Get Client's Real IP (CF Headers)

[pradumnk-mahanta]

Hi,

I am not sure if I am doing anything wrong or its just not working, I thougt I will ask here before I raise an issue.

I am using AdGuardHome to do DNS Rewrites on my local Network. So any basic outside request will look like the following,

Client (1.2.3.4) -> Cloudflared Tunnel (192.168.1.X) -> Adguard Home (192.168.1.A) -> NGINX Proxy Manager (192.168.1.Y) -> Application (192.168.1.Z)

Now following the logs, I can see Tunnel is getting the Client's IP Address in Headers,

X-Forwarded-For
Cf-Connecting-IP
X-Real-IP

All contain the same values, 1.2.3.4

This request now goes to Adguard DNS and then redirected to NGINX Proxy Manger, which in Logs recognises the Request coming from 1.2.3.4 using the X-Real-IP. It logs the same.

The Issue here is, My Adguard Home still logs the request coming from 192.168.1.X which is the Tunnel IP.

Now, the documentation, and mutiple other discussions say, I can use trusted_proxies of the config to get information from the HTTPS headers for the client.

#3451
Configuration

So, following the above, I added, all the CF IPs IP Ranges to the trusted_proxies Section.

But it still logs 192.168.1.X which is the Tunnel IP.

So, I added the Tunnel IP 192.168.1.X as well to the trusted_proxies Section (Also tried with whole network subnet as well).

But it still logs 192.168.1.X which is the Tunnel IP.

I definitely know the the values are present in the request because NGINX Proxy Manger which is after Adguard is able to log the correct IP.

I tried, Adguard in Docker, OpenWrt Directly and still got the same issue.

Adguard Version 1.107.56

Any pointers by anyone whould be much appreciated.

[ainar-g]

You keep mentioning both AdGuard DNS and AdGuard Home, which are two different things. Assuming you actually mean AdGuard Home, you can enable verbose logging and see the decisions AGH does with regards to the incoming hosts and IP addresses.

[pradumnk-mahanta]

Hi @ainar-g ,
Thank you for your reply. I have corrected my post. Yes, it is all AdguardHome.

I enabled verbose logging, but still could not find the issue out. If you get time, please have a look and let me know if anything clicks.

Following is all the logs, when my client (1.2.3.4) tries to reach abc.mydomain.com for my application (192.168.1.Z).

I see that it is taking my Cloudflared Tunnel IP (192.168.1.X) for Stats & Query Logs.

