Deployment Execution Blueprint

---
title: Restoring Real Client IPs in Nginx Behind Cloudflare Proxies
description: A master configuration guide to instruct Nginx to extract actual client IPv4 addresses from Cloudflare headers instead of proxy source routing blocks.
category: Server Configuration
slug: nginx-cloudflare-real-ip-restoration
keywords: nginx cloudflare real ip, restore visitor ip nginx, real_ip_header CF-Connecting-IP, cloudflare reverse proxy logs fix, tracking true user ip addresses
---

Technical Context & Blueprints
Routing your web architecture through a reverse proxy/CDN network like Cloudflare completely breaks your gateway's tracking arrays. Because Cloudflare intercepts requests and channels them onward from their internal datacenter pools, your Nginx access logs and application filters will register Cloudflare's proxy addresses as the source for every visitor.

This breaks IP-based rate limiters, user tracking databases, and fraud prevention engines. To fix this, you must instruct Nginx to pull the true client address from the CF-Connecting-IP header while trusting only verified Cloudflare network blocks.

High-Performance IP Restoration Injector Template
Save this snippet configuration layout inside your server blocks matrix directory as /etc/nginx/conf.d/cloudflare_real_ip.conf:

# Configure Nginx to extract incoming IP addresses from Cloudflare's secure header pipeline
real_ip_header CF-Connecting-IP;

# WHITELISTED CLOUDFLARE NETWORKS MASK LAYERS (Trusting ONLY verified gateway networks)
# Cloudflare IPv4 block lists:
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 199.27.128.0/21;

# Cloudflare IPv6 block lists:
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;

# Enforce processing variables to update matching parameters inside Nginx logs natively
# (This switches remote address pointers globally inside your $remote_addr variable parameters)
real_ip_recursive on;

# Verify configuration integrity flags cleanly
sudo nginx -t

# Apply tracking updates into live operational scopes immediately
sudo systemctl reload nginx