In version 5.51, we have added a new rules set in WAF called “Proxy IP Check”, which is actually a Layer 7 extension of our IPDB distributed firewall. The limitation of IPDB system firewall is that it operates in Layer 3 and thus it cannot detect the real IP address of the visitor if it is embedded in the HTTP header. This normally happens when there is  a proxy like CloudFlare is placed in front of the actual web server. So IPDB distributed firewall cannot block attacks as in Layer 3, all such traffic is coming from the proxy server. This limitation is not just with IPDB, but with all system-level firewalls.

We have noticed that the large number of attacks from known bad IPs are bypassed through proxies like CloudFlare and thus we introduced the new rules set. When you enable “Proxy IP Check” rules set, the client IP embedded using the following header will be detected.