DNS-over-HTTPS behind cloudflare proxy

[notsphinx]

DNS itself is working well, but statistics all report the proxy address as the client. AFAIK, cloudflared does send x-real-ip not sure if there is a disconnect somewhere in between the proxy and Technitium. Has anyone run into this and found a solution/workaround?

Thanks

[ShreyasZare]

Thanks for asking. Why are you using cloudflared? AFAIK, cloudflared is a DNS proxy that takes in UDP requests and forward them to DNS-over-HTTPS upstream. You don't need that when you have Technitium DNS server.

[notsphinx]

Thanks, Shreyas. I am using cloudflared as a proxy to open up access to the Technitium DNS server on my home network. So I can point my devices to the DoH server even while I am away from my home network. This is not using cloudflare DNS, just their proxy so I do not have to punch holes in the home firewall.

The DoH server access itself is working well, but the issue is in the reporting. All stats show up as coming in from the cloudflare proxy endpoint on my home network. The real client IPs are not showing up.

Am I making sense? Thanks

[ShreyasZare]

So, if I understood it correctly, you use cloudflared on your laptop to allow it to access DoH service that you host at your home. You got a reverse proxy at on home network which does reverse proxy to Technitium DNS server.

If that is correct then you just need to configure your reverse proxy to set X-Real-IP header with the client's IP as the value when proxying to the DNS server.

If you are using nginx as the reverse proxy then add proxy_set_header X-Real-IP $remote_addr; in your reverse proxy config.

[notsphinx]

Thanks for the quick response. Looks like cloudflared is using X-Forwarded-For. I have to investigate if there is a way to modify it to send X-Real-IP. How difficult is it to also look for X-Forwarded-For in addition to X-Real-IP?

[rehanone]

This is not something that should be handled by the application server like DNS. As per the documentation, cloudflared provides that IP as CF-Connecting-Ip. This would need to be translated into X-Real-Ip. The proper way to do this is by using a reverse proxy in front of the DNS server. The reverse proxy can terminate the TLS connection and transform the header as a middle-ware and then pass on the request as a DNS-over-HTTP. I am using traefik for the same purpose and and it works perfectly. Any reverse proxy can do this without any issues. In case of traefik, there is a dedicated plugin that does exactly this task. This is a link for that plugin: https://plugins.traefik.io/plugins/628c9f01108ecc83915d776c/traefik-real-ip

[ShreyasZare]

This issue has nothing to do with you using cloudflared on your client device. It your reverse proxy that needs to be configured since the DNS server is not directly exposed on the public IP address.