Modsecurity showing Cloudflare IP and not origin ip address
On a new server installation I have noted that Modsecurity is showing a Cloudflare IP address as the source and not the origin IP address when the domain is using Cloudflare.
The Apache Status in WHM and the Visitor logs display the correct source address.
I have also noted that any attempt to block the actual source address is ignored by CSF.
I have made sure that mod_remoteip is enabled and the LogFormat is changed (which is was already on the new installation). Am I correct in assuming that cPanel now automatically makes provision for Cloudflare IP addresses?
Anything else I am perhaps missing?
-
You can't block the "real" IPs that come through Cloudflare via CSF. CSF only sees the actual CF IP addresses because CSF is working at a different level.. It's unfortunate. I do block a few pesky IPs on a couple of sites behind cloudflare using the site's .htaccess file, but that is likely not going to be of help to you. I'll show you an example in .htacess though that allows all but blocks 54.172.14.111
<RequireAll>
Require all granted
Require not IP 54.172.14.111
</RequireAll>You could probably do something similar in the Apache Include Editor, but it would all be manual and you wouldn't want to list thousands of IPs in it.
0
Please sign in to leave a comment.
Comments
1 comment