# Is this the solution for Cloudflare (free) + Mautic + Nginx (visitor's real IP)?
**URL:** https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859
**Category:** Product Support
**Created:** [January 20, 2021, 3:05pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859 "2021-01-20T15:05:27Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Warren](https://forum.mautic.org/u/Warren)
#### Post date: [January 20, 2021, 3:05pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/1 "2021-01-20T15:05:27Z")
Is this the solution for using the free Cloudflare proxied CDN with Mautic and a Wordpress website **so the real visitor’s IP is still shown** in Mautic? (I’m aware Cloudflare in their Enterprise (expensive) edition has support for the proxy protocol … but I’m using the free version which doesn’t allow that.)
**MY SETUP:**
- Mautic 3.2.4 on a separate Ubuntu 20.04 VPS ([MAUTIC.mywebsite.org](http://MAUTIC.mywebsite.org)).
- NGINX Webserver. PHP. 7.3
- WEBSITE: Wordpress (on shared hosting)
**ISSUE** :
Want to use Cloudflare (and its proxying ability) yet still be able to see visitors real IP’s within Mautic.
**Possible Solution?**
Nginx restore real IP address with the ngx\_http\_realip\_module as specified here?
[Nginx restore real IP address when behind a reverse proxy - nixCraft](https://www.cyberciti.biz/faq/nginx-restore-real-ip-address-when-behind-a-reverse-proxy/)
I haven’t a clue what I’m doing so before trying to follow the guide above, could someone confirm if this is the best option and the guide seems ok?
Thank you!
---
### Author:  [@DavidSchargel](https://forum.mautic.org/u/DavidSchargel)
#### Post date: [January 22, 2021, 6:46pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/2 "2021-01-22T18:46:07Z")
I’m going to oversimplify this by saying that the same approach is taken for Cloudflare as it is on most reverse proxy or proxy services that are placed in front of an Nginx web server.
You need to properly set up Nginx via Nginx’s ngx\_http\_realip\_module module and you’ll need to whitelist the Cloudflare IPv4 addresses. You should also prevent IP leaks which need to you enable Cloudflare Authenticated Origin Pull certificates on your Cloudflare Full SSL enabled sites.
Sadly, this is not trivial on your own VPS and likely near-impossible on a shared host. In the end, it might just be safer to turn off the (orange) proxy that comes with the Cloudflare Free Plan.
---
### Author:  [@DavidSchargel](https://forum.mautic.org/u/DavidSchargel)
#### Post date: [January 22, 2021, 6:48pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/3 "2021-01-22T18:48:43Z")
Forgot the link to the [current IPv4 address pool that Cloudflare is using](https://www.cloudflare.com/ips-v4) at any given time.
---
### Author:  [@Warren](https://forum.mautic.org/u/Warren)
#### Post date: [January 23, 2021, 1:26pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/4 "2021-01-23T13:26:33Z")
Thanks @DavidSchargel
So the steps for part one (pertaining to the realip module) would look like this? (Copied from a Linuxbabe tutorial on installing Matomo behind Cloudflare – [Install Matomo Web Analytics (Piwik) on Ubuntu 20.04 with Apache/Nginx](https://www.linuxbabe.com/ubuntu/install-matomo-web-analytics-piwik-ubuntu-20-04-apache-nginx#comment-135630))
> ## Running Matomo Behind Cloudflare CDN
>
> If Matomo is running behind Cloudflare CDN, then Matomo can only see the Cloudflare servers’ IP address. To show the visitors’ real IP address in Nginx, edit the Nginx main configuration file.
>
> sudo nano /etc/nginx/nginx.conf
>
> Add the following directives in _http_ section.
>
> set\_real\_ip\_from 103.21.244.0/22; set\_real\_ip\_from 103.22.200.0/22; set\_real\_ip\_from 103.31.4.0/22; set\_real\_ip\_from 104.16.0.0/12; set\_real\_ip\_from 108.162.192.0/18; set\_real\_ip\_from 131.0.72.0/22; set\_real\_ip\_from 141.101.64.0/18; set\_real\_ip\_from 162.158.0.0/15; set\_real\_ip\_from 172.64.0.0/13; set\_real\_ip\_from 173.245.48.0/20; set\_real\_ip\_from 188.114.96.0/20; set\_real\_ip\_from 190.93.240.0/20; set\_real\_ip\_from 197.234.240.0/22; set\_real\_ip\_from 198.41.128.0/17; set\_real\_ip\_from 199.27.128.0/21; set\_real\_ip\_from 2400:cb00::/32; set\_real\_ip\_from 2606:4700::/32; set\_real\_ip\_from 2803:f800::/32; set\_real\_ip\_from 2405:b500::/32; set\_real\_ip\_from 2405:8100::/32; set\_real\_ip\_from 2c0f:f248::/32; set\_real\_ip\_from 2a06:98c0::/29; # use any of the following two real\_ip\_header CF-Connecting-IP; #real\_ip\_header X-Forwarded-For;
>
> _set\_real\_ip\_from_ defines trusted addresses, in this case Cloudflare IP addresses, that are known to send correct replacement addresses. Save and close the file. Then reload Nginx for the changes to take effect.
