Get client IP behind cloudflared reverse proxy

[jieyitang]

Hi all,

I’m trying to expose my PVE dashboard to public network using Cloudflare Zero Trust. To get it safer, I plan to use fail2ban. However, seems that its log likes

authentication failure; rhost=::ffff:127.0.0.1

Then I found a solution on 7.4-17. It doesn’t work on any PVE 8.x. At least I found some clues. After some experimenting, the rhost field showed the correct IP. Since I don't know Perl, I hope I didn't do anything wrong. I added this code at line 1423.

if ($request->header('CF-Connecting-IP')) {
    $reqstate->{peer_host} = $request->header('CF-Connecting-IP');
}

Of course, I have no idea what PVEClientIP means, I guess it's another Hack.

 

[jieyitang]

To add, Pseudo IPv4 on Cloudflare should be disabled or some of Class E IPv4 appears in the log if you access them with IPv6.