Many of us use CloudFlare to protect our websites and services from malicious activity. In this post, I’ll show you how to configure Fail2ban to block bad actors directly on CloudFlare. Nginx setup Before we start, make sure your Nginx logs contain real client IP addresses. If your logs still show CloudFlare IPs, follow my earlier guide: Handling Real IP in Nginx Behind Load Balancer and Cloudflare ...
On Aug 12, 2025, NGINX announced native support for the ACME protocol: https://blog.nginx.org/blog/native-support-for-acme-protocol This is a great improvement because you no longer need extra tools to issue SSL certificates. The first release supports only the HTTP-01 challenge, so wildcard certificates are not possible yet. For wildcards you need DNS-01 with DCV delegation . Let’s see how it works. ...
Public IP Address You can always use your own nginx instead of using 3rd party services when you need to know your public IP. Like this: # Public IP location = /ip { default_type text/plain; return 200 $remote_addr; } Or if you need it in JSON format like this: # Public IP JSON location = /ip_json { default_type application/json; return 200 "{\"ip\":\"$remote_addr\"}"; }
When running a website behind a load balancer and Cloudflare, handling client IPs in Nginx can be tricky. Different setups use different headers to pass the real IP: Custom Domains via Cloudflare: Cloudflare sends the real client IP in the CF-Connecting-IP header. Direct CNAME to Load Balancer: The load balancer sets the real client IP in the X-Forwarded-For header. What is the challenge? Nginx’s real_ip_header directive doesn’t support variables. This limitation means you can’t conditionally choose between headers like X-Forwarded-For and CF-Connecting-IP. ...