I'm using cPanel from someone else who resold it to me.
This will probably mean I cannot use mod_cloudflare
I would like to get the visitor's IP and not CloudFlare IP. The part of code I'm using:
$_SERVER['REMOTE_ADDR']
That line will get the IP of cloud flare and not the original user's IP.
Is there any way I can get the original IP address from the visitor?
Akam's answer is too complicated and does not work. Here's a simpler way:
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
}
I used following Functions in my application: http://ipaddress.standingtech.com/ to exclude CloudFlare IP address
<?php
/*
* @param $ips = array of IP address
*/
function clear_flare_ips($ips){
foreach($ips as $index => $ip){
if(is_in_flareips($ip)){
unset($ips[$index]);
}
}
ksort($ips);
return $ips;
}
function is_in_flareips($ip){
$flareips = getflareips();
foreach($flareips as $range){
if(ip_in_range( $ip, $range )){
return true;
}
}
return false;
}
function getallips(){
if (isset($_SERVER['HTTP_CLIENT_IP']))
$ipaddress[] = $_SERVER['HTTP_CLIENT_IP'];
if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
$ipaddress[] = $_SERVER['HTTP_X_FORWARDED_FOR'];
if(isset($_SERVER['HTTP_X_FORWARDED']))
$ipaddress[] = $_SERVER['HTTP_X_FORWARDED'];
if(isset($_SERVER['HTTP_FORWARDED_FOR']))
$ipaddress[] = $_SERVER['HTTP_FORWARDED_FOR'];
if(isset($_SERVER['HTTP_FORWARDED']))
$ipaddress[] = $_SERVER['HTTP_FORWARDED'];
if(isset($_SERVER['REMOTE_ADDR']))
$ipaddress[] = $_SERVER['REMOTE_ADDR'];
if(count($ipaddress) == 0)
$ipaddress[] = 'UNKNOWN';
return $ipaddress;
}
function getflareips(){
/*
https://www.cloudflare.com/ips-v4
*/
return array(
'103.21.244.0/22',
'103.22.200.0/22',
'103.31.4.0/22',
'104.16.0.0/12',
'108.162.192.0/18',
'131.0.72.0/22',
'141.101.64.0/18',
'162.158.0.0/15',
'172.64.0.0/13',
'173.245.48.0/20',
'188.114.96.0/20',
'190.93.240.0/20',
'197.234.240.0/22',
'198.41.128.0/17',
'199.27.128.0/21'
);
}
function ip_in_range( $ip, $range ) {
/**
* Check if a given ip is in a network
* @param string $ip IP to check in IPV4 format eg. 127.0.0.1
* @param string $range IP/CIDR netmask eg. 127.0.0.0/24, also 127.0.0.1 is accepted and /32 assumed
* @return boolean true if the ip is in this range / false if not.
*/
if ( strpos( $range, '/' ) == false ) {
$range .= '/32';
}
// $range is in IP/CIDR format eg 127.0.0.1/24
list( $range, $netmask ) = explode( '/', $range, 2 );
$range_decimal = ip2long( $range );
$ip_decimal = ip2long( $ip );
$wildcard_decimal = pow( 2, ( 32 - $netmask ) ) - 1;
$netmask_decimal = ~ $wildcard_decimal;
return ( ( $ip_decimal & $netmask_decimal ) == ( $range_decimal & $netmask_decimal ) );
}
Yes, but without access to the server configuration, you will be unable to utilize $_SERVER['REMOTE_ADDR'].
However, you can still use X-Forwarded-For and CF-Connecting-IP. Both would be available in the $_SERVER super-global.
How to read the below:
Details explaining answer with examples title (Last one)It's advised to go the right way. You do it once. And you get all the benefits.
If you want just something fast and works. For your need.
Check if the Cloudflare headers are forwarded to your server and available in your app. If available then you can access the value. If not available. Then you need to do server config.
The Cloudflare header is CF-Connecting-IP
To access headers in PHP you can use the below method:
// Replace XXXXXX_XXXX with the name of the header you need in UPPERCASE (and with '-' replaced by '_')
$headerStringValue = $_SERVER['HTTP_XXXXXX_XXXX'];
XXXXXX_XXXX with the name of the header you need in UPPERCASE (and with '-' replaced by '_')In our case, we should check
$_SERVER['HTTP_CF_CONNECTING_IP']
You can check more ways of accessing headers here
How do I read any request header in PHP
Note: Why the right way? If there are any modules that rely on
REMOTE_ADDRvariable automatically. You'll find yourself needing to go for the resolution. As they won't work. Same thing with logs. Like Apache logs. U start to see Cloudflare IPs (surely you can modify the Apache formatting to include the Cloudflare header value). However, you can get the idea. Of how many places you may need to do things if you don't go for the resolution.
Refs
CF-Connecting-IPThis will probably mean I cannot use mod_cloudflare
No you can without any issue if you are using Apache alone as server. Or Nginx alone as a server.
If You are using Apache behind Nginx as a proxy.
Three cases:
Case 1: CPanel or Plesk already does set the headers (Which normally is the case)
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
If those two lines are there. In that case. You only need to add one newly created config file in Nginx. No issue at all. No conflict with Plesk or CPanel. And In Apache the same (one file). In Apache you use X-Real-IP.
Case 2: CPanel doesn't include X-Real-IP But does for X-Forwarded-For
You can use X-Forwarded-For for resolution in Apache.
Case 3: If none of those lines are included by default
(Which normally is never the case. At least X-Forwarded-For)
In that case, you can use a hack. Where through shell scripting you check and add an include toward a config file. That injects lines inside the location {} block in question. You can use chatgpt for creating such a script fast. Make sure to include a check. And include the script in systemd using ExecStartPre= (have to run before start). So on service restart the check happens. If the include is not there it would add it. If Plesk|Cpanel ever regenerates the config after. Plesk|Cpanel will restart the service and our script will make sure to put back the include if not there.
The right way is to set a real-ip resolution at server levels
location {} block for proxy_pass). Would require u to modify cpanel or plesk-generated configs. You can script a check and inject an included line within the proxy passing location block. (check the answer in the last title)
- Otherwise, u opt out of Plesk or Cpanel for Nginx configThe benefit of that. Is having the whole stack works naturally without modifications and the whole stack. Also if you make modifications to your stack. Things will remain to work without needing to re-setup.
Also, The usage of such real-ip modules adds trust security.
Note: Why the right way? If there are any modules that rely on REMOTE_ADDR variable automatically. You'll find yourself needing to go for the resolution. As they won't work. Same thing with logs. Like Apache logs. U start to see Cloudflare IPs (surely you can modify the Apache formatting to include the Cloudflare header value) (Then what about modules that may rely on the log format). In all cases, however, you can get the idea. Of how many places you may need to do things if you don't go for the resolution.
As by Cloudflare doc. The Old Cloudflare module is deprecated. And you have to use Apache and Nginx-specific specialized modules.
https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/ a good read.
My answer here shows a full example and goes into explaining the details, It's long and detailed
https://stackoverflow.com/a/76845593/7668448
Info index (points of the answer above)
$remote_addr variable$proxy_add_x_forwarded_for variablemod_remoteip module