2.4 KiB
2.4 KiB
created, id, keywords, links, modified, summary, tags, title
| created | id | keywords | links | modified | summary | tags | title | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026-04-08T22:26:44+00:00 | 9d2a0957-c0ab-4777-af26-895740cf4a2c |
|
2026-04-08T22:26:44+00:00 | Configuration guide for forwarding real user IPs to SearXNG through Cloudflare Proxy using Nginx CF-Connecting-IP header. |
|
Cloudflare Proxy and SearXNG IP Header Configuration |
Cloudflare Proxy and SearXNG IP Header Configuration
Problem
The SearXNG instance behind Cloudflare Proxy only sees requests from the Cloudflare Proxy itself, not the actual IP address of the end user. This causes issues with rate limiting and logging functionality.
Solution
Every request sent from Cloudflare Proxies includes a separate CF-Connecting-IP header containing the real user's IP address. By configuring your reverse proxy (Nginx) to forward this header to SearXNG, you can enable proper IP logging and rate limiting.
Nginx Configuration
Add the following rules to your Nginx reverse proxy configuration:
proxy_set_header Host $host;
proxy_set_header Connection $http_connection;
proxy_set_header X-Forwarded-For $http_cf_connecting_ip;
proxy_set_header X-Real-IP $http_cf_connecting_ip;
proxy_set_header X-Scheme $scheme;
Expected Outcome
- Real user IPs are forwarded to the SearXNG instance
- IP logging functionality is restored
- Rate limiting can be re-enabled
- Should not encounter further rate limit issues
Additional Use Cases
The CF-Connecting-IP header can be useful in other scenarios:
- Deploying Fail2Ban or CrowdSec on login prompts
- Services like Vaultwarden Server (some allow header configuration directly)
- Other reverse proxy setups (Traefik, Caddy alternatives may exist)
Notes
- SearXNG stores IPs encrypted, so direct verification of logging may not be possible
- Rate limit issue resolution serves as practical confirmation (95% confidence it works as intended)
- Alternative to completely disabling Cloudflare proxy (which was recommended but not ideal)
Related Users
- @unixf0x - Original discovery and recommendation
- @LincHayes - Also encountered this issue
Source: Cloudflare Proxy SearXNG IP Header Configuration Discussion