Restore error

aaP_smithdayton

I had to restore by server from backup due to a move in physical locations. Several apps had to be manually reinstalled and configured. Now the WAF is failing to use Cf-Connecting-IP and only reports the local host IP in the GUI, details appear to accurately report the source IP. If I attempt to "Fix" the installation. I receive the following error..

ERROR: Failed to copy file /tmp/panel_1774844501/panel/script/bt-ipfilter
Updating: 0/5304 .......... .......... .......... 0.00% init.sh
ERROR: Failed to copy file /tmp/panel_1774844501/panel/script/bt-ipfilter
Updating: 0/5304 .......... .......... .......... 0.00% init.sh
ERROR: Failed to copy file /tmp/panel_1774844501/panel/script/bt-ipfilter
Restoring backup files: 0/5304 .......... .......... .......... 0.00% init.sh
ERROR: Failed to copy file /www/server/panel_bak_1774844503/script/bt-ipfilter
Operation failed, backup has been restored successfully...

I have no idea if this is related to the failure to report the Cf-Connecting-IP in the console. Looking for some direction to resolve the error in the WAF reports.

Thanks,

aaPanel_Kern

Hello,

Please use the update command directly: bt 16
This file is in use and cannot be updated normally

aaP_smithdayton

Did not help, web logs still report the local IP address.

aaPanel_Kern

Hello,

Does WAF enable CDN?

aaP_smithdayton

Yes, each website is configured to use CDN in the WAF website tab. Oddly the total number of interceptions is higher then the items in the log detail. The CF-Connecting-IP in the log appears correct, and the waf-intercept-client-ip-port shows the local IP:port. So the log appears to properly identify it, but reports it wrong in the web logs as the local ip as well as listing the local IP in the WAF interface. It did not do this before the restore.

aaPanel_Kern

It is recommended that you provide screenshots and corresponding information

aaP_smithdayton

Local IP address in blockade tab.

details from blockade tab:
GET /robots.txt HTTP/1.1
cdn-loop: cloudflare; loops=1
accept: text/html;q=0.95,text/;q=0.9,/*;q=0.8
x-forwarded-proto: https
accept-encoding: gzip, br
user-agent: Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)
cf-connecting-ip: 217.113.194.22
host: [redacted].com
x-forwarded-for: 217.113.194.22
cf-warp-tag-id: 2234b41c-6692-4478-85e4-ad1014c23e27
cf-visitor: {"scheme":"https"}
cf-ray: 9e5dd0274d31d104-CDG
from: tech@babbar.tech
cf-ipcountry: FR
waf-intercept-client-ip-port: [internal ip redacted].6:36806

www/logs

[internal ip] - - [02/Apr/2026:02:06:32 -0700] ＂GET / HTTP/1.1＂ 200 932546 ＂-＂＂Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36＂

Please let me know if you need something else.

aaPanel_Kern

Are you using a NAT mode network or a reverse proxy?

aaP_smithdayton

No, I am using Cloudflare Zero Trust Tunnels, which I was also using before the server was physically moved to a new location and restored from backup. Prior to the restore I had no issues with Cloudflare connecting IP through the tunnels.

aaPanel_Kern

Hello,

What IP does the website log show?
Which device IP is the internal IP?
Is additional configuration required?

aaP_smithdayton

The website logs show the internal network adapters IP address, which is being reported correctly in the WAF details "waf-intercept-client-ip-port" value.

I am using the exact same configuration that was backed up and restored from the working server. Nothing has changed aside from the internal IP address of the host, and the CF zero trust application ip address pointing to the new tunnel.