# Block original client ip instead of Clouldflare source ip

**URL:** <https://discourse.haproxy.org/t/block-original-client-ip-instead-of-clouldflare-source-ip/3921>\
**Category:** Help!\
**Created:** [June 14, 2019, 3:45am UTC](https://discourse.haproxy.org/t/block-original-client-ip-instead-of-clouldflare-source-ip/3921 "2019-06-14T03:45:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fcwan](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@fcwan](https://discourse.haproxy.org/u/fcwan)\
**Post date:** [June 14, 2019, 3:45am UTC](https://discourse.haproxy.org/t/block-original-client-ip-instead-of-clouldflare-source-ip/3921/1 "2019-06-14T03:45:08Z")

</div>

We have a haproxy behind the cloudflare, below is our haproxy’s access log

Jun 14 18:09:29 localhost haproxy[69672]: 172.68.253.118:35540 10.50.0.105:80 565 1442 200 GET /json/alert/alert\_message.json?\_=1560417328974 HTTP/1.1 app main 10.50.0.101 [uat123-technology.com](http://uat123-technology.com) Mozilla/5.0 (Windows NT 10.0; WOW64; rv:67.0) Gecko/20100101 Firefox/67.0 **21.25.23.35** [https://uat123.technology.com/user/login](https://uat123.technology.com/user/login) nginx -\

We would like to block the original client ip which is 21.25.23.35 by acl instead of Clouldflare source ip 172.68.253.118, how to archive it, thank you very much!

Following is our haproxy configuration, it works when the haproxy is first tier, but behind Cloudflare it doesn’t work.  
acl imip src -f /etc/haproxy/im.zone  
acl isip src -f /etc/haproxy/is.zone  
acl itip src -f /etc/haproxy/it.zone  
acl noip src -f /etc/haproxy/no.zone  
acl ptip src -f /etc/haproxy/pt.zone  
acl seip src -f /etc/haproxy/se.zone  
acl twip src -f /etc/haproxy/tw.zone  
acl usip src -f /etc/haproxy/us.zone  
acl whitelist src -f /etc/haproxy/white\_ip\_list  
acl blacklist src -f /etc/haproxy/black\_ip\_list  
acl all src 0.0.0.0/0  
use\_backend app if whitelist  
use\_backend region if blacklist OR deip OR esip OR frip OR gbip OR hkip OR ieip OR imip OR isip OR itip OR noip OR ptip OR seip OR twip OR usip  
use\_backend app if all

---

<div class="post-metadata">

**Author:** ![ciprian.craciun](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/ciprian.craciun/32/722_2.png) [@ciprian.craciun](https://discourse.haproxy.org/u/ciprian.craciun)\
**Post date:** [June 14, 2019, 5:30am UTC](https://discourse.haproxy.org/t/block-original-client-ip-instead-of-clouldflare-source-ip/3921/2 "2019-06-14T05:30:24Z")

</div>

> [@fcwan](#):
>
> We would like to block the original client ip which is 21.25.23.35 by acl instead of Clouldflare source ip 172.68.253.118, how to archive it, thank you very much!

CloudFlare exposes for each request two headers:

- `CF-Connecting-IP` – the original client IP, the one you are looking for;
- `CF-IPCountry` – the country where the request originated from (which might be useful to filter by if you need country-based filtering as it seems you are);

Therefore you can replace your ACL’s with `acl whatever req.fhdr_cnt(CF-Connecting-IP,-1) -f /etc/...`

Or even better `acl whatever [req.fhdr(CF-IPCountry,-1) US UK DE ...`

---

<div class="post-metadata">

**Author:** ![fcwan](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@fcwan](https://discourse.haproxy.org/u/fcwan)\
**Post date:** [June 14, 2019, 9:10am UTC](https://discourse.haproxy.org/t/block-original-client-ip-instead-of-clouldflare-source-ip/3921/3 "2019-06-14T09:10:03Z")

</div>

I use the CF-IPCountry for the country filtering, it works very well, thank you very much.