2025/02/20 22:20:27.177834 3722#15038 [debug] dnsproxy: in line_num=7 line=";; QUESTION SECTION:"
2025/02/20 22:20:27.177860 3722#15038 [debug] dnsproxy: in line_num=8 line=";abc.mydomain.com.\tIN\t A"
2025/02/20 22:20:27.177894 3722#15038 [debug] dnsproxy: in line_num=9 line=""
2025/02/20 22:20:27.177921 3722#15038 [debug] dnsforward: started processing initial
2025/02/20 22:20:27.177946 3722#15038 [debug] applying filters: looking for client with ip 192.168.1.X and clientid ""
2025/02/20 22:20:27.177980 3722#15038 [debug] applying filters: no clients with ip 192.168.1.X and clientid ""
2025/02/20 22:20:27.178009 3722#15038 [debug] dnsforward: finished processing initial
2025/02/20 22:20:27.178022 3722#15038 [debug] dnsforward: started processing ddr
2025/02/20 22:20:27.178035 3722#15038 [debug] dnsforward: finished processing ddr
2025/02/20 22:20:27.178048 3722#15038 [debug] dnsforward: started processing dhcp hosts
2025/02/20 22:20:27.178082 3722#15038 [debug] dnsforward: finished processing dhcp hosts
2025/02/20 22:20:27.178097 3722#15038 [debug] dnsforward: started processing dhcp addrs
2025/02/20 22:20:27.178115 3722#15038 [debug] dnsforward: finished processing dhcp addrs
2025/02/20 22:20:27.178129 3722#15038 [debug] dnsforward: started processing filtering before req
2025/02/20 22:20:27.178161 3722#15038 [debug] rewrite: a/aaaa for abc.mydomain.com is 192.168.1.Y
2025/02/20 22:20:27.178178 3722#15038 [debug] dnsforward: finished processing filtering before req
2025/02/20 22:20:27.178191 3722#15038 [debug] dnsforward: started processing upstream
2025/02/20 22:20:27.178204 3722#15038 [debug] dnsforward: finished processing upstream
2025/02/20 22:20:27.178216 3722#15038 [debug] dnsforward: started processing filtering after resp
2025/02/20 22:20:27.178229 3722#15038 [debug] dnsforward: finished processing filtering after resp
2025/02/20 22:20:27.178268 3722#15038 [debug] ipset: started processing
2025/02/20 22:20:27.178301 3722#15038 [debug] ipset: finished processing
2025/02/20 22:20:27.178315 3722#15038 [debug] dnsforward: started processing querylog and stats
2025/02/20 22:20:27.178331 3722#15038 [debug] dnsforward: client ip for stats and querylog: 192.168.1.X
2025/02/20 22:20:27.178379 3722#15038 [debug] dnsforward: finished processing querylog and stats
2025/02/20 22:20:27.178413 3722#15038 [debug] dnsproxy: out line_num=1 line=";; opcode: QUERY, status: NOERROR, id: 41811"
2025/02/20 22:20:27.178436 3722#15038 [debug] dnsproxy: out line_num=2 line=";; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0"
2025/02/20 22:20:27.178457 3722#15038 [debug] dnsproxy: out line_num=3 line=""
2025/02/20 22:20:27.178478 3722#15038 [debug] dnsproxy: out line_num=4 line=";; QUESTION SECTION:"
2025/02/20 22:20:27.178499 3722#15038 [debug] dnsproxy: out line_num=5 line=";abc.mydomain.com.\tIN\t A"
2025/02/20 22:20:27.178519 3722#15038 [debug] dnsproxy: out line_num=6 line=""
2025/02/20 22:20:27.178541 3722#15038 [debug] dnsproxy: out line_num=7 line=";; ANSWER SECTION:"
2025/02/20 22:20:27.178562 3722#15038 [debug] dnsproxy: out line_num=8 line="abc.mydomain.com.\t10\tIN\tA\t192.168.1.Y"
2025/02/20 22:20:27.178583 3722#15038 [debug] dnsproxy: out line_num=9 line=""
2025/02/20 22:20:27.178628 3722#21 [debug] addrproc: processing rdns ip=192.168.1.X
2025/02/20 22:20:27.178658 3722#21 [debug] addrproc: finished processing rdns ip=192.168.1.X host="" elapsed=26.766µs
2025/02/20 22:20:27.178676 3722#21 [debug] addrproc: processing whois ip=192.168.1.X
2025/02/20 22:20:27.178698 3722#21 [debug] addrproc: finished processing whois ip=192.168.1.X whois=<nil> elapsed=18.42µs
2025/02/20 22:20:27.178730 3722#15039 [debug] dnsproxy: handling new udp packet raddr=192.168.1.X:32983
2025/02/20 22:20:27.178758 3722#15039 [debug] dnsproxy: in line_num=1 line=";; opcode: QUERY, status: NOERROR, id: 7106"
