Issue CloudFlare with modsecurity problem

[infoo]

Server operating system version

Debian 11

Plesk version and microupdate number

Plesk Obsidian v18.0.44_build1800220614.18

I installed the Plesk, after days not working, not reachable sites. In the logs I see the modsecurity blocked attackers (yet CloudFlare IP adresses) and nobody can visit the sites...
I don´t know why at 21th century is not integrated there CloudFlares real IP getting... I must completely disable the modsecurity to start working pages.
Is this normal? How get work with CloudFlare? Chinese free panel have this function too (aaPa...).

 

[Peter99]

Try and do a:
apt-get install libapache2-mod-cloudflare

Should restore original visitor IPs.

 

[vikK]

In apache nginx settings add this

#additional http and https directive
RemoteIPHeader CF-connecting-IP

#additional nginx directive
real_ip_header CF-Connecting-IP;

correct ip will be logged.

In fail2ban settings you have to add all CF ips as trusted or turn that off. Else if someone tries to bruteforce/attack your plesk panel,mail,ftp like yoursite.com:8443 CF ip will be jailed.

 

[mow]

The whole point of banning attackers is to prevent them from connecting to your server at all. That doesn't work when all your traffic passes through cloudflare so the only addresses connecting to your server are all from cloudflare. For that to make sense, you would have to ban them at cloudflare, if that's possible with their api.

 

[infoo]

What sent Peter99 i searched and find this:

How can I enable Cloudflare support using Juggernaut Firewall? - Knowledgebase - Danami

Work and added an CloudFlare module to Apache.

vikK need this plus insert? (When yes, where put it? /var/www/vhosts/system/domain.com/conf/vhost_nginx.conf?)