CF-Connecting-IP でリモートIPを取得

remoteip_moduleを利用
※Aache 2.4

sudo a2enmod remoteip
sudo systemctl restart apache2

apachectl -M | grep remo
 remoteip_module (shared)

CloudflareからのヘッダCF-Connecting-IPを指定し、CloudflareのIPだけをリモートIPに変換する。
CloudflareのIPリストは、https://www.cloudflare.com/ja-jp/ips/

LoadModule remoteip_module modules/mod_remoteip.so
RemoteIPHeader CF-Connecting-IP

RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 104.16.0.0/13
RemoteIPTrustedProxy 104.24.0.0/14
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 131.0.72.0/22

sudo a2enconf remoteip
sudo systemctl restart apache2

REMOTE_ADDR が CF-Connecting-IP になっているか確認

tail -f /var/log/apache2/access.log

あとは普通に.htaccessなどで制御

Order Deny,Allow
Deny from all
Allow from xxx.xxx.xxx.xxx
Allow from xxx.xxx.xxx.xxx
Allow from xxx.xxx.xxx.xxx