ip_from 204.93.240.0/24;
set_real_ip_from 204.93.177.0/24;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 127.0.0.1/32;
real_ip_header CF-Connecting-IP;
[ Note that the list of CloudFlare IPs changes regularly, so be sure to keep your set of CloudFlare servers updated. ]
::







