IP Tables

How can I setup a IP Table that blocks traffic unless it's coming from any Cloudflare IP (Tunnel, Cloudflare Reverse Proxy, etc)

https://www.cloudflare.com/ips/ I was told this does not have the tunnel ip ranges

Cloudflare

IP Ranges | Cloudflare

This page is intended to be the definitive source of Cloudflare’s current IP ranges.

jdpOP•6/11/23, 4:28 PM

Cloudflare Tunnel doesn't prevent inbound connections directly to my IP from anyone not CF which is why I want to set this up.

Original message was deleted

jdpOP•6/11/23, 6:51 PM

How?

jdpOP•6/11/23, 6:51 PM

I'd like to block everything but SSH (ofc)

Jjdp I'd like to block everything but SSH (ofc)

Chaika•6/11/23, 6:57 PM

If you're using something like UFW, then
ufw allow <your-ssh-port>/tcp (ex. ufw allow 22/tcp)
ufw default deny incoming
otherwise, it depends on the firewall you are using. If you are using a VPS with an external firewall (Hetzner, Ovh, etc), I would configure those settings with them as well

CChaika If you're using something like UFW, then ufw allow <your-ssh-port>/tcp (ex. ufw ...

jdpOP•6/11/23, 7:59 PM

Your rules wouldn't work when it comes to Cloudflare Tunnel I thought or am I thinking of CF Tunnel incorrectly and it works by having the orgin send outbound rather than inbound requests coming from CF?

Jjdp Your rules wouldn't work when it comes to Cloudflare Tunnel I thought or am I th...

Chaika•6/11/23, 8:03 PM

Correct, Cloudflare Tunnels work by running a local daemon/service on your PC called cloudflared. This service connects outbound to Cloudflare's Edge, just like how you can visit https://cloudflare.com without port forwarding/opening any inbound ports. Firewalls like UFW are stateful and understand that the connection was established outbound and will keep track of it/allow it through

Chaika•6/11/23, 8:03 PM

That's what makes CF Tunnels so cool, no need to expose ports, or even have a static IP

CChaika That's what makes CF Tunnels so cool, no need to expose ports, or even have a st...

jdpOP•6/11/23, 11:18 PM

Yeah I'd have to agree.

jdpOP•6/11/23, 11:22 PM

I personally can't fathom how this is possible though you know

jdpOP•6/11/23, 11:22 PM

My brain won't comprehend how it knows someone needs something/making a request

jdpOP•6/11/23, 11:23 PM

my only guess is its using websockets perhaps or polling a CF API that tells it?

jdpOP•6/11/23, 11:23 PM

jdpOP•6/11/23, 11:23 PM

;-;

Original message was deleted

jdpOP•6/12/23, 4:56 PM

My head still can't wrap around it! It's an amazing technology tbh

jdpOP•6/12/23, 4:56 PM

My only issue is you can't block inbound without extra softwarw

jdpOP•6/12/23, 4:57 PM

Would be awesome if you can do it with cloudflared

jdpOP•6/12/23, 4:57 PM

IP Tables & UFW is still hard to grasp for me, and one of our host providers still does not provide backups

jdpOP•6/12/23, 4:57 PM

Our main server does

Chaika•6/12/23, 4:59 PM

ufw is pretty simple, there's lots of tutorials out therre about it if you're having issues. Usually as simple as blocking inbound and opening specific ports as needed

Jjdp My only issue is you can't block inbound without extra softwarw

Hello, I’m Allie!•6/12/23, 5:26 PM

I mean, you can just block inbound with WAF, or a reverse proxy in between cloudflared and your app

CChaika ufw is pretty simple, there's lots of tutorials out therre about it if you're ha...

jdpOP•6/13/23, 10:25 PM

I just tested my CF website which is barely configured right now

jdpOP•6/13/23, 10:26 PM

I have good hardware and network, but for some reason when I tried hitting my website API: it went down

jdpOP•6/13/23, 10:26 PM

It uses CF Tunnel

jdpOP•6/13/23, 10:26 PM

I'm curious how'd it go down if my server uses outbound connections, and receives nothing inbound

jdpOP•6/13/23, 10:27 PM

It wouldn't be due to resources or network, I have a EPYC 7402P VPS w/ 6 cores, 12gb DDR4, and 10gbps In/Out

jdpOP•6/13/23, 10:29 PM

Could the Cloudflare Tunnel have gone down? Under normal circumstances, a Cloudflare Reverse Proxy can never be downed (as they are massive NAT network of servers built for millions of requests), but is it not the same for CF Tunnel?

