Trusted proxy IPs

Every Shield check that keys on an IP address (brute-force blocking, the IP allow and block lists, country blocking) needs the real visitor IP. Behind Cloudflare, a load balancer or a reverse proxy, the connection comes from the proxy, and the visitor's IP arrives in a header the proxy adds.

The two settings

Both are in System → Global Configuration → MuRu Guard, on the Shield tab.

• Trusted proxy header — the header your proxy sets: CF-Connecting-IP (Cloudflare), X-Forwarded-For, X-Real-IP or True-Client-IP. Leave it on None if the site is not behind a proxy.
• Trusted proxy IPs (new in 5.3.0) — the addresses or ranges (CIDR, one per line) of your proxy or load balancer.

How the visitor IP is chosen

1. With no header selected, the direct connection IP is used.
2. With a header selected, it is believed only when the request comes from a trusted proxy: an address in Trusted proxy IPs, or, with that list empty, a proxy on the same server or private network, or a Cloudflare address for CF-Connecting-IP.
3. X-Forwarded-For is read from the right: each proxy adds the address it saw, so the first address that is not a trusted proxy is the visitor.

If your site is behind a proxy with a public IP that is not Cloudflare, add that IP to Trusted proxy IPs after updating to 5.3.0. Otherwise every visitor is seen as the proxy's IP, and one attacker's failed logins could block everyone.

Why this changed

Before 5.3.0 the header was always believed once selected and the left-most address was used. If the server could also be reached directly, a visitor could send the header themselves and pick any IP, including one on your allow list. Both IPv4 and IPv6 ranges are supported.