mod_cloudflare is installed on Digital Ocean Ubuntu/WordPress but real IPs are not appearing in the apache2 log files - can anyone help?

December 4, 2015 1.2k views
Apache WordPress Ubuntu

Here is what I sent to digital ocean support but they have no idea:

mod_cloudflare, although installed and enabled is not passing the correct IP addresses to my log files at all.

I am seeing a lot of IP addresses like: which I know are not correct. My test method is to use 'curl' with long easily identifiable URLs that no regular visitor (or attacker) would be likely to visit and then check my log files. At the same time as my tests I'm getting bizare IP addresses that have nothing to do with the hosts I'm performing the tests from. Why is this happening?

mod_cloudflare is definitely installed on ubuntu 14.04 running apache2. I have never seen this bizarre behavior before.

How can I fix this? This is really critical. If cloudflare's security isn't going to block attacks I definitely need to know the real IP addresses so I can block them myself!

The strange, unrecognized IP addresses are often coming from Amazon data centers - I guess CloudFlare servers are often located in Amazon data centers?

Here what I'm getting when I verify that the cloudflare module is enabled:

root@www:/var/log/apache2# apache2ctl -M | grep cloud
cloudflare_module (shared)

I tried using tcpdump and waited
until I got lucky to catch a header. It looks like it works but I am not
getting legit IPs here... I guess I still have to ask CloudFlare?

User-Agent: Podcasts/1075.33 CFNetwork/758.1.6 Darwin/15.0.0 X-Middleton/1
Accept: /
Accept-Language: en-us
CF-Connecting-IP: 2602:306:8b00:64b0:6596:26d9:496b:156b
Cf-Ray: 24f1ce001b002828-SJC
Cf-Visitor: {"scheme":"http"}
Cookie:__cfduid=dcd6e93c799b853cb0f57c6bb3a91cd891449138442; ezouid=1146425940;

That one looks like it has an IPv6 address??? I never saw IPv6 in my logs
but otherwise it looks right to me. I connected to "sniff" and I found one
with a regular IP and it also looks right. But somehow I am not getting
the correct IP addresses in my logs. How can this be?

Cf-Ipcountry: US
Cf-Ray: 24f1d3f9c892261d-DFW
Cf-Visitor: {"scheme":"http"}
Cookie: ezouid=1006370956;
From: googlebot(at)
X-Middleton: 1

In this second case it definitely appears to be correct because the user
agent is google bot and the IP is owned by google and
recognizes it as a google bot IP.

So what can be going on here? I just grepped my access log for the second
IP, and it's nowhere to be found.

I repeated my test while running tcpdump. I can see my real IP in the
tcpdump. I can find the same request in the access log but it does NOT
have my real IP. How can this be? - - [03/Dec/2015:22:05:44 +0200]
"GET /thisisalongtestingURLforcapturingpackets_HA4 is definitely not my IP. It doesn't appear in any of the
cloudflare headers at all. It also deosn't appear anywhere in the packet
capture dump either.

Can anyone figure this one out?

Be the first one to answer this question.