Jjdp I have good hardware and network, but for some reason when I tried hitting my we...

Chaika•6/13/23, 10:35 PM

What do you mean it went down? If you're getting bad gateway/522, your tunnel is reachable but cannot contact origin, check tunnel logs (i.e journalctl -u cloudflared -f --lines=100)

Jjdp I'm curious how'd it go down if my server uses outbound connections, and receive...

Chaika•6/13/23, 10:37 PM

I mean in theory it can absolutely go down, the fact it's outbound doesn't matter, you lose internet, connectivity to CF, CF loses the connection, etc.
The tunnel does do stuff to prevent that though, it establishes multiple redundant connections to at least two different Cloudflare datacenters/colo, it probably didn't go down, even if a connection fails it just retries but I can only guess, logs / exact error would be helpful

Jjdp Could the Cloudflare Tunnel have gone down? Under normal circumstances, a Cloudf...

Chaika•6/13/23, 10:38 PM

Tunnel Requests go through the same reverse proxy, they then get routed to your tunnel. There is a bit of overhead with tunnels, but they make up for it by scaling connections when needed and such. (and not that it really matters for this case, but they are not NAT, it's all anycast) (and opps, realized I pinged 3 times, should have turned it off, my bad)

CChaika What do you mean it went down? If you're getting bad gateway/522, your tunnel is...

jdpOP•6/13/23, 10:43 PM

status code 429

jdpOP•6/13/23, 10:43 PM

OHHH I KNOW THE ISSUE

Chaika•6/13/23, 10:43 PM

you have unmetered rate limiting configured on your zone?

CChaika you have unmetered rate limiting configured on your zone?

jdpOP•6/13/23, 10:44 PM

I ratelimit on my server

jdpOP•6/13/23, 10:44 PM

I don't use CF as i'm on free currently- which is really limiting

jdpOP•6/13/23, 10:44 PM

I think that might be the issue?

Chaika•6/13/23, 10:45 PM

ah ok, you'll have to configure your rate limiting to use the CF-Connecting-IP header to rate limit by

jdpOP•6/13/23, 10:45 PM

Nevermind.

jdpOP•6/13/23, 10:45 PM

It isn't, odd.

jdpOP•6/13/23, 10:45 PM

I don't have CF Ratelimits up rn

jdpOP•6/13/23, 10:45 PM

so is cf ratelimiting me

Chaika•6/13/23, 10:46 PM

Unless you have a rate limiting rule configured on your zone (Security -> WAF -> Rate Limiting Rules), no

CChaika Unless you have a rate limiting rule configured on your zone (Security -> WAF ->...

jdpOP•6/13/23, 10:46 PM

Then why is a 429 being issued

CChaika Unless you have a rate limiting rule configured on your zone (Security -> WAF ->...

jdpOP•6/13/23, 10:46 PM

I had one setup, but it was disabled.

Chaika•6/13/23, 10:47 PM

What are the headers on the response? If it's a public website, can you share the url?

jdpOP•6/13/23, 10:47 PM

When it was down or right now?

Chaika•6/13/23, 10:47 PM

When it was serving 429 responses

jdpOP•6/13/23, 10:47 PM

Don't know, did not check

jdpOP•6/13/23, 10:48 PM

Chaika•6/13/23, 10:49 PM

Well that's what I would check for if it happens again, If you see the CF-Cache-Status header, it's your origin rate limiting you.
It sounds like its likely to be your origin, if you had rate limiting on it before.
Keep in mind when you are using tunnels, it sees all traffic coming from the same local ip. If your application does rate limiting, it needs to use the CF-Connecting-Header to get the real IP of the user

IP Tables

Similar Threads

Similar Threads

Similar Threads