Home / Nginx / Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address

Nginx

Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address

Fix Nginx logs and rate limiting when every request appears to come from Cloudflare because real IP headers are not trusted correctly.

Published: Apr 10, 20265 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

When Nginx sits behind Cloudflare, the origin sees Cloudflare edge connections by default. If the real_ip module is not configured correctly, access logs, fail2ban rules, geographic controls, and rate limiting all work against Cloudflare IPs instead of the real visitor address.

Symptoms

Access logs show only Cloudflare edge addresses instead of client IPs
Rate limiting blocks large groups of unrelated users at once
Security tools such as fail2ban keep banning Cloudflare IP ranges
The problem started after putting the site behind Cloudflare or changing proxy settings

Common Causes

Nginx does not trust Cloudflare proxy IP ranges
The wrong header is configured for real_ip_header
Cloudflare IP ranges were configured once but never updated
Real IP handling is defined in one server block but missing in another

Step-by-Step Fix

1.Confirm which IP address Nginx is logging right now
2.Check the live access log before changing the configuration so you can verify the fix later.

bash

tail -n 20 /var/log/nginx/access.log

1.Trust the Cloudflare proxy ranges and use the correct header
2.Cloudflare sends the original client address in CF-Connecting-IP, which Nginx should trust only for Cloudflare proxy ranges.

nginx

set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
real_ip_header CF-Connecting-IP;
real_ip_recursive on;

1.Reload Nginx and test with a fresh request
2.A config change without a reload leaves the origin serving the old behavior.

bash

nginx -t && systemctl reload nginx
curl -I https://example.com

1.Verify the logs and security controls now see the visitor IP
2.Check logs, geo rules, and rate limiting after the reload so you know downstream controls are using the corrected address.

bash

tail -n 20 /var/log/nginx/access.log

Prevention

Keep Cloudflare IP ranges updated as part of proxy hardening maintenance
Centralize real_ip configuration in shared Nginx includes
Re-test logging and rate limiting whenever a CDN or reverse proxy changes
Avoid trusting forwarded IP headers from arbitrary sources

Verification

After applying the fix, verify the exact symptom that made the incident visible instead of relying on one green log line. Re-run the command, request, deployment, or browser path that failed before the change and capture the new output for the incident record.

Confirm the original error message no longer appears in application, platform, or edge logs.
Check the affected dependency path from the client side and from the server side when both are available.
Watch the next scheduled job, deploy, cache refresh, or certificate renewal cycle so the fix survives the normal operating path.
Record the final configuration value, command output, and timestamp in the runbook for Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address.

Rollback

If the fix changes routing, credentials, certificates, state, cache behavior, or runtime configuration, keep a rollback path ready before applying it to production. Save the previous configuration, identify the owner of the affected service, and define the signal that will trigger rollback.

1.Restore the last known-good configuration or state reference if validation shows a wider blast radius.
2.Re-run the same diagnostic checks from the fix section to confirm the rollback returned the system to the previous behavior.
3.Leave a short note explaining why the attempted fix was reverted so the next responder does not repeat the same change.

Operational Notes

Use this guide as an incident workflow, not as a blind checklist. The safest order is to collect the current state, confirm the narrowest failing component, apply one focused change, and then re-test the same path that failed. Avoid combining unrelated fixes during Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address; otherwise the team will not know which change restored service or which change caused a later regression.

For production systems, capture command output before and after each change. Include timestamps, hostnames, environment names, account IDs, namespaces, certificate names, or configuration keys when they are relevant. These details make the guide useful during a future incident and help separate a real recurrence from a similar-looking but unrelated failure.

Escalate when the failing path crosses a boundary your team does not own, such as a managed cloud control plane, identity provider, external DNS service, payment gateway, or shared network appliance. Share the exact failing request, correlation ID, command output, and change window with the owning team. Keep customer-facing mitigation separate from root-cause repair: it is often safer to route around the broken dependency first, then schedule the permanent cleanup after traffic is stable.

[Nginx troubleshooting: Fix Lambda Permission Denied - Complete ](fix-lambda-permission-denied)
[Nginx web server troubleshooting: Fix Client Max Body Size Large Upload Nginx Issue ](client-max-body-size-large-upload-nginx)
[Fix Apache 502 Proxy Error](fix-apache-502-proxy-error)
[Fix Apache LogLevel Core Debug Configuration](fix-apache-loglevel-core-debug)
[Fix Cloudflare 502 Bad Gateway Error](fix-cloudflare-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address Nginx Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address troubleshooting Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address fix Fix Nginx logs and rate limiting when every request appears to come from Cloudflare because real IP headers are not trusted correctly Nginx Fix Nginx logs and rate limiting when every request appears to come from Cloudflare because real IP headers are not trusted correctly

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

Nginx Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this nginx-errors troubleshooting guide applies to my situation?

This guide is designed for nginx-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these nginx-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of nginx-errors issue?

Most nginx-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this nginx-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for nginx-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 10, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Prevention

Verification

Rollback

Operational Notes

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

Nginx Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Nginx Real IP Shows Cloudflare Edge IP Instead of the Visitor Address

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Prevention

Verification

Rollback

Operational Notes

Related Articles

People also search for

Share this guide

More Nginx Troubleshooting Guides

Browse Guides from Other Categories

Nginx Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading