Help, cf_connecting_ip from cloudflare is localIP

Website, Application, Performance Security
1

Hi guys, I am newbie here because I have a problem with the log of the nginx abouht the remote Real Ip.

My nginx log format is ( nginx with http_realip_module ):

log_format main '$remote_addr - $remote_user [$time_local] “$request” ’
'$status $body_bytes_sent “$http_referer” ’ request_time: '“$request_time” ’ upstream_response_time '“$upstream_response_time” ’
'“$http_user_agent” http_x_forwarded_for: “$http_x_forwarded_for” ’ host: '“$host” ’ http_cf_connecting_ip: '“$http_cf_connecting_ip” ’ ;

then I got a lot logs like:

172.69.33.99 - - [07/Jan/2020:21:09:53 -0500] “GET /xx/ HTTP/1.1” 200 13962 “http://cc.com/xx/” request_time:“0.002” upstream_response_time"0.002" “WordPress/5.3.2; http://cc.com” http_x_forwarded_for: “200.200.200.200” host:“cc.com” http_cf_connecting_ip:“200.200.200.200”

The problem is:
1. is this remote ip “172.69.33.99” from cloudflare? I did not find it from here IP Ranges
---- This is proble is be addressed. It’s in the CF IP list.

  1. the ip http_x_forwarded_for and http_cf_connecting_ip (200.200.200.200 ) is my hosting IP. I mean my hosting eth0 binded this ip (200.200.200.200). So I can’t believe it’s from my hosting itself. I have reboot and check all the request of my server, so I think there must be something wrong. And I have test, If I open my url from Chrome, the log ip is right. So this log is too too strange. help me. thanks.
2

It is right there. Last but one entry.

Are you saying that log entry is the only one with your server IP address and all others are correct?

3

yes , all others are correct.

4

In that case it seems to be working and that particular request will have been sent by your own server.

1 Like
5

Finally, I have found out:
This traffic is from the plugins of my wordpress.
It’s WP Super Cache with preload model.
It preload all the post url with these request. So the log is all right.

thanks all.

6

This topic was automatically closed after 30 days. New replies are no longer allowed.