1

My server is behind Cloudflare proxies. I have configured simple http authentication to restrict access to some server resources. I'm trying to block brute-force attacks on http auth with fail2ban.

The problem is that all the traffic comes through Cloudflare servers (other sources are blocked), so I can't simply block the real IP of an attacker. Is it possible to run a firewall that would use HTTP headers to find the real IP address of the attacker, and block traffic originating from that IP (before it goes through Cloudflare)?

1
  • Have you tried contacting cloud-flare? If they're your proxy service provider, they've probably a) heard this question before and b) have a solution already implemented that you can use.
    – Bacon Bits
    Feb 22, 2013 at 23:02

1 Answer 1

2

While this is a little old and missed, you can restore the visitor IPs to your log by installing something like mod_cloudflare.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .