Articles in this section

See more

Incorrect IP addresses are logged in the access logs of Plesk domains behind a Cloudflare CDN proxy or Google Cloud Load Balancing

Avatar
Daniel Yordanov
Updated
Follow
Plesk for Linux kb: technical Plesk Obsidian for Linux Plesk Onyx for Linux ABT: Group A

Applicable to:

  • Plesk for Linux

Symptoms

  • Plesk is running behind a Cloudflare CDN proxy or Google Cloud Load Balancing.

  • Internal IP address of load balancer, Plesk server or CDN proxy is displayed in domain logs (Domains > example.com > Logs) instead of the client device public IP (real visitor's IP):

    CONFIG_TEXT: Access 192.0.2.2 200 GET / HTTP/1.0

Cause

CDN Proxies and load balancers rewrite the origin IP address and specify the client's IP address in an additional HTTP header.

Resolution

  1. Log into the server via SSH
  2. Using the next command verify that the remoteip_module Apache module is enabled:

    # (apache2ctl -M || httpd -M) | grep remoteip_module

    The output below means that remoteip_modulemodule is enabled: 

    CONFIG_TEXT: remoteip_module (shared)

  3. If the remoteip_moduleis not enabled, enable it:
    Ubuntu/Debian-based OS:

    # a2enmod remoteip

    Rhel-based OS:
    Add the following line:

    CONFIG_TEXT: LoadModule remoteip_module modules/mod_remoteip.so

    to /etc/httpd/conf.modules.d/00-base.conf and restart httpd:

    # systemctl restart httpd

Then apply one of the following solutions:

Click on a section to expand

Solution for a single domain with nginx enabled and PHP served via Apache (Proxy mode enabled)

  1. Log into Plesk

  2. Go to Domains > example.com > Apache & Nginx Settings and add the following content to both Additional directives for HTTP and Additional directives for HTTPS:

    Note: The remoteip module should be enabled in Tools & Settings > Apache Web Server

    CONFIG_TEXT: RemoteIPHeader X-Forwarded-For

  3. Go to Domains > example.com > Apache & nginx Settings, and add the following content to the Additional nginx directives:

    CONFIG_TEXT: real_ip_header X-Forwarded-For;
    real_ip_recursive on;

  4. Scroll down and press Apply
Solution for a single domain with Nginx enabled

  1. Log into Plesk

  2. Go to Domains > example.com > Apache & nginx Settings, and add the following content to the Additional nginx directives:

    • For Cloudflare:

      CONFIG_TEXT: real_ip_header CF-Connecting-IP;

    • For Cloudflare Load Balancing:

      CONFIG_TEXT: set_real_ip_from 130.0.0.0/8;
      set_real_ip_from 35.0.0.0/8;
      set_real_ip_from 103.21.244.0/22;
      set_real_ip_from 103.22.200.0/22;
      set_real_ip_from 103.31.4.0/22;
      set_real_ip_from 104.16.0.0/13;
      set_real_ip_from 104.24.0.0/14;
      set_real_ip_from 108.162.192.0/18;
      set_real_ip_from 131.0.72.0/22;
      set_real_ip_from 141.101.64.0/18;
      set_real_ip_from 162.158.0.0/15;
      set_real_ip_from 172.64.0.0/13;
      set_real_ip_from 173.245.48.0/20;
      set_real_ip_from 188.114.96.0/20;
      set_real_ip_from 190.93.240.0/20;
      set_real_ip_from 197.234.240.0/22;
      set_real_ip_from 198.41.128.0/17;
      set_real_ip_from 2400:cb00::/32;
      set_real_ip_from 2606:4700::/32;
      set_real_ip_from 2803:f800::/32;
      set_real_ip_from 2405:b500::/32;
      set_real_ip_from 2405:8100::/32;
      set_real_ip_from 2c0f:f248::/32;
      set_real_ip_from 2a06:98c0::/29;
      real_ip_header X-Forwarded-For;
      real_ip_recursive on;

      Note: It might be required to add other IP address ranges to the set_real_ip_from based on the Google Compute Engine zone used.

