Recently was trying to disable access to a subfolder on an IIS site. Adding IP Restrictions to the site , and looking the Logs , the address of the requestor was coming up as the Gateway of the DMZ.

We need to use the X-forwarder-For header for this , however a need a WAF or application level firewall to do this stamping for us

After enabling Proxy Mode on Cloudflare for the hostname , the correct IP address starting populating for X-forwarder-For header so I could turn on blocking