Seeing some cloud flare IPs in user logs

I'm still seeing some cloudflare IPs in my user logs even though I set up restoring visitor IPs. Could they be using CF WARP?

SI•2/3/25, 12:46 PM

Yes, if they are using warp you will not see their ip address.
But it could be due to other reasons, is one of them a user you can contact for trouble shooting

SSI Yes, if they are using warp you will not see their ip address. But it could be d...

SnowOP•2/4/25, 10:44 AM

No I'm the owner of the site and one of the users keeps on hiding behind cf warp and causing problems for me. I'm worried if I IP ban them It would IP ban CF causing my website to break

SSnow No I'm the owner of the site and one of the users keeps on hiding behind cf warp...

Chaika•2/4/25, 2:38 PM

Just don't ban (or whitelist) the proxy IPs: https://www.cloudflare.com/ips/

IP Ranges | Cloudflare

This page is intended to be the definitive source of Cloudflare’s current IP ranges.

Chaika•2/4/25, 2:39 PM

There's some other CF IPs that may be relevant if you're using specific services like Health Checks, Cloudflare tunnels, but otherwise the rest of the IPs from Cf's ASN would be safe to ban

CChaika Just don't ban (or whitelist) the proxy IPs: https://www.cloudflare.com/ips/

SnowOP•2/4/25, 2:53 PM

The thing is I'm only seeing the IPs there logging in with its IPv6 2a09:bac5:d46e:25cd:0000:0000:03c4:004b. I have the IPs being properly restored. I don't use health checks and I don't use cloudflare tunnels. Looking at the list you gave me the IP isn't on it. Hypothetically if I were to just block the cloud flare ASN at the domain level would that cause problems?

SnowOP•2/4/25, 2:54 PM

That IP belongs to the cloudflare ASN

SSnow The thing is I'm only seeing the IPs there logging in with its IPv6 2a09:bac5:d4...

Chaika•2/4/25, 3:04 PM

At the domain level of what service? If you did it on your web host without proper excluding of the proxy ranges, you'd block all the proxy traffic

CChaika At the domain level of what service? If you did it on your web host without prop...

SnowOP•2/4/25, 3:08 PM

I'm talking about on the CF panel itself

SSnow I'm talking about on the CF panel itself

Chaika•2/5/25, 4:20 AM

you still def run the risk of blocking some automated cf stuff (like speed tests, maybe health checks simulating zone, etc), but off my quick test it does work just to block the normal cf asn like that to stop warp. May worth noting Apple's Private Relay shares some IPs from the CF ASN + Akamai + their own I believe, if you wanted to block that (or maybe didn't want to)

Seeing some cloud flare IPs in user logs

Similar Threads

Similar Threads

Similar Threads