Cloudflare and SMF (Visitor IPs wrong)

[MangosMadMax]

Hey,

I have cloudflare setup for my site and all visitor IPs show as the cloudflare ones!

I looked into the cloudflare help section and it just links to the bad behaviour mod.

I have installed the mod but do I need to list all of the cloudflare IPs now in the "Reverse Proxy Addresses" list ?

[MangosMadMax]

Hi,

Just wanted to add for others that might want to use cloudflare with bad behavour, forum firewall...

These are my below working settings.

Bad Behaviour Settings

• IP call to Reverse Proxy - HTTP_CF_CONNECTING_IP
• Reverse Proxy Addresses - IPs copied and pasted from https://www.cloudflare.com/ips-v4

Forum Firewall Settings

• Country Code via Headers - Cf-Ipcountry
• Visitor IP call to Proxy - HTTP_CF_CONNECTING_IP
• Proxy Header ID - Cf-Connecting-Ip

Finally I installed this mod - http://www.ryukent.com/2012/05/protect-your-smf-forum-against-spam  (Mod is under section 3)


If I have missed anything I'm sure someone will point it out.

[Kindred]

meh.. cloudflare is silly and does not actually protect anything...

[FragaCampos]

This is not entirely true.
Cloudflare actually helped my forum a lot. With small forums it may not help much, but with big forums it helps a lot saving bandwidth and making the forum work faster.
I activated their service (free) via cpanel, and I'm an happy customer.

These settings from Xpert-Servers will be very helpful, since this is the only issue that bothers me with cloudflare. (I have Stop Spammer mod installed).

meh.. cloudflare is silly and does not actually protect anything...

[Kindred]

Show me the proof... because I doubt your assertion, with 100% certainty.

[FragaCampos]

The proof are in my server logs.

I had less memory and cpu consumption since I activated clouflare. And I had plenty of issues before that.
Also, I've saved 6,479.62 Gb of traffic on my server since then.

I don't use clouflare for spam purposes, for that I have stop spammer and KeyCAPTCHA. I use it to redirect requests on my server. And it works.

[Arantor]

And how much of your lack of consumption is down to the fact that users are getting a CloudFlare error page...? There are a large number of sites out there that have reported issues with CloudFlare - and if you go to some of the paid forum packages, you will hear the same thing.

[FragaCampos]

Well, that happened in the following months I activated the service. Now it rarely happens. From my "experience" (I'm actually a newbie in all of this, but I read and test a lot), I prefer to have error pages from time to time (I don't have an error page for weeks now and neither other people from other countries) than a slower forum.
It may not work for others, but my forum is better now. And yes, I already tested deactivating Cloudflare in Cpanel, and there's a notorious change in both cpu and memory consumption.

[FragaCampos]

Well, I must say that Bad Behaviour Settings don't work per se. I'm still getting IPs from Cloudflare.
It would be nice to know if anyone managed to solve this issue.

[Arantor]

Random question: do you use a third party mail server?

[Cyberhost]

You could install mod_cloudflare on your webhosting and the ip logging should work.

[FragaCampos]

Errr... can you please explain me what you mean? 

Random question: do you use a third party mail server?

Well, Clouflare states at their "forum" that Bad Behaviour should do the trick... I'll have to dig more into this and see what that mod_cloudflare could do. If my host allow it, of course.

You could install mod_cloudflare on your webhosting and the ip logging should work.

[Arantor]

If you don't use a third party mail server, the mail's coming from your server. Which means your real IP address is exposed and the entirety of CloudFlare's protection can be bypassed with trivial ease.

[FragaCampos]

I don't use a third party mail, but as I stated before, I don't use clouflare for that purpose. I use it to avoid requests to the host's server, thus reducing cpu and memory consumption.

[Arantor]

And anyone who gets an email from you will see your real IP address and be able to totally bypass CloudFlare.

[FragaCampos]

And I don't really understand why are you pressing on that issue. I use cloudflare for another purpose, I don't want to hide nothing, I just want to easy the load on my server.

[Arantor]

And my point is that it may not actually save load because with minimal effort all the 'saving' can be bypassed entirely.

Oh, and the fact that CloudFlare seems to have a ton of issues with its own network anyway, which might be contributing to why you see savings on your server...

[FragaCampos]

Ok, thank you for your alerting me about this. I'll pay attention to what's happening in my server and do some more testing.
Regards.

[rajeshvv]

Hey,

I have cloudflare setup for my site and all visitor IPs show as the cloudflare ones, so after enabling the bad behavior mod with reverse proxy enabled works fine.... due to some reason we need to disable the cloudflare account so I disabled the reverse proxy option in settings... Now IP address not showing in the activation page..  any fix ?

[Deprecated]

meh.. cloudflare is silly and does not actually protect anything...

I know this is an old post but evidently you do not know what CloudFlare is, it does offer some protection -- against DDOS, and also has a beneficial side effect of making your server difficult to locate. It also accelerates your performance by their caching some of your content. I use it primarily as a performance booster. Note that 90% of my websites have nothing to do with SMF.

Also, if you are truly hiding only an idiot would not delete their MX records from CloudFlare.

[Arantor]

only an idiot would not delete their MX records from CloudFlare.

By that definition the majority of users of CF are idiots because most wouldn't *know* to do so.

The minute the real IP address is discoverable - and backtracking via email is the favourite but not the only method - CF's 'protection' doesn't do anything for you.

The fact that their uptime is questionable is also not so beneficial either...

[Kindred]

I know exactly what cloud flare is and does... And none of my statements are incorrect, despite what you (or they) want to claim...

[Deprecated]

There are plenty of good reasons why you might want to delete your MX records from CloudFlare. I've done it both ways and achieved what I needed.

Is there a CloudFlare mod? If not somebody send me a PM and I'll write it. It would take me about an hour. I already modded my custom CDS to be compatible with CloudFlare. All I'd need to do is package it for SMF.

I need an excuse to get back on the top 10 mod package author list anyway!