Restoring Original Visitor IP Address with Cloudflare in CloudStick
Overview
When your website is behind Cloudflare, your server logs will show Cloudflare IP addresses instead of the real visitor IPs. This affects applications that rely on IP detection — such as rate limiting, geolocation, analytics, and security rules.
Cloudflare passes the real visitor IP through the CF-Connecting-IP header. To capture it correctly, you need to configure Nginx on your CloudStick server to trust Cloudflare's IP ranges and read from that header. This guide walks you through that configuration.
Why This Is Important
Ensures accurate visitor tracking and logging
Improves security rules and rate limiting based on real client IPs
Allows applications to detect real client IPs instead of proxy IPs
Step 1: Locate the Nginx Configuration File
On a CloudStick-powered server, each application has its own Nginx configuration directory. Navigate to the configuration file for the specific application you want to update:
vim /etc/nginx-cs/extra.d/app-name.d/main-post.conf
Replace app-name with your actual application name as it appears in the CloudStick dashboard.
Step 2: Add Cloudflare IP Ranges
Insert the following configuration block into the file. This tells Nginx to trust requests coming from Cloudflare's IP ranges and to read the real visitor IP from the CF-Connecting-IP header.
# Cloudflare IP addresses # IPv4 set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 108.162.192.0/18; set_real_ip_from 131.0.72.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 162.158.0.0/15; set_real_ip_from 172.64.0.0/13; set_real_ip_from 173.245.48.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 190.93.240.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; # IPv6 set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32; real_ip_header CF-Connecting-IP;
Always verify the latest Cloudflare IP ranges from Cloudflare's official documentation, as these ranges may be updated over time. Keep your configuration current to avoid missing new IP ranges.
Step 3: Test Nginx Configuration
Before restarting Nginx, always test the configuration to verify there are no syntax errors:
nginx-cs -t
If the test passes, you will see a confirmation that the configuration syntax is OK. Only proceed to the next step after a successful test.
Step 4: Restart Nginx Service
Once the configuration test passes without errors, restart Nginx to apply the changes:
systemctl restart nginx-cs.service
Result
Your server will now log the real visitor IP address instead of Cloudflare's proxy IPs.
Applications depending on IP detection will work correctly.
Logs, analytics, and security systems will reflect accurate client IP data.
Restart Nginx only after a successful configuration test. Restarting with a broken config will take your Nginx service offline. If you encounter any issues, contact CloudStick support for assistance.