Many of us use CloudFlare to protect our websites and services from malicious activity. In this post, I’ll show you how to configure Fail2ban to block bad actors directly on CloudFlare. Nginx setup Before we start, make sure your Nginx logs contain real client IP addresses. If your logs still show CloudFlare IPs, follow my earlier guide: Handling Real IP in Nginx Behind Load Balancer and Cloudflare ...
When running a website behind a load balancer and Cloudflare, handling client IPs in Nginx can be tricky. Different setups use different headers to pass the real IP: Custom Domains via Cloudflare: Cloudflare sends the real client IP in the CF-Connecting-IP header. Direct CNAME to Load Balancer: The load balancer sets the real client IP in the X-Forwarded-For header. What is the challenge? Nginx’s real_ip_header directive doesn’t support variables. This limitation means you can’t conditionally choose between headers like X-Forwarded-For and CF-Connecting-IP. ...