For me, I use Cloudflare proxy and my WAN only accepts inbound from the Cloudflare IP ranges (https://www.cloudflare.com/ips/.  That's all the firewall sees so it can't block by the remote IP that nginx sees.  I could set up the bouncer on each one of my services but would prefer to have it right on the reverse proxy.
				
			
"