Search results

The OLS access control approach does work, the issue is usually the interaction between useIpInProxyHeader and deny ALL. When Use Client IP in Header is set to Trusted IP Only, OLS evaluates access control against the rewritten visitor IP instead of the Cloudflare TCP source IP. So deny ALL...

This is a known conflict between useIpInProxyHeader and access control that catches a lot of people out. The short answer: keep Use Client IP in Header set to No and fix your log format instead. When Trusted IP Only is enabled, OLS replaces the session IP with the value from CF-Connecting-IP...