Client Ip Geolocation

Get started

:::note

Client IP Geolocation is currently in closed Beta testing.

:::

There are several things you can do to best handle traffic from Cloudflare VPN and forward-proxy users:

Overview

import { LinkButton } from "~/components"

:::note

Client IP Geolocation is currently in closed Beta testing.

:::

Cloudflare designed Cloudflare WARP and 1.1.1.1 to make Internet browsing more private and secure. These applications encrypt last-mile connections and make it more difficult for others to use client IP addresses in user fingerprinting.

However, unlike legacy VPN applications, we never designed WARP or 1.1.1.1 to hide user locations or allow users to misrepresent their true geographic location. As a web property operator, you can use Client IP Geolocation to map Cloudflare egress IP addresses to specific geolocations.

Get started Learn more

:::note

Client IP Geolocation is different from the Cloudflare IP Geolocation setting, which helps you capture country codes for visitors.

:::

About

:::note

Client IP Geolocation is currently in closed Beta testing.

:::

Cloudflare Client IP Geolocation helps you understand where in the world a given client is located, even if their true client IP address is obscured by Cloudflare's proxy systems. We offer this service to ensure customers have high-quality experiences interacting with origins that rely on geolocation — such as mapping providers — and origin operators can deliver the right content to the right users. Ensuring origins know where clients are located avoids problems associated with traditional VPNs that obscure a consumer’s geolocation and allow circumvention of geographic restrictions on content.

Users cannot opt out of this geolocation support and Cloudflare will always make a best effort to convey geolocation.

Simple explanation

When Cloudflare connects to your origin over IPv4, we geolocate our VPN users to 1 of 1,000 egress locations (a cell). The list of cells is a super set of all the countries in the world and all US Designated Market Areas and includes multiple cells for large metropolitan areas. For all supported cell locations, download our list.

When Cloudflare connects to your origin over IPv6, we geolocate our VPN users to one of thousands of locations distributed across the globe.

If a VPN user tries to use an interposed VPN or proxy system that attempts to hide their location, we share that information with downstream entities.

Technical explanation

We map our egress IP addresses for our forward-proxy offerings to specific geolocations and continuously share this information with major geolocation database providers like MaxMind, IP 2 Location, and Neustar.

When Cloudflare receives an inbound request from a WARP or 1.1.1.1 user, we first geolocate the IP address that made the connection to Cloudflare. Then, we select an egress IP that maps to the client geolocation. We then discard Client IP information to preserve user privacy but return their true geographic location.

If the Client IP is a known proxy or VPN service without strong commitments to preserving client location, we return an unmapped/unknown location.

Because our cell list includes Designated Market Areas in the United States, you can use the returned geolocation information — or lack of it — to enforce content restrictions when delivering linear or on-demand video content subject to common licensing requirements.

Example scenario

Jane is a Cloudflare WARP user in Glendive, Montana, USA. She is interested in the privacy benefits of using a VPN. Her client IP address is 108.59.112.0, which is owned by Mid-Rivers Telephone Cooperative and geolocates to 47.0984,-104.7275, approximately.

Diagram of how Cloudflare reports accurate location information over VPN

Jane connects to Cloudflare’s edge using a secure tunnel. Cloudflare operates an anycast network and dictates VPN ingress by anycast. Jane’s VPN traffic lands in the Cloudflare Minneapolis data center, 930km from Glendive.

A naive geolocation implementation would provide unacceptably inaccurate information. It would have Jane geolocated to Minneapolis, which is in a totally different state — Minnesota instead of Montana — and Designated Marketing Area — Glendive, MT, the country’s smallest DMA, instead of Minneapolis, MN — from her true location. From a content distribution perspective, this level of geolocation is not acceptable.

Instead, Cloudflare uses its own geolocation mapping to provide much more accurate information. Cloudflare’s edge would geolocate Jane’s client IP (108.59.112.0) to Glendive and select an egress IP address of a.b.c.d from its list of available egress IP addresses based on this geolocation result.

Jane attempts to watch live television via an over-the-top (OTT) video provider. The video provider’s origin sees a connection from a.b.c.d. A geolocation lookup on a.b.c.d returns Glendale, MT, and Jane is able to access the linear video content because the OTT provider is able to geolocate the VPN traffic to the true client location.

FAQ

:::note

Client IP Geolocation is currently in closed Beta testing.

:::

Website operators

What does this functionality mean for me as a website operator?

If you operate a website or ISP that needs to use IP address geolocation information for geographic content restriction, consider allowing IP addresses associated with a VPN.

You can now restrict content delivery to Cloudflare VPN users using the same client IP geolocation mechanisms used for non-VPN users.

How does the above scenario change if I use Cloudflare to secure my infrastructure?

There is significant cross pollination between Cloudflare forward- and reverse-proxy services. When a user connects through Cloudflare proxies to origin infrastructure protected by Cloudflare security tools, our origin-facing tools automatically consume information from our user-facing systems about client geography, IP reputation, and other client metadata. This process happens in a privacy-preserving manner that reduces unnecessary collection of personally identifiable information while ensuring customers can maintain their desired security posture.

WAF custom rules specifying country- or region-level match criteria will match correctly on users passing through our VPN and forward-proxy systems with no action needed from you.

In the example, what happens when Cloudflare’s Minneapolis data center is removed from service for maintenance?

The example scenario still provides accurate geolocation data.

Geography-specific egress IPs are not tightly coupled to physical Cloudflare network locations. We continue using geography-specific egress IPs even if the geographically closest network location or locations are rerouted.

What happens when a user nests or chains VPNs and connects to Cloudflare through a downstream proxy service?

Cloudflare will make best efforts to identify such circumstances and communicate this information upstream to origins. Client IPs will geolocate as unknown when the entity that made the initial connection to Cloudflare appears to have originated from an open-proxy service or we are unsure of the location of the user.

I want greater geographic detail on egress locations. Can you provide it?

Yes! We can provide much finer granularity for origins reachable over IPv6. We encourage adoption of IPv6 for the good of the Internet, as well as for providing much finer detail on user locations to origin operators.

What incentives does Cloudflare have to ensure location information is accurate?

Cloudflare wants those using our consumer VPN and corporate forward-proxy services to have as smooth an experience as possible. We want our users to have uninterrupted browsing experiences. At the same time, we also want to give origin operators the information they need to distribute the right content to the right users at the right times.

Cloudflare VPN users

What does this mean for me as a Cloudflare VPN user?

If you use Cloudflare WARP or 1.1.1.1, geolocation improves your user experience. Because we communicate your geographic location accurately (but still in a non-identifiable way), you should have accurate, geography-specific experiences and uninterrupted access to the content you are licensed to consume in your local geography.

We also maintain all of our privacy commitments regarding your use of our consumer application and will keep your Internet browsing private and secure.

What if I am a user and want to spoof my location?

Cloudflare does not permit or support the spoofing of location and will never offer such functionality in the future.