L7 (Layer 7)<\/strong><\/td>\n| Application Layer<\/td>\n | Appends X-Forwarded-For<\/code>, hostname\/URL-based control, WAF<\/td>\n<\/tr>\n\nOLS (OpenLiteSpeed)<\/strong><\/td>\n| Web Server<\/td>\n | High-speed delivery, LSCache integration, QUIC (depending on conditions)<\/td>\n<\/tr>\n | \nX-Forwarded-For (XFF)<\/strong><\/td>\n| HTTP Header (L7)<\/td>\n | Passes the real IP to the application\/logs<\/td>\n<\/tr>\n | \nCDN (QUIC.cloud)<\/strong><\/td>\n| Delivery Network<\/td>\n | Caching, TLS\/HTTP3, DDoS mitigation, PoP optimization<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nEnabling WordPress LiteSpeed Cache CDN (QUIC.cloud)<\/h2>\n\n- Conditions for enabling LiteSpeed Cache CDN (QUIC.cloud)\n
\n- \u2026\/?rest_route=\/lscwp\/ip-check must return remote_ip (route IP) + x_forwarded_for (client real IP)<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Why I Got Stuck<\/h2>\n\n- X-Forwarded-For cannot be added at L4
\nnginx stream and simple DNAT cannot touch the “inside” of TCP\/UDP packets.<\/li>\n - OpenLiteSpeed does not support PROXY protocol
\nTricks to carry the original IP via L4 (PROXY proto) cannot be used with OLS either.<\/li>\n - Result: WordPress\/OLS cannot recognize the real client IP, causing LiteSpeed Cache’s ip-check \/ CDN activation to be rejected.<\/li>\n<\/ul>\n
Solution<\/h2>\n\n- Temporarily insert nginx in front at L7 (HTTP)<\/strong>
Set up an nginx container on the remote side, perform TLS termination<\/strong>, and X-Forwarded-For<\/code> attachment<\/strong>. The backend connects to OLS via WireGuard.\n\n\/?rest_route=\/lscwp\/ip-check<\/code> will now return remote_ip<\/code> + x_forwarded_for<\/code><\/strong>.<\/li>\n<\/ol>\n<\/li>\n- Enable LiteSpeed Cache CDN (QUIC.cloud) in this state
\n<\/strong>Ownership verification and registration will pass. Confirm that <\/span>x-qc-pop<\/code><\/strong> and <\/span>alt-svc: h3=\":443\"<\/code><\/strong> appear in the response.<\/span><\/li>\n- Remove nginx and revert to L4 (WireGuard + iptables DNAT)<\/strong>Exposed ports :80\/:443 (and :443\/udp if needed) are set to <\/span>DNAT \u2192 OLS<\/strong>.<\/span> Configure OLS with “Use Client IP in Header = Trusted IP Only”, and <\/span>register the tunnel peer’s source IP in the Allowed List with a
T<\/code> flag<\/strong> (= accept XFF<\/code> only from trusted proxies).<\/span>From then on, <\/span>HTTP\/3 is terminated at the CDN side<\/strong>, keeping the origin lightweight.<\/span><\/li>\n<\/ol>\n\nKey takeaway: “Insert L7 only during registration to guarantee XFF” \u2192 Revert to L4 after registration<\/strong>. CDN handles operations, origin remains minimal.<\/p>\n<\/blockquote>\nImplementation Notes (Example)<\/h2>\nExample of temporary nginx (L7)<\/p>\n server {\n listen 443 ssl http2;\n server_name example.com;\n ssl_certificate \/etc\/ssl\/fullchain.pem;\n ssl_certificate_key \/etc\/ssl\/privkey.pem;\n location \/ {\n proxy_pass https:\/\/&lt;OLS_IP&gt;;\n proxy_http_version 1.1;\n proxy_set_header Host $host;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # \u2190This is it!\n proxy_set_header X-Forwarded-Proto https;\n proxy_set_header X-Real-IP $remote_addr;\n }\n}\n<\/pre>\nThis allows ip-check to recognize the “real IP (XFF)” and completes the QUIC.cloud activation.<\/p>\n After Reverting to L4 (WireGuard + DNAT)<\/h3>\n\n- DNAT: Public :80\/:443 (and :443\/udp if needed) \u2192 OLS :80\/:443<\/li>\n
