cloudflare / cloudflared

Cloudflare Tunnel client (formerly Argo Tunnel)
https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide
Apache License 2.0
8.95k stars 788 forks source link

🐛 X-Real-IP header is not sent by cloudflared #920

Closed Practicalbutterfly5 closed 1 year ago

Practicalbutterfly5 commented 1 year ago

Describe the bug Cloudflare documentation mentions it will set X-Real-Ip before sending the request to origin server. But it appears that it is not being set.

To Reproduce Steps to reproduce the behavior:

  1. Install cloudflared using .deb
  2. Install nextcloud in docker using docker-compose. Port mapping for nextcloud container is 8080:80
  3. Make a named tunnel in zerotrust and forward it to http://localhost:8080
  4. Login into nextcloud. Check nextcloud logs, they contain docker_container gateway ip and not the real ip
  5. Solving this issue by proxying cloudflared to a reverse nginx proxy(on port 80) and setting X-Real-Ip to $http_cf_forwarded_ip)
    ...
    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $http_cf_connecting_ip;
      }
    ...
  6. Login and check nextcloud logs and they show real ip correctly.

If it's an issue with Cloudflare Tunnel: cloudflared config: Not applicable as tunnel was run using cloudflared tunnel run --token token

Expected behavior X-Real-Ip should be set and nextcloud logs should show real ip.

Environment and versions

obezuk commented 1 year ago

This is an issue in documentation, not cloudflared. X-Real-IP isn't typically sent by Cloudflare, and it's also not sent for a proxied website without Cloudflare Tunnels. There are some exceptions where X-Real-IP is sent when Workers are utilized, but in general I recommend using [cf-connecting-ip] (https://developers.cloudflare.com/fundamentals/get-started/reference/http-request-headers/#cf-connecting-ip) as you described.

We'll address this by correcting the documentation relating to X-Real-IP in the developer docs.