Load balancer behind Cloudflare getting multiple source IP for a single session

Website, Application, Performance
1

I’m working with an implementation team that has set up a couple of load balancers in Azure, and Cloudflare is load balancing between those. He’s reporting that his load balancer is seeing multiple IP addresses for a single client request. Does that make any sense? Is there anything I can look at to figure out what’s happening?

2

Multiple IPs for a single request? It seems impossible.

If you were saying different origins per session it may be so without session affinity, but the opposite it’s basically impossible.

3

That was my take on it. I’ll relay this information back to the implementer.

4

He responded with some log entries from a single user requesting images:

[08/May/2020:20:38:48 +0000] 172.68.174.110 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/delete.svg HTTP/1.1” 2558 1236

[08/May/2020:20:38:48 +0000] 172.68.174.26 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/select_arrow.svg HTTP/1.1” 5092 1800

[08/May/2020:20:38:48 +0000] 172.68.174.128 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/point_mode.svg HTTP/1.1” 2197 3132

[08/May/2020:20:38:48 +0000] 172.68.174.74 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/dim_line_mode.svg HTTP/1.1” 6184 3208

[08/May/2020:20:38:48 +0000] 172.68.174.92 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/polygon_mode.svg HTTP/1.1” 1819 2099

[08/May/2020:20:38:48 +0000] 172.68.174.122 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/line_mode.svg HTTP/1.1” 1913 1835

[08/May/2020:20:38:48 +0000] 172.68.174.86 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/close.svg HTTP/1.1” 3048 1475

[08/May/2020:20:38:48 +0000] 172.68.174.110 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/snapping-on.svg HTTP/1.1” 2676 2792

[08/May/2020:20:38:48 +0000] 172.68.174.68 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/package_manager.svg HTTP/1.1” 5494 2312

[08/May/2020:20:38:48 +0000] 172.68.174.122 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/duplicate.svg HTTP/1.1” 3149 1367

[08/May/2020:20:38:48 +0000] 172.68.174.68 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 “GET /myworld/modules/capture/images/list.svg HTTP/1.1” 401 1115

[08/May/2020:20:38:48 +0000] 172.68.174.20 {SSL_PROTOCOL}x ECDHE-RSA-AES256-GCM-SHA384 "GET /myworld/modules/capture/images/edit_package.svg HTTP/1.1

5

I see, then the case was multiple IPs for a single session. That’s because those IPs are Cloudflare’s, not the user’s. They shouldn’t matter for the server itself.

You need to use the cf-connecting-ip header to get the user’s IP.

1 Like
6

So, the server will see multiple IP addresses for a session when it’s proxied through Cloudflare? Is there any setting I can change to pin a session to a single IP address?

Otherwise, is there any way to do an source-ip-based session affinity for load balancing?

7

Not from Cloudflare, but as I said the actual user IP is shown in a header. You should use that as source IP and not the actual IP of the connection.

Not that I am aware, you do session affinity for the actual user, but not from Cloudflare’s edge.

8

This topic was automatically closed after 30 days. New replies are no longer allowed.