- SNAT\/MASQUERADE: Restricted only to “traffic originating from wg0 destined for OLS” (fixed return route)<\/li>\n
- FORWARD: Allow only WAN\u2192wg0 destined for OLS \/ Returns allowed via ESTABLISHED,RELATED<\/li>\n
- OLS: Set Use Client IP in Header = Trusted IP Only, register the tunnel peer IP with a T flag in the Allowed List (= accept XFF only from trusted proxies)<\/li>\n<\/ul>\n
\nOnly keep UDP\/443 DNAT<\/strong> if you want to receive direct access via HTTP\/3. Unnecessary if CDN termination is sufficient<\/strong> (also reduces attack surface).<\/p>\n<\/blockquote>\nVerification Methods<\/h2>\n\n- CDN-proxied headers
\ncurl -I https:\/\/example.com | tr -d ‘\\r’ | grep -i ‘server\\|x-qc-pop\\|alt-svc’<\/li>\n - CDN bypass (fixed SNI)
\ncurl -vk –resolve example.com:443: https:\/\/example.com\/ | head -n1<\/li>\n - WordPress-side view (using a test script)
\nSuccess if REMOTE_ADDR shows the real IP and X-Forwarded-For contains the same initial IP.<\/li>\n<\/ul>\nPitfalls to Watch Out For<\/h2>\n\n- XFF cannot be attached with L4 alone (HTTP headers are an L7 concept)<\/li>\n
- OpenLiteSpeed does not support PROXY protocol (cannot carry the original IP via L4)<\/li>\n
- Broad iptables MASQUERADE is dangerous: restricting by sending IF & destination subnet is the ironclad rule<\/li>\n
- Do not expose :80\/:443 across multiple containers (watch out for docker-proxy conflicts)<\/li>\n<\/ul>\n
Summary<\/h2>\n\n- Unless XFF is visible, QUIC.cloud’s ip-check will not pass.<\/li>\n
- Therefore, interject L7 (nginx) only during registration to guarantee XFF, and revert to L4 (WireGuard + DNAT) once registration is complete.<\/li>\n
- Operationally, terminate HTTP\/3 at the CDN and keep the origin light with OLS.<\/li>\n
- Limit OLS to trusted proxies using Trusted IP Only + Allowed List.<\/li>\n<\/ul>\n
Through this workflow, I was able to successfully leverage QUIC.cloud even with a Home Server \u00d7 WireGuard \u00d7 OCI setup.<\/p>\n","protected":false},"excerpt":{"rendered":" I was stuck trying to enable the LiteSpeed Cache CDN (QUIC.cloud) on my home WordPress server (running OpenLit […]<\/p>\n","protected":false},"author":4,"featured_media":2274,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=2270","footnotes":""},"categories":[1166],"tags":[119,18,27,15,117,20,13,14,92,61,10,310,381,131],"class_list":["post-5233","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress-blog-seo","tag-cdn","tag-docker","tag-iptables","tag-litespeed","tag-litespeed-cache","tag-oci","tag-ols","tag-openlitespeed","tag-wireguard","tag-wordpress","tag-server","tag-310","tag-381","tag-131","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5233"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5233\/revisions"}],"predecessor-version":[{"id":5236,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5233\/revisions\/5236"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/2274"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} | | | | | ![\"Exposing](\"https:\/\/donguri3.net\/wp-content\/uploads\/2025\/02\/\u30de\u30f3\u30b7\u30e7\u30f3\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u5185\u306e\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u3092\u516c\u958b-1-1024x576.jpg\")
<\/a><\/p>\n