---
author: Mike Conrad
categories:
- Cloudflare
- Networking
- Security
- Software Engineering
date: "2024-08-01T17:02:29Z"
excerpt: Harden your origin server by only allowing access from Cloudflare IP addresses.
tags:
- Blog Post
title: Hardening your web server by only allowing traffic from Cloudflare
---

#### TDLR:

If you just want the code you can find a convenient script on my Gitea server [here](https://git.hackanooga.com/Mike Conrad/random_scripts/src/branch/master/allow_only_cloudflare_traffic.sh). This version has been slightly modified so that it will work on more systems.

I have been using Cloudflare for several years for both personal and professional projects. The free plan has some various gracious limits and it’s a great way to clear out some low hanging fruit and improve the security of your application. If you’re not familiar with how it works, basically Cloudflare has two modes for DNS records. `DNS Only` and `Proxied`. The only way to get the advantages of Cloudflare is to use `Proxied` mode. Cloudflare has some great documentation on how all of their services work but basically what happens is that you are pointing your domain to Cloudflare and Cloudflare provisions their network of Proxy servers to handle requests for your domain.

These proxy servers allow you to secure your domain by implementing things like WAF and Rate limiting. You can also enforce HTTPS only mode and modify/add custom request/response headers. You will notice that once you turn this mode on, your webserver will log requests as coming from Cloudflare IP addresses. They have great [documentation](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/) on how to configure your webserver to restore these IP addresses in your log files.

This is a very easy step to start securing your origin server but it still allows attackers to access your servers directly if they know the IP address. We can take our security one step forward by only allowing requests from IP addresses originating within Cloudflare meaning that we will only allow requests if they are coming from a Cloudflare proxy server. The setup is fairly straightforward. In this example I will be using a Linux server.

We can achieve this pretty easily because Cloudflare provides a sort of API where they regular publish their network blocks. Here is the basic script we will use:

```shell
for ip in $(curl https://www.cloudflare.com/ips-v4/); do iptables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT; done

for ip in $(curl https://www.cloudflare.com/ips-v6/); do ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT; done

iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP
ip6tables -A INPUT -p tcp -m multiport --dports http,https -j DROP

```

This will pull down the latest network addresses from Cloudflare and create `iptables` rules for us. These IP addresses do change from time to time so you may want to put this in a script and run it via a `cronjob` to have it update on a regular basis.

Now with this in place, here is the results:

![](/wp-content/uploads/2024/09/image-1024x320.png)This should cut down on some of the noise from attackers and script kiddies trying to find holes in your security.