How to Fix RSFirewall Blocking Cloudflare IPs on Apache/XAMPP (mod_remoteip Setup)

Kenapa RSFirewall Suka Nge-Banned IP Cloudflare? Ini Dia Solusinya Pakai mod_remoteip

Wadaw, mumet gw bray. Urusan server emang kadang bikin kepala cenat-cenut. Ya udah, langsung aja gw ceritain pengalaman iseng-iseng berhadapan sama RSFirewall, Cloudflare, sama Apache XAMPP yang bikin gw mikir keras. Semoga tulisan ini bisa jadi obat penenang buat lo yang lagi ngalamin hal serupa.

Awal Mula: Kok Bisa Error 403 Terus?

Jadi gini, ada website Joomla di server Windows pake XAMPP. Website ini pakai Cloudflare biar lebih aman dan cepet. Tapi tiba-tiba, website suka nampilin error 403 Forbidden gitu. Parahnya, pas mau akses halaman administrator juga sama aja. Pokoknya semua URL pada nolak.

Gw coba liat di access.log Apache. Eh, ternyata ada IP 172.69.176.5 yang diblokir. RSFirewall nganggep IP itu attacker karena ada request mencurigakan kayak percobaan exploit PHP. Tapi pas dicek lagi, itu IP punya Cloudflare, bukan IP pengunjung asli.

Nah lho, kenapa bisa gitu?

Penyebabnya: Apache Cuma Lihat IP Cloudflare

Si IP asli client itu xx.xx.xx.xx6. Tapi karena Cloudflare jadi perantara, yang sampe ke server Apache itu IP Cloudflare-nya, bukan IP aslinya. Jadi, Apache dan Joomla (dan RSFirewall) cuma kenal sama IP Cloudflare. Akibatnya, ya gitu, Cloudflare dianggap penyerang.

Client (xx.xx.xx.xx6) → Cloudflare (172.69.176.5) → Apache/Joomla/RSFirewall

Bingung gw. Kok bisa-bisanya sih. Kan seharusnya yang diblokir itu IP yang beneran nakal, bukan IP-nya Cloudflare. Soalnya IP Cloudflare itu dipake bareng sama banyak orang. Kalo sampe keblokir, bukan cuma satu user yang kena, tapi banyak.

Solusi: Kenalan Sama mod_remoteip

Nah, biar Apache bisa tau IP asli pengunjung, kita harus pake modul namanya mod_remoteip. Modul ini fungsinya buat ngubah IP client yang terlihat oleh Apache, jadi pake header dari reverse proxy yang terpercaya. Dalam hal ini, Cloudflare.

Pertama, gw cek dulu modulnya udah ada apa belum.

C:\xampp\apache\bin\httpd.exe -M

Hasilnya, remoteip_module (shared) gak keluar. Artinya belum aktif.

Terus gw cek filenya di C:\xampp\apache\modules\mod_remoteip.so. Filenya ternyata ada. Tinggal diaktifin aja.

1. Buka file C:\xampp\apache\conf\httpd.conf.
2. Cari baris #LoadModule remoteip_module modules/mod_remoteip.so, trus hapus tanda pagar (#) di depannya.
3. Restart Apache.

Abis itu, cek lagi pake httpd.exe -M. Sekarang remoteip_module (shared) udah keluar. Mantap!

Konfigurasi Cloudflare di Apache

Langkah selanjutnya, bikin file konfigurasi khusus buat Cloudflare. Gw bikin file C:\xampp\apache\conf\extra\httpd-cloudflare.conf isinya:

RemoteIPHeader CF-Connecting-IP

RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 104.16.0.0/13
RemoteIPTrustedProxy 104.24.0.0/14
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 131.0.72.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17

# IPv6 ranges
RemoteIPTrustedProxy 2400:cb00::/32
RemoteIPTrustedProxy 2606:4700::/32
RemoteIPTrustedProxy 2803:f800::/32
RemoteIPTrustedProxy 2405:b500::/32
RemoteIPTrustedProxy 2405:8100::/32
RemoteIPTrustedProxy 2a06:98c0::/29
RemoteIPTrustedProxy 2c0f:f248::/32

Yang penting di sini, IP 172.69.176.5 udah termasuk dalam range 172.64.0.0/13. Jadi gak perlu ditulis satu-satu. Keren kan.

Terus, di file httpd.conf bagian bawah, gw tambahin:

Include conf/extra/httpd-cloudflare.conf

Validasi dan Testing

Sebelum restart, gw validasi dulu konfigurasi Apache pake perintah httpd.exe -t. Hasilnya Syntax OK. Berarti aman.

Abis itu, restart Apache lewat Windows Services. Tunggu beberapa saat, terus gw akses website dari komputer client (xx.xx.xx.xx6).

Gw pantau access.log pake perintah:

Get-Content C:\xampp\apache\logs\access.log -Wait -Tail 20

Dan... YES! IP yang muncul sekarang adalah xx.xx.xx.xx6, bukan 172.69.176.5 lagi.

Berarti mod_remoteip udah berhasil. Apache sekarang bisa bedain mana IP asli dan mana IP Cloudflare. RSFirewall juga akhirnya bisa tidur nyenyak tanpa ngeban IP Cloudflare sembarangan.

Kesimpulan: Jangan Asal Blokir IP

Jadi, intinya masalahnya bukan karena RSFirewall terlalu galak. Tapi karena Apache dan Joomla gak tau kalo request itu sebenernya dari IP asli yang lewat Cloudflare. Solusi dengan mod_remoteip ini emang paling bener.

Beberapa hal yang harus diinget:

• Jangan blokir IP Cloudflare secara manual.
• Jangan percaya header CF-Connecting-IP dari sumber yang gak jelas.
• Jangan masukkan IP client asli ke daftar RemoteIPTrustedProxy.

