Hello. The scripts works correctly, but I don't know when is stopped.
The problem IP addresses are missing in file /etc/nginx/cloudflare

[root@server ~]# cat /etc/nginx/cloudflare
#Cloudflare

- IPv4

- IPv6

real_ip_header CF-Connecting-IP;
[root@server ~]#

I try to download the script again, but its not working. If I run in manualy here is the output:

[root@server~]# /usr/scripts/cloudflare-sync-ips.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

but in the file /etc/nginx/cloudflare IPs are missing.

I'll post here the final approach I took to get at the same time

• Block non cloudflare IPs (per server)
• Identify incoming ips
• No need for a firewall
  Add to nginx.conf (http scope):

geo $realip_remote_addr $cloudflare_ip {
        default          0;
        103.21.244.0/22  1;
        103.22.200.0/22  1;
        103.31.4.0/22    1;
        104.16.0.0/12    1;
        108.162.192.0/18 1;
        131.0.72.0/22    1;
        141.101.64.0/18  1;
        162.158.0.0/15   1;
        172.64.0.0/13    1;
        173.245.48.0/20  1;
        188.114.96.0/20  1;
        190.93.240.0/20  1;
        197.234.240.0/22 1;
        198.41.128.0/17  1;
        199.27.128.0/21  1;
    }

In the server block:

location /route/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://127.0.0.1:8051/;
        proxy_redirect off;
        if ($cloudflare_ip != 1) {
            return 403;
        }
        include /etc/nginx/snippets/allow_cloudflare.conf;
        deny all;
    }

Being allow_cloudflare.conf the following:

allow 103.21.244.0/22;
allow 103.22.200.0/22;
allow 103.31.4.0/22;
allow 104.16.0.0/12;
allow 108.162.192.0/18;
allow 131.0.72.0/22;
allow 141.101.64.0/18;
allow 162.158.0.0/15;
allow 172.64.0.0/13;
allow 173.245.48.0/20;
allow 188.114.96.0/20;
allow 190.93.240.0/20;
allow 197.234.240.0/22;
allow 198.41.128.0/17;

real_ip_header CF-Connecting-IP;

This works like a charm, if you still want extra security you can configure the firewall to block the other ips but it's not needed.

Hello @ergin and thank you very much for your work on this script, I came across it a few times and finally implemented your research into my SlickStack script after several users asked for it.

This is not so much a feature request, but in case you wanted to share an alternative way to build cloudflare.conf using sed and an existing boilerplate, it seems to work okay...

Ref: https://github.com/littlebizzy/slickstack/blob/master/bash/ss-install-nginx-cloudflare-ips.txt

## ipv4 list ##
CLOUDFLARE_IPV4_LIST=$(for i in `curl -s -L https://www.cloudflare.com/ips-v4`; do
    echo "set_real_ip_from $i;" >> /tmp/ips-v4.txt;
done)

sed -i -e '/@CLOUDFLARE_IPV4_LIST/{r /tmp/ips-v4.txt' -e 'd' -e '}' "${TMP_CLOUDFLARE_CONF}"

## ipv6 list ##
CLOUDFLARE_IPV6_LIST=$(for i in `curl -s -L https://www.cloudflare.com/ips-v6`; do
    echo "set_real_ip_from $i;" >> /tmp/ips-v6.txt;
done)

sed -i -e '/@CLOUDFLARE_IPV6_LIST/{r /tmp/ips-v6.txt' -e 'd' -e '}' "${TMP_CLOUDFLARE_CONF}"

This is an example boilerplate:

https://github.com/littlebizzy/slickstack/blob/master/modules/nginx/includes/cloudflare-conf.txt

And the placeholders in the boilerplate @CLOUDFLARE_IPV4_LIST and @CLOUDFLARE_IPV6_LIST get replaced via sed using your nifty bash for loop and a few tmp files.

Anyway I had never used sed this way before so just wanted to share. Thanks!

P.S. we credited you in the script comments at the bottom

Hello,

How do I run this when nginx proxy manager is running in a docker container?

I'm binding a folder into /etc/nginx/ and a data folder into /data. Within data, I created a file called http.conf in /data/nginx/custom added the following line to it (see here:

include /etc/nginx/cloudflare;

I added the file "cloudflare" to the folder I'm mounting to /etc/nginx/ like described in the instructions. I'm now struggling to create the cron tab to run the script. I found this, to setup a crontab, but it seems fairly complicated and I'm unsure whether it works or not.

After I setup everything, I connected to the sh shell of my container using portainer and ran the script, but I got this error:

nginx: error while loading shared libraries: libluajit-5.1.so.2: cannot open shared object file: No such file or directory

Also, I'd prefer to have this happen in real time so that my NPM logs reflect the real IPs right away.

This system works fine to add the source ip to the apache logs, the problem is that after this you can't block the traffic not comming from cloudflare because it's identified with the real ip. Have you accomplished this?