mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 09:25:55 +03:00
[GH-ISSUE #1358] X-forwared-for shows Cloudflare IP instead of real IP #1077
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1077
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @bernikr on GitHub (Aug 28, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1358
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
When using Cloudflare infront of NPM, NPM populates the
X-forwarded-forheader with the cloudflare IP instead of the real IP that cloudflare provices in itsX-forwarded-forheader. I would expect NPM to check if the source IP is one of cloudflare's and trust theX-forwarded-forheader in that case. This seemd to be a feature in2.6.0but broken in all verisons afterwards.Nginx Proxy Manager Version
2.9.8To Reproduce
Set up a cloudflare domain and let it point to NPM. If you now navigate to the site the server behind NPM will get one of cloudflare's IPs as the
X-forwarded-forheader instead of the client IPExpected behavior
Show the real client IP that cloudflare reports in the
X-forwarded-forheader.Operating System
Synology NAS
Additional context
The closed issues #112 and #811 both suggest using the following settings as a workaround:
This is however a major security risk as it doesnt check if the request is actually coming from cloudflare. It allows anyone with knowledge of your IP to send requests pretending to be from cloudflare with an
CF-Connecting-IPheader set to any IP they want, (including lan ips such as 10.0.0.1) possibly circumventing any IP based security measures.@schevenin commented on GitHub (Sep 4, 2021):
Use v2.6.0 is what I found in my #811
@TritonB7 commented on GitHub (Jan 21, 2022):
Found the following:
set_real_ip_fromdefines trusted addresses that are known to send correct replacement addresses.Source: https://nginx.org/en/docs/http/ngx_http_realip_module.html
nginx configuration file snippet (IPv4 only):
Cloudflare Documentation:
https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs
Cloudflare IPs:
https://www.cloudflare.com/ips
@gmcinalli commented on GitHub (Jan 21, 2022):
Awesome @TritonB7, I've tried it and it seems to work!
@ctrlbrk42 commented on GitHub (Feb 24, 2022):
Is this still not automatic/internal to NPM
v2.9.16?I am migrating to NPM. Previously, I was using this on my own config:
#!/bin/bash echo "#Cloudflare" > /var/www/nginx/cloudflare.conf; for i in $(curl https://www.cloudflare.com/ips-v4); do echo "set_real_ip_from $i;" >> /var/www/nginx/cloudflare.conf; done echo "real_ip_header CF-Connecting-IP;" >> /var/www/nginx/cloudflare.conf;Not ideal but hacky enough to get the job done.
I landed on this thread because am experiencing this issue with my upstream behind NPM, it's not logging the correct IP where it was pre-NPM.
@punksinatra commented on GitHub (Mar 15, 2022):
Not sure if you have fixed this but I saw something here 811 check the post by techc0de maybe you can try it.
@ctrlbrk42 commented on GitHub (Mar 15, 2022):
I switched to Caddy for this particular project.
@bioszombie commented on GitHub (Feb 3, 2023):
Where did you update this? In the GUI or in the compose file?
@gmcinalli commented on GitHub (Feb 3, 2023):
@bioszombie “Custom Nginx Configuration” field in the “Advanced” tab of the proxy host editing modal on the GUI.
@bioszombie commented on GitHub (Feb 3, 2023):
Thank you. That worked!
@wdolan commented on GitHub (Mar 1, 2023):
I am currently trying to get this working with Guacamole and can't seem to figure it out as that isn't working.
I am trying with the below and it doesn't seem to be picking up the remote ip but the ip address of Cloudflare that it is routing through.
Does this look correct? I also tried adding a copy of the real_ip_header line under the location section which made no difference.
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
real_ip_header CF-Connecting-IP;
location / {
proxy_pass http://10.1.11.3:9998/guacamole/;
proxy_cookie_path /guacamole/ /;
}
@gmcinalli commented on GitHub (Mar 1, 2023):
@wdolan I don't think you need the location block, that will be handled by the NPM UI.
@wdolan commented on GitHub (May 18, 2023):
Hello,
Maybe I have something wrong then.
Even then trying to make a few variants on it, I am seeing connections as
being from 127.0.0.1 despite having the below setup.
When I connect through the host from the same network using the machine
name instead of the external FQDN it reports correctly.
Did I miss something?
server {
server_name remote.redacted.net;
location / {
set_real_ip_from 03.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
real_ip_header CF-Connecting-IP;
proxy_pass http://localhost:8080/guacamole/;
proxy_pass http://localhost:8081;
}
managed by Certbot
remote.redacted.net/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
error_page 404 500 502 503 504
https://letmegooglethat.com/?q=why+does+my+server+have+an+error;
}
Any help would be greatly appreciated.
On Thu, May 18, 2023 at 12:39 PM glassman81 @.***>
wrote:
@LuXc-NL commented on GitHub (Feb 29, 2024):
You just saved my day!
@reply2future commented on GitHub (Mar 9, 2024):
If you want to take effect to all your websites, you could add the content to a file
/data/nginx/custom/server_proxy.confwhich is included at the end of every proxy server block. You could find more information from official document@Bluscream commented on GitHub (Apr 7, 2024):
this is a godsend 🙏
here's the latest ips
/portainer/Files/AppData/Config/nginx-proxy-manager $ cat data/nginx/custom/server_proxy.confEDIT: Seems like npm is already fetching these ips, isn't this a reason to implement a simple checkbox to enable cloudflare visitor ips? @jc21
@MrrZed0 commented on GitHub (Apr 10, 2024):
man this worked for me using CasaOS with home assistant and Nginx Proxy Manager and Cloudflare with proxy enabled and now i can access it thanks to this information thanks so much, spend so many hours trying to get it to work
@aerickt commented on GitHub (Nov 26, 2024):
For anyone in the same situation as me: if you're using a Cloudflare zero trust tunnel, I only needed a single set_real_ip_from specifying the local Cloudflare network IP. This is the IP your server will report when visiting through the tunnel
@mrwogu commented on GitHub (Mar 5, 2025):
There is no need to manually specify
set_real_ip_fromfor Cloudflare IP addresses, because Nginx Proxy Manager already includes a built-inip_ranges.conffile that’s automatically generated and refreshed.It’s based on Cloudflare and CloudFront IP addresses. You can check it out here:
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/backend/internal/ip_ranges.js
Simply add the following snippet to your
/data/nginx/custom/server_proxy.confconfiguration:@anver commented on GitHub (Apr 4, 2025):
Nothing works for me, tried everything on this page, still getting the container ip
@github-actions[bot] commented on GitHub (Oct 15, 2025):
Issue is now considered stale. If you want to keep it open, please comment 👍
@enoot commented on GitHub (Dec 9, 2025):
No need to add
include conf.d/include/ip_ranges.conf;.Those configs are included by default.
Just add
real_ip_header X-Forwarded-For;in your proxy host custom config.