Cloudflare + NetBird stacked demo
Static nginx page on forest-box, listening only on its NetBird address. This page is rendered per request (nginx SSI) from the headers that reached the backend.
Hops
- Browser to Cloudflare edge (colo
CMH, raya5a933f0e844284b): DDoS, WAF, rate limit - Cloudflare Worker (
cloudflare-worker cf-netbird-stack-demo) adds the secret origin header and the client IP header - NetBird Cloud proxy eu1 checks the secret header, strips it, sets X-Forwarded-For
- WireGuard tunnel to the forest-box NetBird peer (proxy peer address
100.122.108.131) - nginx on 100.122.105.183:18491 (this page)
Headers seen by the backend
| X-Stack-Client-IP (real client, from CF-Connecting-IP) | 216.73.216.197 |
|---|---|
| X-Stack-Country | US |
| X-Forwarded-For (set by NetBird proxy) | 104.23.243.192 |
| X-Real-IP (set by NetBird proxy) | 104.23.243.192 |
| X-Forwarded-Host | stack-demo.eu1.netbird.services |
| Host | 100.122.105.183:18491 |
| CF-Connecting-IP (as received) | 216.73.216.197 |
| Secret origin header reached backend? | no, stripped by NetBird |
| Peer address (TCP source) | 100.122.108.131 |
Raw JSON: /whoami.json