3 ms·
Agreed. It also can't hurt to setup a firewall or EC2 Security Group that only allows ingress from Cloudflare IPs: https://www.cloudflare.com/ips/ https://www.c
by throwitaway1123 2y ago
Agreed. It also can't hurt to setup a firewall or EC2 Security Group that only allows ingress from Cloudflare IPs: https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/
Alternatively, you can use Cloudflare Tunnel, and then block all incoming connections.
- fideloper 2y agothey also provide certs for mTLS between cloudflare and your origin, which you can layer in along with IP restrictions (the term they use is “authenticated origin pull”)
- viraptor 2y agoYou have to limit the traffic to that pool to prevent people accessing your server directly. But that's not enough on its own, because other people can use CloudFlare's IPs to scan you too, so you need some kind of auth on top or use the tunnel.
- chazeon 2y agoTypically my servers is behind NAT and it has no public address, one can only reached the service through the CF tunnel and my access is through VPN, this should be safe, right?
- throwitaway1123 2y agoYes, this is correct. If you're using IP address allowlists then you also have to check the Host HTTP header (Cloudflare won't allow their other customers to forge that header). Or, you can use mTLS (as another commenter pointed out), or tunnels (as I pointed out): https://news.ycombinator.com/item?id=26690388 https://news.ycombinator.com/item?id=26690388