Respect X-Forwarded-For or X-Real-IP for IP ACLs

NPM Version: v2.14.0
I run NPM frontend by Cloudflare and enforce it through NAT ACLs but I also want per site to be able to block access to my machines at layer 7 as I get access to the original client IP address.

I expect that whatever IP address I enter in the Access List it should be the IP address that the real_ip_header pulls.