2025/02/20 22:20:27.178781 3722#15039 [debug] dnsproxy: in line_num=2 line=";; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1"
2025/02/20 22:20:27.178802 3722#15039 [debug] dnsproxy: in line_num=3 line=""
2025/02/20 22:20:27.178823 3722#15039 [debug] dnsproxy: in line_num=4 line=";; OPT PSEUDOSECTION:"
2025/02/20 22:20:27.178844 3722#15039 [debug] dnsproxy: in line_num=5 line="; EDNS: version 0; flags:; udp: 1232"
2025/02/20 22:20:27.178864 3722#15039 [debug] dnsproxy: in line_num=6 line=""
2025/02/20 22:20:27.178884 3722#15039 [debug] dnsproxy: in line_num=7 line=";; QUESTION SECTION:"
2025/02/20 22:20:27.178904 3722#15039 [debug] dnsproxy: in line_num=8 line=";abc.mydomain.com.\tIN\t AAAA"
2025/02/20 22:20:27.178924 3722#15039 [debug] dnsproxy: in line_num=9 line=""
2025/02/20 22:20:27.178944 3722#15039 [debug] dnsforward: started processing initial
2025/02/20 22:20:27.178963 3722#15039 [debug] applying filters: looking for client with ip 192.168.1.X and clientid ""
2025/02/20 22:20:27.178982 3722#15039 [debug] applying filters: no clients with ip 192.168.1.X and clientid ""
2025/02/20 22:20:27.178997 3722#15039 [debug] dnsforward: finished processing initial
2025/02/20 22:20:27.179010 3722#15039 [debug] dnsforward: started processing ddr
2025/02/20 22:20:27.179023 3722#15039 [debug] dnsforward: finished processing ddr
2025/02/20 22:20:27.179036 3722#15039 [debug] dnsforward: started processing dhcp hosts
2025/02/20 22:20:27.179050 3722#15039 [debug] dnsforward: finished processing dhcp hosts
2025/02/20 22:20:27.179063 3722#15039 [debug] dnsforward: started processing dhcp addrs
2025/02/20 22:20:27.179076 3722#15039 [debug] dnsforward: finished processing dhcp addrs
2025/02/20 22:20:27.179088 3722#15039 [debug] dnsforward: started processing filtering before req
2025/02/20 22:20:27.179103 3722#15039 [debug] dnsforward: finished processing filtering before req
2025/02/20 22:20:27.179115 3722#15039 [debug] dnsforward: started processing upstream
2025/02/20 22:20:27.179128 3722#15039 [debug] dnsforward: finished processing upstream
2025/02/20 22:20:27.179141 3722#15039 [debug] dnsforward: started processing filtering after resp
2025/02/20 22:20:27.179163 3722#15039 [debug] dnsforward: finished processing filtering after resp
2025/02/20 22:20:27.179205 3722#15039 [debug] ipset: started processing
2025/02/20 22:20:27.179240 3722#15039 [debug] ipset: finished processing
2025/02/20 22:20:27.179253 3722#15039 [debug] dnsforward: started processing querylog and stats
2025/02/20 22:20:27.179268 3722#15039 [debug] dnsforward: client ip for stats and querylog: 192.168.1.X
2025/02/20 22:20:27.179292 3722#15039 [debug] dnsforward: finished processing querylog and stats
2025/02/20 22:20:27.179318 3722#15039 [debug] dnsproxy: out line_num=1 line=";; opcode: QUERY, status: NOERROR, id: 7106"
2025/02/20 22:20:27.179339 3722#15039 [debug] dnsproxy: out line_num=2 line=";; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0"
2025/02/20 22:20:27.179360 3722#15039 [debug] dnsproxy: out line_num=3 line=""
2025/02/20 22:20:27.179380 3722#15039 [debug] dnsproxy: out line_num=4 line=";; QUESTION SECTION:"
2025/02/20 22:20:27.179402 3722#15039 [debug] dnsproxy: out line_num=5 line=";abc.mydomain.com.\tIN\t AAAA"
2025/02/20 22:20:27.179422 3722#15039 [debug] dnsproxy: out line_num=6 line=""
2025/02/20 22:20:27.179458 3722#21 [debug] addrproc: processing rdns ip=192.168.1.X
2025/02/20 22:20:27.179486 3722#21 [debug] addrproc: finished processing rdns ip=192.168.1.X host="" elapsed=22.715µs
2025/02/20 22:20:27.179504 3722#21 [debug] addrproc: processing whois ip=192.168.1.X
2025/02/20 22:20:27.179525 3722#21 [debug] addrproc: finished processing whois ip=192.168.1.X whois=<nil> elapsed=18.173µs