This works because I'm using $realip_remote_addr in the geo block which keeps the original client address when using real_ip_header CF-Connecting-IP. [Best Black Magic Specialist in Dehradun](https://sites.google.com/view/hindiislamictotke/Black-Magic-Specialist-in-Dehradun)