8 ms·
Wouldn't this expose the origin IPs to attack?
by booi 4y ago
Wouldn't this expose the origin IPs to attack?
- phillipseamore 4y agoI'm talking about this as an option for users like me, that don't have an attack surface, but need the global performance gains of CF.
- 1123581321 4y agoProbably not many users who need the performance and can handle unexpected failover. There would also be the issue of setting the policy defaults effectively. Most users wouldn’t benefit from this footgun. If you’re serious, you could probably automate this right now with your DNS provider and uptime monitoring.
- phillipseamore 4y agoI'm so serious that I already have failover after 1 hour at the registrar level, but those changes are not immediate and can take up to 24h to roll-in and roll-back due to DNS propagation and caching.
- 1123581321 4y agoThere is no immediate option with DNS changes. CF can’t immediately remove their IP from the route. Sounds like you’ve solved your problem in the sense that you have an automatic failover, though, which is good.
- phillipseamore 4y agoWe seem to have hit the nesting maximum 1123581321, but to your point "There is no immediate option with DNS changes." There's a huge difference in changing nameservers for a domain and simply changing host records.
- efreak 4y agoThis is a 7th level comment. Synu below[0] has a 9th level comment, and I've seen nested comments go quite a bit further. [0] https://news.ycombinator.com/item?id=31821497 https://news.ycombinator.com/item?id=31821497
- pxeger1 4y agoI think there is no nesting maximum (or if there is, it's much bigger than this). There's a limit which stops you replying to a comment immediately, to prevent super long quick-fire arguments.
- 1123581321 4y agoAh, sorry, misunderstood you. You can’t rely on them to change their host records when they’re down. If you want CDN-independent automatic failover, look into anycast with two providers. If one of them is Cloudflare, use the tier that lets you manage your DNS elsewhere.
- chrisweekly 4y agoTypically CF _is_ the DNS provider though, right?
- 1123581321 4y agoOnly up until the $200/mo tier. This kind of feature would be locked at that level anyway. As I said to the OP elsewhere, he should be doing something like anycast to multiple CDNs if this is critical.
- hatthew 4y agoYes, but I'd wager that most sites experience cloudflare outages more often than they experience bona fide attacks.
- Cthulhu_ 4y agoYou say that, but there's tons of automated attempts doing the rounds on everything directly connected to the internet; centralized providers like Cloudflare can detect and prevent these patterns, whereas you need to be on the ball yourself if you have a service directly open to the internet. Exploits are exploited quickly, and while I make no assumptions about your particular website / application, a lot cannot push an update on short notice.
- scrollaway 4y agoYou would lose your wager. DDoS attacks are extremely common at just about any scale, even if you only have a few thousand users. Cloudflare going down like this? Actually first time I remember it happening. There’s been downtime before but nothing so major.
- mccorrinall 4y agoYes, but he says in his second sentence that he doesn’t mind and mainly uses CF for performance.
- phillipseamore 4y agoPlenty of commenters also seem to miss the most important word in the first sentence: "option".
- londons_explore 4y agoThe origin IP's are already open to attack for most users. It's trivial to scan the whole IPv4 internet to find out which IP you are hosting your site on.
- renonce 4y agoYou need to block 443 for any other IP than Cloudflare. The IP list can be found at https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/.
- dingdongthe 4y agoand/or use Authenticated Origin Pulls with a TLS client certificate.
- renonce 4y agoThat would leak your IP nevertheless. People can figure out that you're serving a specific website by inspecting your certificate on handshake without actually connecting.