 

Solution for a single domain with Apache only

  1. Log into Plesk

  2. Go to Domains > example.com > Apache & Nginx Settings and add the following content to both Additional directives for HTTP and Additional directives for HTTPS:

    Note: The remoteip module should be enabled in Tools & Settings > Apache Web Server

    • For Cloudflare:

      CONFIG_TEXT: RemoteIPHeader CF-connecting-IP

    • For Google Cloud Load Balancing:

      CONFIG_TEXT: RemoteIPHeader X-Forwarded-For
      RemoteIPInternalProxy 130.0.0.0/8
      RemoteIPInternalProxy 35.0.0.0/8

Server-wide solution with Nginx enabled

  1. Connect to the server via SSH.

  2. Download and execute the next script in order to add the Nginx variables globally:

    # curl -LO https://raw.githubusercontent.com/plesk/kb-scripts/master/cf-nginx-ip-passthrough/cf.sh && chmod 700 /root/cf.sh

  3. Execute the script:

    # bash cf.sh

Note: The script could be called at the required intervals using Plesk Scheduled Tasks.

Server-wide solution with Apache only

  1. Connect to the server via SSH

  2. Make sure that /etc/httpd/conf/httpd.conf(on Debian-based OS the path is /etc/apache2/apache2.conf) has the following LogFormat:

    CONFIG_TEXT: LogFormat "%a %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined

  3. Create a new configuration file:
    On Rhel-based OS: /etc/httpd/conf.d/cloudflare.conf
    On Debian-based OS: /etc/apache2/conf-enabled/cloudflare.conf

  4. Add Cloudflare IP addresses in the file created on step 3:

    CONFIG_TEXT: RemoteIPHeader CF-Connecting-IP
    RemoteIPTrustedProxy 173.245.48.0/20
    RemoteIPTrustedProxy 103.21.244.0/22
    RemoteIPTrustedProxy 103.22.200.0/22
    RemoteIPTrustedProxy 103.31.4.0/22
    RemoteIPTrustedProxy 141.101.64.0/18
    RemoteIPTrustedProxy 108.162.192.0/18
    RemoteIPTrustedProxy 190.93.240.0/20
    RemoteIPTrustedProxy 188.114.96.0/20
    RemoteIPTrustedProxy 197.234.240.0/22
    RemoteIPTrustedProxy 198.41.128.0/17
    RemoteIPTrustedProxy 162.158.0.0/15
    RemoteIPTrustedProxy 104.16.0.0/13
    RemoteIPTrustedProxy 104.24.0.0/14
    RemoteIPTrustedProxy 172.64.0.0/13
    RemoteIPTrustedProxy 131.0.72.0/22
    RemoteIPTrustedProxy 2400:cb00::/32
    RemoteIPTrustedProxy 2606:4700::/32
    RemoteIPTrustedProxy 2803:f800::/32
    RemoteIPTrustedProxy 2405:b500::/32
    RemoteIPTrustedProxy 2405:8100::/32
    RemoteIPTrustedProxy 2a06:98c0::/29
    RemoteIPTrustedProxy 2c0f:f248::/32

  5. Restart Apache service:

    • For CentOS\RHEL:

      # systemctl restart httpd

    • For Debian\Ubuntu:

      # systemctl restart apache2

Note: For additional information on proper HTTP headers with the client's IP address for non-listed services contact the support of the proxy/load-balancing service or its system administrator.

Comments

9 comments

Sort by Date Votes
  • Avatar
    Emanuel Schiendorfer

    The solution for nginx (single domain) is not working:

    If I just add real_ip_header CF-Connecting-IP; The IP is still wrong...

    If I try to add the whole code given, I get an error:

    Invalid nginx configuration: nginx: [emerg] "real_ip_header" directive is duplicate in /var/www/vhosts/system/something/conf/vhost_nginx.conf:27 nginx: configuration file /etc/nginx/nginx.conf test failed
    0
    Comment actions Permalink
  • Avatar
    Emanuel Schiendorfer

    Now it's working for me... You have to use the load balancer config, even if you don't use cloudflare load balancer... AND only use the load balancer config. Copying both leads to an error as the line 

    real_ip_header CF-Connecting-IP;

    is duplicated. Pretty obvious, but if you just copy paste, you might run into it ^^

    0
    Comment actions Permalink
  • Avatar
    Mohd Yaakob

    I change this code on line 21 from

    sed -i '1ireal_ip_header CF-Connecting-IP' $CFTEMP

    To

    sed -i '1ireal_ip_header X-Forwarded-For' $CFTEMP

    and work fine to me.

