3 ms·
We'll be presenting the original IP. If you wish to block or otherwise take action on, e.g., malicious traffic from the IP being used to connect to Warp, you'l
by prdonahue 8y ago
We'll be presenting the original IP.
If you wish to block or otherwise take action on, e.g., malicious traffic from the IP being used to connect to Warp, you'll be able to do so.
- dsl 8y agoIs this in X-Forwarded-For?
- prdonahue 8y agoCF-Connecting-IP is what we recommend using. See https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers- https://support.cloudflare.com/hc/en-us/articles/200170986-H... for details.
- devicenull 8y agoWhich presumably only works if your site is using Cloudflare? Since you wouldn't be MITMing SSL in order to inject this header?
- zackbloom 8y agoThis is correct. It's significantly harder to inject the origin IP into a TCP stream. We have ways [1] of doing it, but it requires some coordination on both sides. 1- https://blog.cloudflare.com/mmproxy-creative-way-of-preserving-client-ips-in-spectrum/ https://blog.cloudflare.com/mmproxy-creative-way-of-preservi...
- dsl 8y agoHave you considered enabling this out of band? For example as a network administrator I could verify a CIDR block and receive a real time stream of 5-tuples (err, 7-tuples with the proxy?) destined to my network.
- topranks 8y agoHow can they do this? Are Cloudflare going to be able to decrypt the TLS sessions running over their VPN between me and end-sites, so they can insert this additional HTTP header? Doesn’t sound feasible.
- X-Istence 8y agoWhen most of those sites are hosted by Cloudflare, they already decrypt the TLS session at their load balancers before forwarding the request to the remote endpoint.
- mobilemidget 8y agoAnd then at some point CF protected sites can dis- or enable to only allow warp VPN users per filter?