# פרוקסי הפוך ל-Discourse | מיסוך IP אמיתי
**URL:** https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611
**Category:** Self-hosting
**Created:** [17 באוגוסט, 2023, 8:08pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611 "2023-08-17T20:08:47Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [17 באוגוסט, 2023, 8:08pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/1 "2023-08-17T20:08:47Z")
I want to setup a reverse proxy that will work correctly with Discourse. My goal is to mask the real IP address of the server.
What features do I need to buy a server for this?
What should I do for the reverse proxy server and what should I do for the discourse server.
Can you help with the steps to follow?
I couldn’t find an understandable guide for non-professionals like me.
I wish this topic to be a guide for new users.
I ask for your help. Thanks in advance. Respect.
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [17 באוגוסט, 2023, 8:25pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/2 "2023-08-17T20:25:38Z")
[https://meta.discourse.org/search?q=reverse%20proxy](https://meta.discourse.org/search?q=reverse%20proxy)
> [@What's the proper way to set up Discourse behind a reverse proxy?](https://meta.discourse.org/t/whats-the-proper-way-to-set-up-discourse-behind-a-reverse-proxy/30262/2):
>
> if you expose a port/ip, all traffic for that port will be handled. The only issue you need to resolve is IP forwarding. So you need to customize NGINX to allow for the forwarded IP addresses so it does not look like all traffic is coming from 1 IP, there is a post here on meta covering that.
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [17 באוגוסט, 2023, 9:00pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/3 "2023-08-17T21:00:12Z")
This is not my area of expertise and nothing comes to mind when I read these topics.
I actually wanted to create a step-by-step guide for this. Both for me and for non-experts like me.
Thanks anyway.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [17 באוגוסט, 2023, 9:47pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/4 "2023-08-17T21:47:47Z")
Use [this guide](https://meta.discourse.org/t/run-other-websites-on-the-same-machine-as-discourse/17247) and change the `proxy_pass` line to the IP address of the real Discourse installation.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [17 באוגוסט, 2023, 9:49pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/5 "2023-08-17T21:49:21Z")
Also remember to add correct `set_real_ip_from` directives in the Discourse container for the frontend’s ipv4 and ipv6 addresses. (See cloudflare.template.yml for an example)
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [17 באוגוסט, 2023, 10:16pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/6 "2023-08-17T22:16:06Z")
> [@vifyirusti](#):
>
> My goal is to mask the real IP address of the server.
Maybe you want cloudflare? I think you may need to make sure that mail doesn’t expose your ip.
Unless you have reason to believe that people hate you or your forum, it’s likely a waste of time.
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [17 באוגוסט, 2023, 10:19pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/7 "2023-08-17T22:19:36Z")
> [@Reverse proxy for Discourse | Real IP masking](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/4):
>
> Use [this guide](https://meta.discourse.org/t/run-other-websites-on-the-same-machine-as-discourse/17247) and change the proxy\_pass line to the IP address of the real Discourse installation.
> [@Reverse proxy for Discourse | Real IP masking](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/5):
>
> Also remember to add correct set\_real\_ip\_from directives in the Discourse container for the frontend’s ipv4 and ipv6 addresses. (See cloudflare.template.yml for an example)
I will try these. Thanks.
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [17 באוגוסט, 2023, 10:29pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/8 "2023-08-17T22:29:56Z")
Thanks for your reply. I’m using an external smtp server and a different CDN.
Cloudflare is not enough to hide the IP address. iplogger. It is possible to learn the IP address in tools such as org. I couldn’t see anything in the discourse settings to prevent this. So iplogger. Thanks to a link taken from the org address, it is possible to learn the real IP address of the server at the entry points of the forum.
I’m thinking of using Discourse for a political party. Those with opposing views try too many avenues of attack. I need to build this forum solid.
Here’s what I pictured in my mind;
VPS - (discourse installed- external cdn, external smtp) — \> reverse proxy (HAProxy- layer 7 ddos - reverse proxy) — \> cloudflare
To stop using HAProxy / Reverse proxy, I need to ban URL in the forum. I don’t know how to prevent this from all inputs.