    0
    Comment actions Permalink
  • Avatar
    Stefan Yakubov

    Hi, Mohd Yaakob

    Could you clarify the conditions, when that change in the script is necessary?

    Out of the box on staging environment with CloudFlare-proxied domain I did not encounter issues.

    0
    Comment actions Permalink
  • Avatar
    Mohd Yaakob

    when i execute cf.sh my server still log cloudflare ip. i check on php info i cant find

    $_SERVER['CF_CONNECTING_IP']

    i just find

    $_SERVER['HTTP_X_FORWARDED_FOR']

    That why i change a little to cf.sh script.

    0
    Comment actions Permalink
  • Avatar
    Stefan Yakubov

    Mohd Yaakob

    It's not related to PHP anyhow.

    Unless custom configuration is being applied, provided script does work out of the box as is.

    In case it does the trick in your case, thanks for sharing. It might be useful for some.

    0
    Comment actions Permalink
  • Avatar
    Q

    This script at https://raw.githubusercontent.com/plesk/kb-scripts/master/cf-nginx-ip-passthrough/cf.sh appears to have stopped working over the past 24 hours. This causes the script to halt silently, disabling the Cloudflare nginx configuration.

    Debugging it shows that it is failing with the CURL call. Perhaps there has been a change at Cloudflare...

    Adding a trailing slash (/) after the URL for both IPv4 and IPv6 requests in the curl commands seems to fix the issue. Change the following lines in the cf.sh script:

    Change from:

    curl -sS https://www.cloudflare.com/ips-v4 >$cfTemp && printf "\n" >> $cfTemp
    curl -sS https://www.cloudflare.com/ips-v6 >>$cfTemp

    to:

    curl -sS https://www.cloudflare.com/ips-v4/ >$cfTemp && printf "\n" >> $cfTemp
    curl -sS https://www.cloudflare.com/ips-v6/ >>$cfTemp

    Then remove the cf-stop file and rerun the script:

    rm /etc/nginx/conf.d/cf-stop && bash cf.sh
    0
    Comment actions Permalink
  • Avatar
    Stefan Yakubov

    Hello, Q

    Thank you for the feedback. `-L` option was added to the curl command in script so it'll follow redirection from now on.

    0
    Comment actions Permalink
  • Avatar
    adrian TNT

    This is my exact list that I add under 

    Domains > [DOMAIN NAME] > Apache & nginx Settings > Additional nginx directives 

    For some reason it didn't work to specify the same under service plan and set this for all domains.

    But it works for individual domains.

    The way I see it real_ip_header CF-Connecting-IP tells it from what header field to take the real ip (CF-Connecting-IP in this case), and the list of set_real_ip_from [...] tells it from what parent source to trust this real ip field, otherwise a site visitor can provide this CF-Connecting-IP header field containing a fake ip.

    So you need both these real_ip_header and set_real_ip_from, not sure why above says "for Cloudflare Load Balancing" only.

    # live lists:
    # https://www.cloudflare.com/ips-v4
    # https://www.cloudflare.com/ips-v6
    #

    # !!! important
    real_ip_header CF-Connecting-IP;

    set_real_ip_from 173.245.48.0/20;
    set_real_ip_from 103.21.244.0/22;
    set_real_ip_from 103.22.200.0/22;
    set_real_ip_from 103.31.4.0/22;
    set_real_ip_from 141.101.64.0/18;
    set_real_ip_from 108.162.192.0/18;
    set_real_ip_from 190.93.240.0/20;
    set_real_ip_from 188.114.96.0/20;
    set_real_ip_from 197.234.240.0/22;
    set_real_ip_from 198.41.128.0/17;
    set_real_ip_from 162.158.0.0/15;
    set_real_ip_from 104.16.0.0/13;
    set_real_ip_from 104.24.0.0/14;
    set_real_ip_from 172.64.0.0/13;
    set_real_ip_from 131.0.72.0/22;

    set_real_ip_from 2400:cb00::/32;
    set_real_ip_from 2606:4700::/32;
    set_real_ip_from 2803:f800::/32;
    set_real_ip_from 2405:b500::/32;
    set_real_ip_from 2405:8100::/32;
    set_real_ip_from 2a06:98c0::/29;
    set_real_ip_from 2c0f:f248::/32;
    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles