Cara Setting nginx supaya bisa menampilkan Real IP client dengan domain yang di daftarkan di cloudflare proxy

Karena domain berada di belakang proxy Cloudflare (orange cloud / proxied), Cloudflare selalu menyertakan header khusus bernama CF-Connecting-IP yang berisi IP publik asli dari user/klien.

Solusinya sangat mudah dan definitif: ubah real_ip_header di Nginx ke CF-Connecting-IP dan daftarkan list IP Cloudflare serta IP internal K3s sebagai trusted proxy.

Tambahkan perintah berikut :

      # ===================================================
      # KONFIGURASI REAL IP UNTUK CLOUDFLARE + K3S
      # ===================================================
      real_ip_header CF-Connecting-IP;

      # 1. Trust CIDR Cloudflare Resmi (IPv4)
      set_real_ip_from 173.245.48.0/20;
      set_real_ip_from 103.21.244.0/22;
      set_real_ip_from 103.22.200.0/22;
      set_real_ip_from 103.31.4.0/22;
      set_real_ip_from 141.101.64.0/18;
      set_real_ip_from 108.162.192.0/18;
      set_real_ip_from 190.93.240.0/20;
      set_real_ip_from 188.114.96.0/20;
      set_real_ip_from 197.234.240.0/22;
      set_real_ip_from 198.41.128.0/17;
      set_real_ip_from 162.158.0.0/15;
      set_real_ip_from 104.16.0.0/13;
      set_real_ip_from 104.24.0.0/14;
      set_real_ip_from 172.64.0.0/13;
      set_real_ip_from 131.0.72.0/22;

      # 2. Trust Subnet Internal K3s & Localhost (Traefik / Ingress)
      set_real_ip_from 10.42.0.0/16;
      set_real_ip_from 10.43.0.0/16;
      set_real_ip_from 10.0.0.0/8;
      set_real_ip_from 172.16.0.0/12;
      set_real_ip_from 192.168.0.0/16;
      set_real_ip_from 127.0.0.1;

      real_ip_recursive on;

Contoh nya misalkan buat docker app buat test

1. buat docker-compose.yaml

mkdir -p ~/ip-tester && cd ~/ip-tester
cat << 'EOF' > docker-compose.yml
services:
  ip-tester:
    image: mendhak/http-https-echo:latest
    container_name: ip-tester
    restart: unless-stopped
    ports:
      - "127.0.0.1:5000:8080"
EOF
docker compose up -d

2. config nginx misal

sudo nano /etc/nginx/conf.d/ip-tester.conf

server {
    listen 80;
    server_name ip.hendro-wibiksono.web.id;

    # ===================================================
    # KONFIGURASI REAL IP CLOUDFLARE
    # ===================================================
    real_ip_header CF-Connecting-IP;

    # Trust seluruh Range IP Cloudflare Resmi (IPv4 & IPv6)
    set_real_ip_from 173.245.48.0/20;
    set_real_ip_from 103.21.244.0/22;
    set_real_ip_from 103.22.200.0/22;
    set_real_ip_from 103.31.4.0/22;
    set_real_ip_from 141.101.64.0/18;
    set_real_ip_from 108.162.192.0/18;
    set_real_ip_from 190.93.240.0/20;
    set_real_ip_from 188.114.96.0/20;
    set_real_ip_from 197.234.240.0/22;
    set_real_ip_from 198.41.128.0/17;
    set_real_ip_from 162.158.0.0/15;
    set_real_ip_from 104.16.0.0/13;
    set_real_ip_from 104.24.0.0/14;
    set_real_ip_from 172.64.0.0/13;
    set_real_ip_from 131.0.72.0/22;
    set_real_ip_from 2400:cb00::/32;
    set_real_ip_from 2606:4700::/32;
    set_real_ip_from 2803:f800::/32;
    set_real_ip_from 2405:b500::/32;
    set_real_ip_from 2405:8100::/32;
    set_real_ip_from 2a06:98c0::/29;
    set_real_ip_from 2c0f:f248::/32;

    real_ip_recursive on;

    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

3. reload nginx

sudo nginx -t && sudo systemctl reload nginx

4. setting cerbot https

sudo certbot --nginx -d ip.hendro-wibiksono.web.id

5. coba akses web nya

nanti muncul :

path	"/"
headers	
host	"ip.hendro-wibiksono.web.id"
x-real-ip	"114.8.205.129"
x-forwarded-for	"114.8.205.129"
x-forwarded-proto	"http"
connection