Cant Hide the IP

Website, Application, Performance DNS & Network
1

What is the name of the domain?

What is the error number?

What is the error message?

What is the issue you’re encountering

im looking to hide users IP on a social media instance

What steps have you taken to resolve the issue?

my NGINX Configuration has this

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

this usually worked well and everyone registering or using my social media instance has had the IP 127.0.0.1, now that i got Cloudflare it shows a Cloudflare proxy IP as user IP, is there any where i can hide it back to 127.0.0.1 to not Expose any IPs of my users?

What feature, service or problem is this related to?

I don’t know

What are the steps to reproduce the issue?

2

Since using Nginx, did you added below code to your nginx.conf file to return the real visitor IP? :thinking:

Could you check if the CF-Connecting-IP header exists and if you’ve added it?, otherwise you’d have to fall back to the $remote_addr I guess:

set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;

real_ip_header CF-Connecting-IP; --> this one here?!

Might have to call different header, otherwise you could manually set the IP via the header if you’d have to return back the particular, specific, identical one for all of them? :thinking:

What I don’t understand is way of you using 127.0.0.1 for external requests?; which kind of shouldn’t be used for since that would represent localhost?

Is your concern of the log files and GDPR or something else here?

I haven’t tested now, but I could in next couple of hours, if you’re using the above code in your main nginx.conf, therefrom for the domain example.com using example.vhost file, I’d assume you need to add some if-else part to set headers conditionally, e.g.:

location / {
    # Keep 127.0.0.1 for internal proxies
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # If request comes from Cloudflare, replace X-Real-IP with the real client IP
    if ($http_x_forwarded_for = "") {
        set $real_ip $remote_addr;
    }
    if ($http_cf_connecting_ip != "") {
        set $real_ip $http_cf_connecting_ip;
    }

    # Use the real IP from Cloudflare (if available)
    proxy_set_header X-Real-IP $real_ip;

    # Set the X-Forwarded-For to the real IP (or append it if needed)
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

If you’re on Enterprise plan, you could also experiment a bit by using the True Client IP header from the Dashboard, with less implementation written from above:

3

Hey, no i dont see this in there, this is nginx.conf

worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##
    limit_req_zone $binary_remote_addr zone=inbox_limit:10m rate=5r/s;

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

#       access_log /var/log/nginx/access.log;
#       error_log /var/log/nginx/error.log;
#log_format no_ip '$remote_user [$time_local] "$request" '
#                  '$status $body_bytes_sent "$http_referer" '
#                  '"$http_user_agent" "$http_x_forwarded_for"';
#access_log /var/log/nginx/access.log no_ip;
        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
                                       
        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}
}

This is mastodon

  default upgrade;
  ''      close;
}

upstream backend {
    server 127.0.0.1:3000 fail_timeout=0;
}

upstream streaming {
    # Instruct nginx to send connections to the server with the least number of connections
    # to ensure load is distributed evenly.
    least_conn;

    server 127.0.0.1:4000 fail_timeout=0;
    # Uncomment these lines for load-balancing multiple instances of streaming for scaling,
    # this assumes your running the streaming server on ports 4000, 4001, and 4002:
    # server 127.0.0.1:4001 fail_timeout=0;
    # server 127.0.0.1:4002 fail_timeout=0;
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=1g;

server {
    if ($host = mapsupport.de) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


  listen 80;
  listen [::]:80;
  server_name mapsupport.de;
access_log off;
error_log /dev/null crit;
  root /home/mastodon/live/public;
  location /.well-known/acme-challenge/ { allow all; }
  location / { return 301 https://$host$request_uri; }

#24.nov.2024 consuela rate limiting because of server attacks, rest is in nginx.conf
        location ~* /inbox {
            limit_req zone=inbox_limit burst=10 nodelay; # burst of 5
            limit_req_status 403;
        }

}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name mapsupport.de;

  ssl_protocols TLSv1.2 TLSv1.3;

  # You can use https://ssl-config.mozilla.org/ to generate your cipher set.
  # We recommend their "Intermediate" level.
  ssl_ciphers XXXXXXX>

  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;

  # Uncomment these lines once you acquire a certificate:
    ssl_certificate /etc/letsencrypt/live/mapsupport.de/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mapsupport.de/privkey.pem; # managed by Certbot

  keepalive_timeout    70;
  sendfile             on;
  client_max_body_size 99m;

  root /home/mastodon/live/public;

  gzip on;
  gzip_disable "msie6";
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_buffers 16 8k;
  gzip_http_version 1.1;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon;

  location / {
    try_files $uri @proxy;
  }

  # If Docker is used for deployment and Rails serves static files,
  # then needed must replace line `try_files $uri =404;` with `try_files $uri @proxy;`.
  location = /sw.js {
    add_header Cache-Control "public, max-age=604800, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/assets/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/avatars/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/emoji/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/headers/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/packs/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/shortcuts/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/sounds/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/system/ {
    add_header Cache-Control "public, max-age=2419200, immutable";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    add_header X-Content-Type-Options nosniff;
    add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
    try_files $uri =404;
  }

  location ^~ /api/v1/streaming {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Proxy "";
    proxy_pass http://streaming;
    proxy_buffering off;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";

    tcp_nodelay on;
  }

  location @proxy {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Proxy "";
    proxy_pass_header Server;
    proxy_pass http://backend;
    proxy_buffering on;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_cache CACHE;
    proxy_cache_valid 200 7d;
    proxy_cache_valid 410 24h;
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    add_header X-Cached $upstream_cache_status;

    tcp_nodelay on;
  }

  error_page 404 500 501 502 503 504 /500.html;


}
server {
    server_name  www.mapsupport.de;
    rewrite ^(.*) https://mapsupport.de$1 permanent;


    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.mapsupport.de/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.mapsupport.de/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = www.mapsupport.de) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name  www.mapsupport.de;
    listen 80;
    return 404; # managed by Certbot

}
4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.