NginxProxyManager / NginxProxyManager/nginx-proxy-manager

v3 did not take into account being deployed on a VPS and getting blocked by Cloudflare.

Open
#4,783 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug stale
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

After the initial startup, I encountered the following error:

nginx: [emerg] invalid number of arguments in "set_real_ip_from" directive in /etc/nginx/conf.d/include/ipranges.conf:13585

I investigated the issue and checked the end of the configuration file, where I found:

# Cloudflare Ranges from: https://www.cloudflare.com/ips-v4
set_real_ip_from <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><>

# Cloudflare Ranges from: https://www.cloudflare.com/ips-v6
set_real_ip_from <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><>

I'm reporting this as a bug.

Many VPS IP ranges are not trusted by Cloudflare, so requests to https://www.cloudflare.com/ips-v4 or /ips-v6 get intercepted by Cloudflare's "5-second challenge" (interstitial page), causing the actual IP lists to be replaced with HTML content. This breaks the Nginx configuration.

I suggest hardcoding Cloudflare's IP ranges in the image or build artifact. Alternatively, during the CI/CD pipeline before each release, automatically fetch the latest Cloudflare IP ranges (and other dynamic upstream IP lists) and embed them into the configuration. This would ensure the config always contains valid CIDR blocks—not HTML error pages—regardless of the deployment environment.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how /etc/nginx/conf.d/include/ipranges.conf is generated and how the Cloudflare IPv4 and IPv6 URLs are fetched during the image or release process. Reproduce the intercepted response, then verify the resulting file contains valid CIDR entries and passes Nginx configuration validation without replacing the lists with HTML.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, nginx
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.