# Reverse proxy for Discourse | Real IP masking

**URL:** https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611
**Category:** Self-hosting
**Created:** [August 17, 2023, 8:08pm UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611 "2023-08-17T20:08:47Z")
**Posts on this page:** 1
**Showing post:** 13

<div class="post-metadata">

### Author: ![vifyirusti](https://avatars.discourse-cdn.com/v4/letter/v/bc8723/32.png) [@vifyirusti](https://meta.discourse.org/u/vifyirusti)
#### Post date: [August 19, 2023, 10:49am UTC](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611/13 "2023-08-19T10:49:14Z")

</div>

Thanks for your answer. What you say is theoretically correct. But it is not technically correct and sufficient.

> [@Mailgun leaking server's real IP behind Cloudflare](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/20):
>
> How would that protect you if the attacker fakes their origin? Spoofing that kind of thing is trivial.

> [@Mailgun leaking server's real IP behind Cloudflare](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/21):
>
> Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.

Respects.

---

_[View the full topic](https://meta.discourse.org/t/reverse-proxy-for-discourse-real-ip-masking/275611)._