Cloudflare IP addresses

[TXJustin]

v0.31.0
I can not figure out how to get real IP addresses through cloudflare to log. I modify the config.yml using the example from the docs:
middlewares:
- use: cloudflare_real_ip
- use: ModifyResponse
set_headers:
Access-Control-Allow-Headers: ""
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
Access-Control-Allow-Origin: ""
Access-Control-Max-Age: 180
Content-Security-Policy: object-src 'self'; frame-ancestors 'self';
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
and the logs set to combined format logs the cloudflare proxy server IP address.

Gemini gave me an alternate option:
middlewares:
- use: real_ip
header: CF-Connecting-IP
from:
- cloudflare

Which logs the error:
errors:
entrypoint error
entrypoint[0]
from > [0]: invalid CIDR address: cloudflare/32
realIP.From: validation error
require "min:1"

Gemini's next response was:
middlewares:
- use: real_ip
header: CF-Connecting-IP
from:
- 0.0.0.0/0
- ::/0
- use: ModifyResponse

This did not work either, and now Gemini says the logs record before middlewares take effect, so ... I don't even know.

[TXJustin]

I don't know what or why Gemini led me down that path.

With some more testing I've found that the default from the sample config works, but only when there is a matching route. Before moving some items over I was testing with what I knew were garbage urls as a quick and easy test assuming it would show the real IP if configured properly, and when it did not that's when I thought my config must be wrong.

It's not really fair to you, but with NGINX Proxy Manager being the first reverse proxy most people (me included) use, I made the assumption that other programs would behave the same way and since NPM logs the real ip address for a 404 error I assumed that would be true here as well.

[yusing]

Thanks for following up. Your assumption was reasonable, and your testing found the actual limitation: in v0.31.0, cloudflare_real_ip only runs when a route matches. Unmatched requests take the entrypoint’s 404 path, so the access log still sees the Cloudflare proxy address.

from: cloudflare is not supported syntax, and using 0.0.0.0/0 or ::/0 would trust forwarded-IP headers from any client, so please do not use that workaround.

Please upgrade to v0.31.1 and do this

entrypoint:
  rules:
    not_found: |
      {
        middleware CloudflareRealIP
      }

This applies the same trusted Cloudflare real-IP handling before unmatched requests are written to the access log. Keep your existing cloudflare_real_ip middleware for matched routes. Thanks for identifying this gap.

[TXJustin]

Success, connecting with some random path returns 404 and logs the real IP address.

Somewhat related question - might I have something configured incorrectly: When I brought up godoxy I have thousands of tls handshake errors for 13 minutes until the cloudflare proxy IP list is loaded:

2026-08-29T01:18:59.413545570Z [godoxy-proxy] 08-28 20:18 INF startup configuration summary enabled_subsystems=["autocert","entrypoint_middlewares","access_log"]
2026-08-29T01:18:59.413548492Z [godoxy-proxy] 08-28 20:18 INF config committed: healthy
2026-08-29T01:18:59.413550791Z [godoxy-proxy] providers: 6 ready, 0 degraded, 0 failed
2026-08-29T01:18:59.413553012Z [godoxy-proxy] routes: 45 active, 0 failed
2026-08-29T01:18:59.413555217Z [godoxy-proxy] api: main ready, local not configured
2026-08-29T01:18:59.413557415Z [godoxy-proxy] metrics: ready
2026-08-29T01:18:59.480162347Z [godoxy-proxy] 08-28 20:18 ??? http: TLS handshake error from 162.158.248.138:31126: EOF
2026-08-29T01:18:59.505385944Z [godoxy-proxy] 08-28 20:18 ??? http: TLS handshake error from 172.69.170.148:14878: EOF
(snip)
2026-08-29T01:27:24.401822069Z [godoxy-proxy] 08-28 20:27 ??? http: TLS handshake error from 172.68.145.148:63774: EOF
2026-08-29T01:31:46.367468215Z [godoxy-proxy] 08-28 20:31 INF cloudflare CIDR range updated