Cloudflare proxy

When you proxy the panel’s domain through Cloudflare, nginx otherwise sees Cloudflare’s edge IPs instead of your visitors’ real IPs. VirtConsole fixes this by trusting Cloudflare’s published IP ranges and reading the CF-Connecting-IP header.

How it works

1. The panel keeps a list of Cloudflare’s IPv4 and IPv6 ranges.
2. nginx is configured with set_real_ip_from for those ranges and real_ip_header CF-Connecting-IP.
3. The application, the audit logs and any IP restriction rules all see the true client IP.

The management server refreshes the range list automatically every 24 hours. Changes take effect immediately, and both IPv4 and IPv6 ranges are covered.

Manual refresh

Run a manual refresh after changing Cloudflare proxy settings, or when troubleshooting IP detection:

vcli app:update-cloudflare

Expected output:

Cloudflare IP configuration up to date
IPv4 ranges: 15
IPv6 ranges: 7

Common problems

• Logs still show Cloudflare IPs. Run vcli app:update-cloudflare, then confirm nginx contains set_real_ip_from entries and real_ip_header CF-Connecting-IP;. Also confirm the orange-cloud proxy is enabled for the record in Cloudflare’s dashboard.

Related

• Management server installation
• Admin IP restriction