mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 09:25:55 +03:00
[GH-ISSUE #268] Cloudflare only switch #237
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#237
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @vrelk on GitHub (Dec 31, 2019).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/268
Could we get an option to enable that would cause a 403 to be returned if the client isn't a cloudflare IP? This would be nice to force direct access, mainly for things like cloudflare access. Seeing as rewriting the client IP is forced, that prevents the normal way of doing this.
@Rustymage commented on GitHub (Jan 9, 2020):
I like this suggestion.
@webbson commented on GitHub (Mar 2, 2020):
I would really like this too, would be really helpful in combination with Cloudflare access to restrict access to certain areas.
I've tried to solve it with a custom config on advanced containing
allow 173.245.48.0/20; allow 103.21.244.0/22; allow 103.22.200.0/22; allow 103.31.4.0/22; allow 141.101.64.0/18; allow 108.162.192.0/18; allow 190.93.240.0/20; allow 188.114.96.0/20; allow 197.234.240.0/22; allow 198.41.128.0/17; allow 162.158.0.0/15; allow 104.16.0.0/12; allow 172.64.0.0/13; allow 131.0.72.0/22; deny all;This however blocks all requests. Inspecting the log shows that the requests are logged with the real IP of the visitor even though the traffic goes through Cloudflare.
Edit: Sorry for line break not working in code block
@Rustymage commented on GitHub (Apr 11, 2020):
I wonder if there is a cloudflare settings toggle?
@Rustymage commented on GitHub (Apr 17, 2020):
This suggests Cloudflare does not add the visitor IP address to the header...
@vrelk commented on GitHub (Apr 18, 2020):
It actually does using X-forwarded-for. The nginx config just replaces the
client IP with the value of that header, which then makes it so you can't
validate that it is a cloudflare IP.
On Fri, Apr 17, 2020, 4:15 PM Anthony notifications@github.com wrote:
@Rustymage commented on GitHub (Apr 20, 2020):
I see - I've now added a hardware firewall on the network which does the heavy lifting of checking for Cloudflare IPs. Problem circumvent and solved.
@netstx commented on GitHub (Mar 5, 2021):
Could this be why my NPM proxy host to a Cloudflare endpoint (website on their CDN) doesn't work for me? I keep getting 403 forbidden error on the page (cloudflare error, not npm).
@github-actions[bot] commented on GitHub (Mar 31, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@github-actions[bot] commented on GitHub (May 10, 2025):
Issue was closed due to inactivity.