Pokoknya, pastikan Apache tau siapa client aslinya. Kalo udah, RSFirewall pasti bakal lebih akurat dalam mendeteksi ancaman.

Gimana, udah paham kan? Kalo masih bingung, coba baca ulang pelan-pelan. Atau tanya aja di kolom komentar, nanti gw jawab semampunya. Hehehe.

Entahlah, semoga tulisan ini bermanfaat ya. Gw capek ngetiknya. Dadah!

How to Stop RSFirewall from Blocking Cloudflare IPs with mod_remoteip

Alright, fellow internet wanderer. I've been wrestling with a server issue that was driving me nuts, and I figured I'd share my battle scars. Maybe it'll save you a few sleepless nights if you're dealing with a similar setup: Joomla, Cloudflare, and XAMPP on Windows.

The Problem: 403 Forbidden Everywhere

So, there's this Joomla site running on a Windows server using XAMPP. Standard stuff. The site is behind Cloudflare for speed and security. But out of nowhere, the site started throwing 403 Forbidden errors left and right. Even the administrator page was locked down. We're talking a total lockdown.

I checked the Apache access.log and found a specific IP: 172.69.176.5. It was getting blocked. RSFirewall flagged it as an attacker because of some suspicious requests that looked like PHP exploit attempts. But after a bit of digging, I realized that IP belongs to Cloudflare. It wasn't the real visitor.

Huh, why is that happening?

Root Cause: Apache Only Sees Cloudflare's IP

The real visitor's IP was xx.xx.xx.xx6. However, because the traffic goes through Cloudflare, the IP that reaches the server is Cloudflare's own IP, not the visitor's. So Apache, Joomla, and RSFirewall had no idea who the real visitor was. They just saw Cloudflare's IP and thought it was the attacker.

Client (xx.xx.xx.xx6) → Cloudflare (172.69.176.5) → Apache/Joomla/RSFirewall

This is a problem because if RSFirewall blocks that Cloudflare IP, it could block all traffic from other users sharing that IP. It's like throwing a net over a whole neighborhood to catch one fish.

The Solution: Introducing mod_remoteip

To fix this, we need to teach Apache to recognize the original visitor's IP. This is where the mod_remoteip module comes in. This module allows Apache to replace the client IP it sees with the one from a trusted reverse proxy header. In our case, that's Cloudflare's CF-Connecting-IP header.

First, I needed to check if the module was available.

C:\xampp\apache\bin\httpd.exe -M

The output didn't show remoteip_module (shared), meaning it wasn't loaded.

I checked for the file at C:\xampp\apache\modules\mod_remoteip.so and it was there. So, I just needed to activate it.

1. Open C:\xampp\apache\conf\httpd.conf.
2. Find the line #LoadModule remoteip_module modules/mod_remoteip.so and remove the '#' to uncomment it.
3. Restart Apache.

After the restart, running httpd.exe -M showed remoteip_module (shared). Great! Module is active.

Configuring Apache for Cloudflare

Next, I created a specific configuration file for Cloudflare. I created C:\xampp\apache\conf\extra\httpd-cloudflare.conf with this content:

RemoteIPHeader CF-Connecting-IP

RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 104.16.0.0/13
RemoteIPTrustedProxy 104.24.0.0/14
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 131.0.72.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17

# IPv6 ranges
RemoteIPTrustedProxy 2400:cb00::/32
RemoteIPTrustedProxy 2606:4700::/32
RemoteIPTrustedProxy 2803:f800::/32
RemoteIPTrustedProxy 2405:b500::/32
RemoteIPTrustedProxy 2405:8100::/32
RemoteIPTrustedProxy 2a06:98c0::/29
RemoteIPTrustedProxy 2c0f:f248::/32

Notice that the IP 172.69.176.5 is already covered by the range 172.64.0.0/13. No need to add it individually. Nice and clean.

Then, at the end of httpd.conf, I added the include directive:

Include conf/extra/httpd-cloudflare.conf

Validation and Testing

Before restarting, I validated the Apache config with httpd.exe -t. The output was Syntax OK. Good to go.

I restarted Apache via Windows Services. After a moment, I accessed the website from the client machine (xx.xx.xx.xx6).

I monitored the access.log using:

Get-Content C:\xampp\apache\logs\access.log -Wait -Tail 20

And... BAM! The IP being logged was now xx.xx.xx.xx6, not 172.69.176.5. Success!

This confirms mod_remoteip is working perfectly. Apache now correctly identifies the real client IP. RSFirewall can finally chill out and not accidentally ban half the internet.

Final Thoughts: Don't Be a Trigger-Happy Blocker

So, the core issue wasn't RSFirewall being overly aggressive. It was the lack of proper IP identification at the Apache level. The mod_remoteip solution is the cleanest and most correct approach.

Key takeaways:

• Don't manually block Cloudflare IPs.
• Don't blindly trust CF-Connecting-IP from untrusted sources.
• Don't add your real client IP to RemoteIPTrustedProxy.

The goal is simple: ensure Apache knows who the real client is. Once that's sorted, security tools like RSFirewall can do their job much more accurately.

Hope this helps! It was a wild ride. Now, go configure your server and get some sleep.

Terima kasih sudah mampir! Jika kamu menikmati konten ini dan ingin menunjukkan dukunganmu, bagaimana kalau mentraktirku secangkir kopi? 😊 Ini adalah gestur kecil yang sangat membantu untuk menjaga semangatku agar terus membuat konten-konten keren. Tidak ada paksaan, tapi secangkir kopi darimu pasti akan membuat hariku jadi sedikit lebih cerah. ☕️

☕ Buy Me Coffee