I have a DNS record (a subdomain) pointing to the public IP address of an EC2 instance (AWS machine) that hosts my Moodle application server.
I've observed the following behavior when the proxy feature of the DNS record (Cloudflare proxy) is active:
Incoming IP Address: The application server logs show the incoming IP address as belonging to Cloudflare and not the real client IP address.
Moodle Login Issue: The Moodle platform seems to be incorrectly handling the session. Because the client IP address (seen by Moodle) constantly changes (even if the IPs are all from the Cloudflare range), Moodle interprets this change as a security risk and blocks the login attempt.
Troubleshooting & Hypothesis
Test on AWS (Direct Access): We created a new subdomain hosted directly on AWS (without the Cloudflare proxy), and Moodle works flawlessly.
Conclusion: This confirms that the issue is related to a misconfiguration or specific behavior of Cloudflare's proxy.
The Question
Has anyone encountered this specific behavior before?