title: How can I configure NGINX ingress controller to work with Cloudflare and Digital Ocean Load Balancer?
body: <p>I have tried the answers in <a href="https://stackoverflow.com/questions/56489147/how-to-restore-original-client-ip-from-cloudflare-with-nginx-ingress-controller">this question</a>. This is my current configuration:</p>
  <pre><code>apiVersion: v1
  kind: ConfigMap
  metadata:
    labels:
      helm.sh/chart: ingress-nginx-2.13.0
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/version: 0.35.0
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/component: controller
    name: ingress-nginx-controller
    namespace: ingress-nginx
  data:
    use-proxy-protocol: 'true'
    enable-real-ip: &quot;true&quot;
    proxy-real-ip-cidr: &quot;173.245.48.0/20,173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32&quot;
    # use-forwarded-headers: &quot;true&quot;
    # compute-full-forwarded-for: &quot;true&quot;
    # forwarded-for-header: &quot;Cf-Connecting-Ip&quot;
    # forwarded-for-header: &quot;X-Original-Forwarded-For&quot;
    server-snippet: |
      real_ip_header CF-Connecting-IP;
  </code></pre>
  <p>And none of the configuration I have tried is actually giving the originating ip as the real ip.</p>
  <p>Before I applied the configuration, I was getting:</p>
  <pre><code>Host: example.com
  X-Request-ID: deadcafe
  X-Real-IP: 162.158.X.X (A Cloudflare IP)
  X-Forwarded-For: 162.158.X.X (Same as above)
  X-Forwarded-Proto: https
  X-Forwarded-Host: example.com
  X-Forwarded-Port: 80
  X-Scheme: https
  X-Original-Forwarded-For: &lt;The Originating IP that I want&gt;
  Accept-Encoding: gzip
  CF-IPCountry: IN
  CF-RAY: cafedeed
  CF-Visitor: {&quot;scheme&quot;:&quot;https&quot;}
  user-agent: Mozilla/5.0 
  accept-language: en-US,en;q=0.5
  referer: https://pv-hr.jptec.in/
  upgrade-insecure-requests: 1
  cookie: __cfduid=012dadfad
  CF-Request-ID: 01234faddad
  CF-Connecting-IP: &lt;The Originating IP that I want&gt;
  CDN-Loop: cloudflare
  </code></pre>
  <p>After applying the config map, the headers are:</p>
  <pre><code>Host: example.com
  X-Request-ID: 0123fda
  X-Real-IP: 10.X.X.X (An IP that matches the private ip of the Digital Ocean droplets in the vpc, so guessing its the load balancer)
  X-Forwarded-For: 10.X.X.X (Same as above)
  X-Forwarded-Proto: http
  X-Forwarded-Host: example.com
  X-Forwarded-Port: 80
  X-Scheme: http
  X-Original-Forwarded-For: &lt;Originating IP&gt;
  Accept-Encoding: gzip
  CF-IPCountry: US
  CF-RAY: 5005deeb
  CF-Visitor: {&quot;scheme&quot;:&quot;https&quot;}
  accept: /
  user-agent: Mozilla/5.0
  CF-Request-ID: 1EE7af
  CF-Connecting-IP: &lt;Originating IP&gt;
  CDN-Loop: cloudflare
  </code></pre>
  <p>So the only change after the configuration is that the real-ip now points to some internal resource on the Digital Ocean vpc. I haven't been able to track that down but I am guessing its the load balancer. I am confident that it is a DO resource because it matches the ip of the kubernetes nodes. So, I am not really sure why this is happening and what I should be doing to get the originating ip as the real ip.</p>