4 ms·
Allowing only cloudflare IPs for ports 80/443 (e.g. in nginx) is easy and the server can still be used for other purposes without Cloudflare. Other services can
by dx034 9y ago
Allowing only cloudflare IPs for ports 80/443 (e.g. in nginx) is easy and the server can still be used for other purposes without Cloudflare. Other services can use different domains, would be hard to find out the server ip this way.
- problems 9y agoYes, CloudFlare even provides official lists for this purpose. https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/ IPv4 space is far too small not to use this. Often times if an attacker has determined your provider in the past, they may be able to leverage that information and scan only nearby ranges. Other common anti-DDoS proxy bypass tactics: - direct.* subdomain used to be used by default on CloudFlare for a direct route to the server - Check headers in outgoing emails for an origin IP (this one gets way too many sites) - CloudFlare only recently got websocket support - check if their websocket servers are secured or not - Check for an MX record - Use DNS bruteforcing tools to attempt to find other services
- fyfy18 9y ago> Check headers in outgoing emails for an origin IP (this one gets way too many sites) Are there any workarounds for this, other than running mail servers on a separate network and IP range?
- Meekro 9y agoUse Amazon SES to send your email. SES actually conceals your origin IP -- unlike other providers like Sendgrid, which include it.
- problems 9y agoRun your mail server on a different provider and configure it to strip the relay headers - some mail relay services may also work for this purpose.
- deleted 9y ago[deleted]
- blibble 9y agoit's far from an ideal solution given they keep changing the lists I only seem to find out when people complain that the site is down from certain parts of the world
- jgrahamc 9y agokeeping changing the lists We don't change the IPs often and we always update the list well before they are ever used (typically months before). The last update was two years ago. I'm sorry if you had a problem. https://www.changedetection.com/log/cloudflare/ips-v4_log.html https://www.changedetection.com/log/cloudflare/ips-v4_log.ht... EDIT: I was rude in the previous version of this comment. Sorry for being a jerk. And thanks to dang for letting me edit.
- AgentME 9y agoI remember being affected by this too a few years ago. It's not something I thought to check and update often. I was disappointed that I was never emailed or otherwise notified by the change.
- jgrahamc 9y agoI was rude in that comment and it's too late to edit it. Sorry for being a jerk. I should have said: We don't change the IPs often and we always update the list well before they are ever used (typically months before). The last update was two years ago.