How to fix all traffic showing as coming from Cloudflare servers instead of the user's browser IP

Support
,
1

When deploying Discourse in a 1Panel container with a reverse proxy and using Cloudflare CDN for the domain, how can I resolve the issue where all traffic appears to originate from Cloudflare’s servers instead of the users’ actual browser IP addresses?

2

You want to use the Cloudflare template in your app.yml.

2 Likes
3

Tried it, but it didn’t work :rofl:. The failure might be because I deployed it using a 1panel container and used a reverse proxy?

4

Can you edit the nginx configuration file directly? If so, make the changes suggested here. And now after reloading the nginx service it should be working. Hope this helps!

1 Like
5

Curious on the reasons for running 2 reverse proxies? One at the hosting company and CloudFlare. Is there a technical reason?

1 Like
6

I deployed Discourse using containers via the 1Panel server management panel (open-source) for convenient server management.

The 1Panel architecture is: User -> Cloudflare -> 1Panel Nginx -> Discourse container.

My understanding is that even if I modify the app.yml configuration in Discourse, 1Panel’s Nginx still sits between Cloudflare and Discourse.

7

So it is a technical constraint introduced by 1panel.

Are you running multiple servers or only Discourse on the VPS? If you are only running discourse you probably do not need 1panel. Unless, there is a technical reason you need 1 panel.

My discourse is native on a vps behind cloudflare. This setup works.

8

Besides Discourse, there’s also OpenClaw :grinning_face:

1 Like
9

Almost certainly.

Is the IP you’re seeing teh 1panel container IP?

10

When viewing users as an administrator, the last used IP address displayed is a Cloudflare IP address.

11

Have you implemented this?

https://support.cpanel.net/hc/en-us/articles/360051107513-How-to-restore-visitors-IP-with-mod-remoteip#:~:text=The%20Apache%20mod_remoteip%20module%20restores%20the%20original,instead%20of%20the%20original%20visitor’s%20IP%20address.

This is the fix for Apache to use the end user ip instead of the cloudflare ip address.

1 Like
12

Thanks, I’m using nginx. I’ve looked up some tutorials that involve configuring the host’s nginx for reverse proxying. I’ll give it a try when I have some time.

13

Did you install the cloudflare template as suggested? If not, then why are you asking for help here?

14

Cloudflare template? I’ve already modified the yml configuration file and enabled the Cloudflare template. However, I’m deploying Discourse via 1Panel containers (1Panel architecture: User → Cloudflare → 1Panel Nginx → Discourse container). Just changing the yml file isn’t enough; you also need to modify the reverse proxy Nginx configuration file inside 1Panel. I don’t have time right now, so I haven’t gotten around to making those changes yet.

15

It sounds like you need to modify 1Panel’s instance of nginx to utilize its real_ip functionality for user requests. Cloudflare sends along this information with the CF-Connecting-IP header, and you can utilize that header to tell nginx what to do with itself.

It would likely be worthwhile to build some script-based automation to regularly download cloudflare’s proxy address lists (ipv4, ipv6) to keep your nginx real_ip ranges updated.

If you don’t have access to your 1Panel nginx.conf file, you’re probably out of luck. Nginx’s real_ip + cloudflare’s CF-Connecting-IP header is how this problem is intended to be solved if you’re managing your own reverse proxy in front of self-hosted Discourse.

1 Like