Question
mod_remoteip was enabled, why do I still see CloudFlare IPs when I execute "netstat"?
Answer
The "netstat" command will review network data that your server receives. From a network standpoint, CloudFlare is connecting to your server. The data that CloudFlare sends to the webserver in headers would contain the IP that you are looking for. Apache's mod_remoteip will extract the IP from those headers and place them in your logs. As a result, you will see the real IP in logs, but not within "netstat" output.