My server is behind Cloudflare proxies. I have configured simple http authentication to restrict access to some server resources. I'm trying to block brute-force attacks on http auth with fail2ban.
The problem is that all the traffic comes through Cloudflare servers (other sources are blocked), so I can't simply block the real IP of an attacker. Is it possible to run a firewall that would use HTTP headers to find the real IP address of the attacker, and block traffic originating from that IP (before it goes through Cloudflare)?