the reason:
I set up a wordpress blog, because cloudflare is slow in mainland China, so I bought a US CN2 vps as a blog proxy (using nginx, put it in front of cloudflare), and use dns smart analysis to resolve the traffic from mainland China to CN2 vps, which will be excluded The access from outside mainland China resolves to cloudflare. The problem we are encountering now is: China mainland visits blogs (CN2 vps), and cloudflare traffic statistics show that it is US IP access (the address is CN2 vps IP). I am worried about network attacks. I have searched many places on the Internet and tried many methods to pass the IP of users visiting from Mainland China to cloudflare.
Network link diagram:
If I want to use cloudflare as a firewall to prevent my blog from being attacked by the Internet, I need to pass the guest IP to cloudflare.
In Mainland China: ①Visitors (IP: 112.37.X.X)–>②CN2 VPS (IP: 104.224.X.X)–>③Cloudflare (getting the IP of ②, not the ip of ①)–>④Wordpress
Cloudflare is required to obtain the IP of ①.
In non-Mainland China: ⑪Visit -->⑫cloudflare–>⑬wordpress, you can get the visitor IP normally.
②Nginx configuration code:
server {
listen 80;
listen [::]:80;
server_name www.xxx.info;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443;
server_name www.xxx.info;
ssl_certificate /home/www/nginx/ssl/xxx.info/www.xxx.info.pem;
ssl_certificate_key /home/www/nginx/ssl/xxx.info/www.xxx.info.key;
client_max_body_size 5m;
client_body_timeout 60;
#real_ip_recursive on;
#real_ip_header CF-Connecting-IP;
#real_ip_header X-Forwarded-For;
#set_real_ip_from 0.0.0.0/0;
gzip on;
gzip_types application/xml application/json text/css text/javascript application/javascript;
gzip_vary on;
gzip_comp_level 6;
gzip_min_length 500;
location / {
proxy_pass https://104.26.11.153;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_http_version 1.1;
proxy_ssl_name $host;
proxy_ssl_server_name on;
}
location ~ .*\.(gif|jpg|png|css|js)(.*) {
proxy_pass https://104.26.11.153;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_set_header Host $host;
proxy_cache cache_one;
proxy_cache_valid 200 302 24h;
proxy_cache_valid 301 30d;
proxy_cache_valid any 5m;
proxy_buffer_size 16k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 96k;
proxy_temp_file_write_size 96k;
expires 90d;
add_header wall "xxx-CN2";
proxy_ssl_name $host;
proxy_ssl_server_name on;
}
}
