# CF-Connecting-IP

**URL:** https://discourse.haproxy.org/t/cf-connecting-ip/6153
**Category:** Help!
**Created:** [January 19, 2021, 3:50pm UTC](https://discourse.haproxy.org/t/cf-connecting-ip/6153 "2021-01-19T15:50:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![heliton.martins](https://avatars.discourse-cdn.com/v4/letter/h/3ab097/32.png) [@heliton.martins](https://discourse.haproxy.org/u/heliton.martins)
#### Post date: [January 19, 2021, 3:50pm UTC](https://discourse.haproxy.org/t/cf-connecting-ip/6153/1 "2021-01-19T15:50:01Z")

</div>

Hello guys.

I have an HAproxy in pfsense working with several front-end. Everything working. I also have SSL running on Cloudflare.

there was a need to limit a frontend to some specific ips.

As I understand it, cloudflare proxy requests and in HAproxy I only receive the Cloudflare range. Looking at the documentation I saw that it is possible to get the client’s IP using the “CF-Connecting-IP” method but I have no idea how to get it.

Can anybody help me ?

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [January 20, 2021, 9:47pm UTC](https://discourse.haproxy.org/t/cf-connecting-ip/6153/2 "2021-01-20T21:47:54Z")

</div>

```
# allow cloudflare src ranges (https://www.cloudflare.com/ips-v4 + https://www.cloudflare.com/ips-v6)
acl is_cloudflare src -f /etc/cloudflare/ips-v4
acl is_cloudflare src -f /etc/cloudflare/ips-v6

# WORKAROUND: https://github.com/haproxy/haproxy/issues/90
acl is_cloudflare var(sess.cloudflare) -m found
http-request set-var(sess.cloudflare) always_true if { http_first_req } is_cloudflare

# deny cloudflare bypass
http-request deny if ! is_cloudflare

# set true source if cloudflare
http-request set-src hdr(cf-connecting-ip) if is_cloudflare

```

And for automatic and atomic updates of the file, I call wget from cron, save to temporary file and rename:

```
wget "https://www.cloudflare.com/ips-v4" -qO /etc/cloudflare/ips-v4.tmp && mv /etc/cloudflare/ips-v4.tmp /etc/cloudflare/ips-v4; wget "https://www.cloudflare.com/ips-v6" -qO /etc/cloudflare/ips-v6.tmp && mv /etc/cloudflare/ips-v6.tmp /etc/cloudflare/ips-v6

```

Originally from

> [@Cloudflare: haproxy is using the wrong IP for HTTP requests after the first](https://discourse.haproxy.org/t/cloudflare-haproxy-is-using-the-wrong-ip-for-http-requests-after-the-first/3769):
>
> We are using haproxy 1.8.17 in a two-stage setup: multiple “interceptor” servers (in http mode) that accept the initial connection and send it (using send-proxy-v2-ssl) to multiple: “routers” that know about the various backends to which we need to route the requests Everything is working great, except when CloudFlare is involved. In the frontend on “router” we’re using: http-request set-src hdr(x-forwarded-for) if is\_cloudflare\_src and we find: the connections are properly coming from v…

and improved in:

> **[Build software better, together](https://github.com/haproxy/haproxy/issues/new/choose)**
>
> GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.