Thaks. Respect.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [18 באוגוסט, 2023, 6:11am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/9 "2023-08-18T06:11:56Z")
> [@vifyirusti](#):
>
> Cloudflare is not enough to hide the IP address. iplogger. It is possible to learn the IP address in tools such as org.
It should be, if Cloudflare can’t hide it then your reverse proxy also cannot. But it’s possible, so you must have a configuration mistake somewhere. What do you mean with “such as org” ?
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [19 באוגוסט, 2023, 2:00am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/10 "2023-08-19T02:00:39Z")
> [@How to protect a server's IP from being exposed?](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424):
>
> My forum has CloudFlare and when inserting a URL from this service, I can get the real IP of my server, this is a big gift for DDoS attacks. I checked it on the Discourse Meta and this forum don’t have URL-filtration too. Blocked domain by IPlogger can’t help because the attacker can use a custom domain using the script for logger ip address. I think need use whitelist to filter domain who can use onebox. Example: if admin allow only url from Youtube, Twitter, Imgur, all other ur…
Actually, I’m talking about the above. A URL can be created with the help of the tool available at “[iplogger.org](http://iplogger.org)”. When you take this URL and place it in the thread in the discourse forum, you can learn the real IP address of the server. Because the VPS where discourse is installed is making a direct request to the connection placed inside the topic. This allows the server’s real IP address to be exposed.
In the topic below, it says that a proxy server should be set up for outgoing requests from the server.
> [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720/8):
>
> Yes you will need to set up a proxy for outgoing traffic on your server this has nothing to do with us.
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [19 באוגוסט, 2023, 2:14am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/11 "2023-08-19T02:14:22Z")
I wrote it with the help of a translation. Sorry for the typo. My English is not very good.
Also, after putting cloudflare in front of the VPS, the IP address of the server is masked. There is no problem here.
However, the outgoing request from the server shows the ip address. “[https://iplogger.org/](https://iplogger.org/)” does the job of exposing the IP address very well.
If this is due to misconfiguration it would be great to know how to fix it.
An end-to-end guide will help many people.
> [@How to protect a server's IP from being exposed?](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424/6):
>
> please share, i have change many time ip address coz the hacker get my ip from iplogger.
> [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720/24):
>
> Is it not possible to disable discourse’s parsing of these images/urls that cause the IP leak of the origin server? Or at least make it so there is a whitelist of a certain set of domains that will be parsed?
> [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720/5):
>
> From what I understand discourse fetches the link server side to generate the preview. Post a malicious link controlled by attacker, check server access logs, get IP address attack and site go down. Easy peasy
> [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720):
>
> I keep my forum’s server behind cloud flare due to a large amount of attacks against the site. The link previews and emails can leak the server’s backend IP Address. The email issue was resolved by setting up a SMTP relay that strips headers (if the user pulls email headers to get the IP, they get the relay and not the forum’s IP). Is there a way to make the link previews go through a proxy server?
Respects.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [19 באוגוסט, 2023, 6:53am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/12 "2023-08-19T06:53:49Z")
> [@vifyirusti](#):
>
> If this is due to misconfiguration it would be great to know how to fix it.
I think you fix it by having your firewall allow connections only from cloudflare servers. This way it will not matter if your ip address is known.
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [19 באוגוסט, 2023, 10:49am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/13 "2023-08-19T10:49:14Z")
Thanks for your answer. What you say is theoretically correct. But it is not technically correct and sufficient.
> [@Mailgun leaking server's real IP behind Cloudflare](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/20):
>
> How would that protect you if the attacker fakes their origin? Spoofing that kind of thing is trivial.
> [@Mailgun leaking server's real IP behind Cloudflare](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/21):
>
> Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.
Respects.
---
### Author:  [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [19 באוגוסט, 2023, 11:46am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/14 "2023-08-19T11:46:03Z")
How do I get the outgoing traffic from the VPS to go through CloudFlare?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [19 באוגוסט, 2023, 1:18pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/15 "2023-08-19T13:18:28Z")
You need a proxy server for that, not a reverse proxy. You can Google for “free proxy server” to find some, or run something like Squid on a vm that allows ssh only from your ip, perhaps behind a bastion.
I’m not quite sure how to configure discourse to use it, but it might be as simple as setting an env variable.