Seeing some cloud flare IPs in user logs
I'm still seeing some cloudflare IPs in my user logs even though I set up restoring visitor IPs. Could they be using CF WARP?
8 Replies
Yes, if they are using warp you will not see their ip address.
But it could be due to other reasons, is one of them a user you can contact for trouble shooting
No I'm the owner of the site and one of the users keeps on hiding behind cf warp and causing problems for me. I'm worried if I IP ban them It would IP ban CF causing my website to break
Just don't ban (or whitelist) the proxy IPs: https://www.cloudflare.com/ips/
IP Ranges | Cloudflare
This page is intended to be the definitive source of Cloudflare’s current IP ranges.
There's some other CF IPs that may be relevant if you're using specific services like Health Checks, Cloudflare tunnels, but otherwise the rest of the IPs from Cf's ASN would be safe to ban
The thing is I'm only seeing the IPs there logging in with its IPv6 2a09:bac5:d46e:25cd:0000:0000:03c4:004b. I have the IPs being properly restored. I don't use health checks and I don't use cloudflare tunnels. Looking at the list you gave me the IP isn't on it. Hypothetically if I were to just block the cloud flare ASN at the domain level would that cause problems?
That IP belongs to the cloudflare ASN
At the domain level of what service? If you did it on your web host without proper excluding of the proxy ranges, you'd block all the proxy traffic
I'm talking about on the CF panel itself
you still def run the risk of blocking some automated cf stuff (like speed tests, maybe health checks simulating zone, etc), but off my quick test it does work just to block the normal cf asn like that to stop warp. May worth noting Apple's Private Relay shares some IPs from the CF ASN + Akamai + their own I believe, if you wanted to block that (or maybe didn't want to)