Unable to get source IP of connected player

[dimaguy]

I have the following architecture:
Player (running modflared) --> cloudflared --> haproxy --> velocity --> server

Currently cloudflared doesn't seem to send me the source IP of the player, which makes it a bit harsh to moderate with, would it be possible to have a side channel or http tunnel that gives me the contents of the CF-Connecting-IP header?

[HttpRafa]

I’m not sure if I understood your question correctly, but the packets sent by a player are modified through Cloudflared, like NAT. This means that Minecraft only sees the source IP in the TCP header, which is the IP of your Cloudflared instance in the local network. The same problem with not getting the correct source IP happens when you route traffic through a VPN using NAT. If you want to see the real IP in Minecraft, you need to install a mod on the server that reads the Cloudflare header. But honestly, I have no idea how that would work.

[dimaguy]

You've understood it correctly. If we monitor the logs in the cloudflared at server end, we can tie the logs between the ssl detector and the tcp connection because they share the same connIndex id, a server side of this mod could be written to launch cloudflared at the proxy (velocity), and create a PROXY connection that contains the TCP stream from the player with the data obtained from the SSL Detector probe, this could be done by parsing the stdout logs and opening a new port that reverse proxies the connection

[HttpRafa]

That's an interesting idea, and it would definitely be possible, though it sounds like a significant amount of work. I find the concept intriguing and think it would be a great feature to have.

Currently, I have a lot on my plate, and another project I started a few months ago is already consuming most of my free time outside of school. That said, I’d love to explore this idea further when I get the chance.

If you have the skills and the time, you’re welcome to take a crack at it and submit a pull request. I'd be happy to review and collaborate on it! If not, I’ll keep this idea in mind and revisit it when I have more bandwidth.

[dimaguy]

Currently I figure the easiest way would be to set up a wrapper for cloudflared that generates a PROXY protocol connection between cloudflared and velocity, this wrapper would match incoming streams with the right header, the main issue I'm seeing is that in order to be absolutely sure that I'm mixing the right stream with the right connIndex on this wrapper I need to map the source port from cloudflared, and currently it only spills the beans on that when the connection is long gone(see last line of the log image I had sent). I have 0 experience in Go so I'm essentially scrambling a way of getting it to print out at the very least both source port and connindex in the same stdout line.