CloudFlare IP whitelist & set_real_ip_from

cf.sh

#!/bin/bash
set -x

echo "#Cloudflare" > /etc/nginx/conf.d/00_real_ip_cloudflare_00.conf;
ips=$(curl https://www.cloudflare.com/ips-v4)

iptables -F cloudflare;
iptables -N cloudflare;
iptables -C INPUT -p tcp -m multiport --dports http,https -j cloudflare || iptables -A INPUT -p tcp -m multiport --dports http,https -j cloudflare
iptables -A cloudflare -p tcp -m multiport --dports http,https -s 127.0.0.0/8 -j ACCEPT;
for i in $ips; do
        iptables -A cloudflare -p tcp -m multiport --dports http,https -s $i -j ACCEPT;
        echo "set_real_ip_from $i;" >> /etc/nginx/conf.d/00_real_ip_cloudflare_00.conf;
done

iptables -A cloudflare -j DROP
echo "real_ip_header CF-Connecting-IP;" >> /etc/nginx/conf.d/00_real_ip_cloudflare_00.conf;
nginx -s reload