Apache2 - Important configuration for Cloudflare

If you want to use Cloudflare for your webserver and websites/webservices, then you have to configure Apache2 to use the client ip address instead of the Cloudflare proxy IP adress.

Please check out the new tutorial: https://support.cloudflare.com/hc/en-us/articles/360029696071

Please run the following commands:

sudo a2enmod remoteip

Add "RemoteIPHeader CF-Connecting-IP" to your vhost:

<VirtualHost *:80> ServerAdmin [email protected] DocumentRoot /var/www/html ServerName serverdomainname RemoteIPHeader CF-Connecting-IP ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined </VirtualHost>

In apache2 main config file apache2.conf

Instead of this:

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

You must use this:

LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

Add this (cloudflare proxy ip addresses) to the file /etc/apache2/conf-available/remoteip.conf:

RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 104.16.0.0/12
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 131.0.72.0/22
RemoteIPTrustedProxy 2400:cb00::/32
RemoteIPTrustedProxy 2606:4700::/32
RemoteIPTrustedProxy 2803:f800::/32
RemoteIPTrustedProxy 2405:b500::/32
RemoteIPTrustedProxy 2405:8100::/32
RemoteIPTrustedProxy 2a06:98c0::/29
RemoteIPTrustedProxy 2c0f:f248::/32

Activate this config file and restart apache2:

a2enconf remoteip.conf

service apache2 restart