====== 2025.02.06 Cloudflare CF-Connecting-IP ======

CF-Connecting-IP でリモートIPを取得

remoteip_moduleを利用
※Aache 2.4

===== module有効化 =====

<code>
sudo a2enmod remoteip
sudo systemctl restart apache2

apachectl -M | grep remo
 remoteip_module (shared)
</code>

===== removeip.conf用意 =====

CloudflareからのヘッダCF-Connecting-IPを指定し、CloudflareのIPだけをリモートIPに変換する。
CloudflareのIPリストは、[[https://www.cloudflare.com/ja-jp/ips/]]

<code| /etc/apache2/conf-available/remoteip.conf>
LoadModule remoteip_module modules/mod_remoteip.so
RemoteIPHeader CF-Connecting-IP

RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 104.16.0.0/13
RemoteIPTrustedProxy 104.24.0.0/14
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 131.0.72.0/22
</code>


===== 設定有効化 =====
<code>
sudo a2enconf remoteip
sudo systemctl restart apache2
</code>


===== ログ確認 =====


REMOTE_ADDR が CF-Connecting-IP になっているか確認
<code>
tail -f /var/log/apache2/access.log
</code>


あとは普通に.htaccessなどで制御

<code>
Order Deny,Allow
Deny from all
Allow from xxx.xxx.xxx.xxx
Allow from xxx.xxx.xxx.xxx
Allow from xxx.xxx.xxx.xxx
</code>

{{tag>日記 Cloudflare}}