# Traffic from cloudflare is not blocked by ipblacklist plugin

**URL:** <https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841>\
**Category:** Traefik v2\
**Tags:** plugin\
**Created:** [December 19, 2023, 10:50am UTC](https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841 "2023-12-19T10:50:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![deo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/deo/32/8004_2.png) [@deo](https://community.traefik.io/u/deo)\
**Post date:** [December 19, 2023, 10:50am UTC](https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841/1 "2023-12-19T10:50:29Z")

</div>

I've installed and enabled ipblacklist plugin like this:  
**traefik.yml**

```auto
api:
  dashboard: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"
    http:
      middlewares:
        - my-traefik-plugin-ipblacklist@file

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

  file:
    directory: /configuration
    watch: true

experimental:
  plugins:
    traefik-plugin-ipblacklist:
      moduleName: "github.com/LyuHe-uestc/traefik-plugin-ipblacklist"
      version: "v0.0.2"

```

**configuration/file.yml**

```auto
http:
  middlewares:
    my-traefik-plugin-ipblacklist:
      plugin:
        traefik-plugin-ipblacklist:
          SourceRange:
            - test_ip/32

```

what I observe now:

1. test ip is correctly banned with 403 status when I try to access traefik dashboard
2. All hosts from the docker provider are still accessible

What I need to apply this plugin globally to literally ALL hosts?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 19, 2023, 11:08am UTC](https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841/2 "2023-12-19T11:08:05Z")

</div>

To me it seems you applied the plugin `middlewares` on `entrypoint`, so it should be available for all `routers` using `websecure`.

---

<div class="post-metadata">

**Author:** ![deo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/deo/32/8004_2.png) [@deo](https://community.traefik.io/u/deo)\
**Post date:** [December 19, 2023, 11:34am UTC](https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841/3 "2023-12-19T11:34:54Z")

</div>

Thanks, it is appeared to be related to the Cloudflare proxy mode enabled for the respective domains.  
On updating /etc/hosts locally to bypass Cloudflare I was finally banned successfully 🙂  
So the question now turned into how to unmask client IP before calling ipblacklist plugin

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 19, 2023, 12:57pm UTC](https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841/4 "2023-12-19T12:57:50Z")

</div>

Check if Cloudflare supports `ProxyProtocol`. Traefik does.

---

<div class="post-metadata">

**Author:** ![deo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/deo/32/8004_2.png) [@deo](https://community.traefik.io/u/deo)\
**Post date:** [December 19, 2023, 1:17pm UTC](https://community.traefik.io/t/traffic-from-cloudflare-is-not-blocked-by-ipblacklist-plugin/20841/5 "2023-12-19T13:17:52Z")

</div>

Maybe I just need something like this in front of ipblacklist?

> **[Real IP from Cloudflare Proxy/Tunnel](https://plugins.traefik.io/plugins/62e97498e2bf06d4675b9443/real-ip-from-cloudflare-proxy-tunnel)**
>
> get real IP and proto from Cloudflare Proxy/Tunnel