Advertisement:

Author Topic: X-Forward-for  (Read 1869 times)

Offline r00tbear

  • Newbie
  • *
  • Posts: 4
X-Forward-for
« on: January 15, 2015, 04:45:56 AM »
Hello,
I really need to get information about IP addresses of users using X-Forward-for, because I use cloudflare CND and now I see just cloudflare IPs in logs... I tried to use Bad Behavior mod, but it doesn't work or I didn't configure it right...

Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 58,560
  • Gender: Male
    • Kindred-999 on GitHub
Re: X-Forward-for
« Reply #1 on: January 15, 2015, 08:01:07 AM »
well, the first question is: why are you using cloudflare?

1- it does not actually speed up a forum site
2- if you think that it obfuscates your server IP, then be aware that it does -- but only for people who don't know where to look
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline r00tbear

  • Newbie
  • *
  • Posts: 4
Re: X-Forward-for
« Reply #2 on: January 15, 2015, 09:31:52 AM »
It helps to protect my server from script-kiddies, which can make me headache by using LOIC and other tools for "hacking by using just one big red button".

Offline Arantor

  • Resident Overthinker
  • SMF Friend
  • SMF Legend
  • *
  • Posts: 71,823
    • StoryBB/StoryBB on GitHub
Re: X-Forward-for
« Reply #3 on: January 15, 2015, 10:34:29 AM »
Well, Cloudflare doesn't use X-Forward-For unless they've changed, they use a different header. I forget offhand which it is.

As for protecting from script kiddies, be aware that it is absolutely trivial to obtain your real IP address if your server sends email to them (like, say, the registration email).
Don’t try to tell me that some power can corrupt a person. You haven’t had enough to know what it’s like.

No good deed goes unpunished / No act of charity goes unresented.

Offline r00tbear

  • Newbie
  • *
  • Posts: 4
Re: X-Forward-for
« Reply #4 on: January 15, 2015, 10:44:22 AM »
"CloudFlare does append both X-Forwarded-For and X-Forwarded-Proto headers" from here hxxp:support.cloudflare.com/hc/en-us/articles/200170946-Does-CloudFlare-include-an-X-Forwarded-For-header- [nonactive]
And about emails - I don't use internal email system to send emails to users, just external, like gmail (external smtp servers). Yes, I'm paranoid :)

Offline Arantor

  • Resident Overthinker
  • SMF Friend
  • SMF Legend
  • *
  • Posts: 71,823
    • StoryBB/StoryBB on GitHub
Re: X-Forward-for
« Reply #5 on: January 15, 2015, 10:46:33 AM »
Don’t try to tell me that some power can corrupt a person. You haven’t had enough to know what it’s like.

No good deed goes unpunished / No act of charity goes unresented.

Offline r00tbear

  • Newbie
  • *
  • Posts: 4
Re: X-Forward-for
« Reply #6 on: January 15, 2015, 11:38:46 AM »
Thanks! It works!