From 58a75cbde42308bf9c3c11dd6a60fe04b830d18b Mon Sep 17 00:00:00 2001 From: Serghey Rodin Date: Mon, 16 Feb 2015 17:27:25 +0200 Subject: [PATCH] transparent nginx integration for CloudFlare --- install/debian/nginx.conf | 22 ++++++++++++++++++++++ install/rhel/nginx.conf | 22 ++++++++++++++++++++++ install/ubuntu/nginx.conf | 22 ++++++++++++++++++++++ 3 files changed, 66 insertions(+) diff --git a/install/debian/nginx.conf b/install/debian/nginx.conf index aec6246d0..19e4a7546 100644 --- a/install/debian/nginx.conf +++ b/install/debian/nginx.conf @@ -68,6 +68,28 @@ http { proxy_buffers 32 4k; + # Cloudflare + set_real_ip_from 199.27.128.0/21; + set_real_ip_from 173.245.48.0/20; + set_real_ip_from 103.21.244.0/22; + set_real_ip_from 103.22.200.0/22; + set_real_ip_from 103.31.4.0/22; + set_real_ip_from 141.101.64.0/18; + set_real_ip_from 108.162.192.0/18; + set_real_ip_from 190.93.240.0/20; + set_real_ip_from 188.114.96.0/20; + set_real_ip_from 197.234.240.0/22; + set_real_ip_from 198.41.128.0/17; + set_real_ip_from 162.158.0.0/15; + set_real_ip_from 104.16.0.0/12; + set_real_ip_from 2400:cb00::/32; + set_real_ip_from 2606:4700::/32; + set_real_ip_from 2803:f800::/32; + set_real_ip_from 2405:b500::/32; + set_real_ip_from 2405:8100::/32; + real_ip_header CF-Connecting-IP; + + # SSL PCI Compliance ssl_session_cache shared:SSL:10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; diff --git a/install/rhel/nginx.conf b/install/rhel/nginx.conf index 0316de7ac..fa5ff117b 100644 --- a/install/rhel/nginx.conf +++ b/install/rhel/nginx.conf @@ -68,6 +68,28 @@ http { proxy_buffers 32 4k; + # Cloudflare + set_real_ip_from 199.27.128.0/21; + set_real_ip_from 173.245.48.0/20; + set_real_ip_from 103.21.244.0/22; + set_real_ip_from 103.22.200.0/22; + set_real_ip_from 103.31.4.0/22; + set_real_ip_from 141.101.64.0/18; + set_real_ip_from 108.162.192.0/18; + set_real_ip_from 190.93.240.0/20; + set_real_ip_from 188.114.96.0/20; + set_real_ip_from 197.234.240.0/22; + set_real_ip_from 198.41.128.0/17; + set_real_ip_from 162.158.0.0/15; + set_real_ip_from 104.16.0.0/12; + set_real_ip_from 2400:cb00::/32; + set_real_ip_from 2606:4700::/32; + set_real_ip_from 2803:f800::/32; + set_real_ip_from 2405:b500::/32; + set_real_ip_from 2405:8100::/32; + real_ip_header CF-Connecting-IP; + + # SSL PCI Compliance ssl_session_cache shared:SSL:10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; diff --git a/install/ubuntu/nginx.conf b/install/ubuntu/nginx.conf index e2e72c471..6767e8ca7 100644 --- a/install/ubuntu/nginx.conf +++ b/install/ubuntu/nginx.conf @@ -68,6 +68,28 @@ http { proxy_buffers 32 4k; + # Cloudflare + set_real_ip_from 199.27.128.0/21; + set_real_ip_from 173.245.48.0/20; + set_real_ip_from 103.21.244.0/22; + set_real_ip_from 103.22.200.0/22; + set_real_ip_from 103.31.4.0/22; + set_real_ip_from 141.101.64.0/18; + set_real_ip_from 108.162.192.0/18; + set_real_ip_from 190.93.240.0/20; + set_real_ip_from 188.114.96.0/20; + set_real_ip_from 197.234.240.0/22; + set_real_ip_from 198.41.128.0/17; + set_real_ip_from 162.158.0.0/15; + set_real_ip_from 104.16.0.0/12; + set_real_ip_from 2400:cb00::/32; + set_real_ip_from 2606:4700::/32; + set_real_ip_from 2803:f800::/32; + set_real_ip_from 2405:b500::/32; + set_real_ip_from 2405:8100::/32; + real_ip_header CF-Connecting-IP; + + # SSL PCI Compliance ssl_session_cache shared:SSL:10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2;