>
> sudo systemctl reload nginx
and for the second part: ([https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls](https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls))
> Setting up NGINX to use TLS Authenticated Origin Pulls
>
> For authenticated origin pulls to work, use _Full_ **SSL** in the Cloudflare **SSL/TLS** app, and update the origin web server SSL configuration. Download [origin-pull-ca.pem](https://support.cloudflare.com/hc/en-us/article_attachments/360044928032/origin-pull-ca.pem)origin-pull-ca.pem and place the certificate in a file on your origin web server, for example in _/etc/nginx/certs/cloudflare.crt_
>
> Then add these lines to the SSL configuration for your origin web server:
>
> ssl\_client\_certificate /etc/nginx/certs/cloudflare.crt; ssl\_verify\_client on;
Does that pretty well summarise the steps needed to be taken?
---
### Author:  [@DavidSchargel](https://forum.mautic.org/u/DavidSchargel)
#### Post date: [January 23, 2021, 2:24pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/5 "2021-01-23T14:24:49Z")
Oh boy…you’re potentially asking for a world of hurt if you incorrectly muck with nginx.conf files. Nginx setups are often not the same from host to host and this code here would **not** work for the multiple servers I maintain. Chances are very good that your host has it setup the way they want so be careful!
Yes, `set_real_ip_from` within the `http` context is the correct implementation.
Here are some potential trouble spots:
- You’ll need a system.d/cronjob to update this list as Cloudflare updates its IP ranges. It’s updated 2-4 times a year.
- Depending on your host, you _may_ need an additional `real_ip_recursive on;` directive in addition to `real_ip_header CF-Connecting-IP;` or `real_ip_header X-Forwarded-For;` Ask your host.
- Before reloading nginx, test with `nginx -t`.
- Interference from the server-side firewall(s). Depending on the configuration, UFW, IPTables, and CSF might not be too happy so be sure to whitelist appropriately there.
- Check if your nginx has IPv6 Support. If not, drop those references.
If you’re not into debugging nginx, the likely best practice here is to create a brand new .conf file and use nginx `include` directive to reference it within nginx.conf. That should be the one and only modification made to the original nginx.conf.
For those reading this thread later, this is the nature of the implementation for another reverse proxy in front of nginx (Varnish, HAProxy, Google PageSpeed service, Cloud DDOS proxy, CloudFlare, Incapsula, etc.). Here’s the IP ranges for [AWS Cloudfront](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html) and [Incapsula](https://support.incapsula.com/hc/en-us/articles/200627570-Restricting-direct-access-to-your-website-Incapsula-s-IP-addresses-).
* * *
For Authenticated Origin Pulls…
Unless you’re concerned with IP leaks to your origin nginx server, I wouldn’t bother with going for Full Strict on the Cloudflare SSL. Full SSL fits most use cases. On top of that, authenticated Origin Pull certs expire and you’d need some sort of system - manual or otherwise - for updating them.
---
### Author:  [@bellafronte](https://forum.mautic.org/u/bellafronte)
#### Post date: [January 25, 2021, 12:34pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/6 "2021-01-25T12:34:44Z")
Your host provider has mod\_cloudflare available?
> **[Restoring original visitor IPs - Option 1: Installing mod\_cloudflare](https://support.cloudflare.com/hc/en-us/articles/200170916-Restoring-original-visitor-IPs-Option-1-Installing-mod-cloudflare)**
>
> Learn how to install mod\_cloudflare and log your visitor’s original IP address at your origin server.
> Overview
> Install mod\_cloudflare
> Remove mod\_cloudflare
> Related resources
> OverviewCloudflare no l...
---
### Author:  [@DavidSchargel](https://forum.mautic.org/u/DavidSchargel)
#### Post date: [January 25, 2021, 2:56pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/7 "2021-01-25T14:56:28Z")
> [@bellafronte](#):
>
> Your host provider has mod\_cloudflare available?
I think that mod\_cloudflare is for Apache & LiteSpeed only and that `set_real_ip_from` is the appropriate equivalent for nginx.
---
### Author:  [@Warren](https://forum.mautic.org/u/Warren)
#### Post date: [January 27, 2021, 5:44pm UTC](https://forum.mautic.org/t/is-this-the-solution-for-cloudflare-free-mautic-nginx-visitors-real-ip/17859/8 "2021-01-27T17:44:39Z")
Thanks, David … I’m looking at and trying to assimilate the info 🙂