Cloudflare Developers•2y ago

Firewall for HTTP or SSH?

Kasumi•3/21/24, 12:45 PM

There are just a lot 45, 103, 79

CCyb3r-Jak3 Firewall for HTTP or SSH?

Kasumi•3/21/24, 12:45 PM

HTTP/S

KKasumi And I set my Firewall like that, that it only accepts Cloudflare IP's. But it re...

Isaac McFadyen•3/21/24, 12:45 PM

You're probably looking at the wrong logs.

Kasumi•3/21/24, 12:45 PM

Isaac McFadyen•3/21/24, 12:45 PM

Those logs won't show HTTP connections.

IIsaac McFadyen You're probably looking at the wrong logs.

Kasumi•3/21/24, 12:45 PM

Its the journal logs

IIsaac McFadyen Those logs won't show HTTP connections.

Kasumi•3/21/24, 12:46 PM

Firewalld should log everything and there are no different logs where I can look at

Kasumi•3/21/24, 12:56 PM

Doesnt cdn-cgi/trace show the CF origin ip?

KKasumi Doesnt cdn-cgi/trace show the CF origin ip?

Chaika•3/21/24, 12:58 PM

no? How would it? It's not making a connection to your origin

Kasumi•3/21/24, 12:59 PM

I mean the CLoudflares Proxy IP

Chaika•3/21/24, 12:59 PM

It shows your IP, but not Cloudflare's

Kasumi•3/21/24, 12:59 PM

How useless is this future then :shyyDead:

Chaika•3/21/24, 12:59 PM

there's two types of CF Proxy IPs, the incoming ones (anycasted ones in your proxied a/aaaa records) and the outgoing ones (which CF uses to connect to your origin)

Chaika•3/21/24, 1:00 PM

cdn-cgi doesn't show either

Kasumi•3/21/24, 1:00 PM

tcpdump doesnt help me in anyway because I dont want to go through all IP's that cloudflare has.

CChaika cdn-cgi doesn't show either

Kasumi•3/21/24, 1:00 PM

Yes useless af

Kasumi•3/21/24, 1:00 PM

Then I need to flush the Firewall and find a different way or so

Isaac McFadyen•3/21/24, 1:01 PM

If Cloudflare can't connect to your origin and you don't see anything in the logs then it's probably a firewall in front of your server.

Isaac McFadyen•3/21/24, 1:01 PM

Some cloud providers have a firewall that restricts connections to your server at all, even if the firewall on the server is compltely off.

IIsaac McFadyen If Cloudflare can't connect to your origin and you don't see anything in the log...

Kasumi•3/21/24, 1:01 PM

:Facepalm:

Kasumi•3/21/24, 1:01 PM

Yes theres a firewall between but the firewall has all CLoudflare IP's whitelisted

KKasumi Yes useless af

Chaika•3/21/24, 1:01 PM

well, how would it though? It hasn't made a connection yet? Some connections are Argo Smart Routed, how would it know which IP that would come out of?
The only utility that shows Edge Server Origin IPs is HTTP Logpush iirc

Kasumi•3/21/24, 1:02 PM

But it still drops everything and I dont see any requests getting dropped by Cloudflare IP's

KKasumi Yes theres a firewall between but the firewall has all CLoudflare IP's whitelist...

Isaac McFadyen•3/21/24, 1:02 PM

Can you see the logs of that firewall or no?

IIsaac McFadyen Can you see the logs of that firewall or no?

Kasumi•3/21/24, 1:02 PM

Yes :shyyDead:

KKasumi Click to see attachment

Kasumi•3/21/24, 1:02 PM

KKasumi Click to see attachment

Kasumi•3/21/24, 1:02 PM

And thats the firewall config

Isaac McFadyen•3/21/24, 1:02 PM

That's the SSH firewall on your server. I mean that there's sometimes a firewall that's not part of your server.

Isaac McFadyen•3/21/24, 1:02 PM

See: AWS Security Groups, Azure Security Groups, GCP Firewall Rules, etc.

IIsaac McFadyen That's the SSH firewall on your server. I mean that there's sometimes a firewall...

Kasumi•3/21/24, 1:03 PM

Thats not just ssh firewall just because there are ssh messages

Kasumi•3/21/24, 1:03 PM

Why it should just include ssh if its a journal log

KKasumi Thats not just ssh firewall just because there are ssh messages

Isaac McFadyen•3/21/24, 1:03 PM

Yes, I just mean that there are no logs for the HTTP firewall in there.

Kasumi•3/21/24, 1:04 PM

IIsaac McFadyen Yes, I just mean that there are no logs for the HTTP firewall in there.

Kasumi•3/21/24, 1:04 PM

Yes why Cloudflare then cant connect to my Origin

Isaac McFadyen•3/21/24, 1:04 PM

Also, it looks like those are only logging denied messages.

Kasumi•3/21/24, 1:04 PM

If theres no request

IIsaac McFadyen Also, it looks like those are only logging denied messages.

Kasumi•3/21/24, 1:04 PM

It should log everything

Isaac McFadyen•3/21/24, 1:04 PM

Perhaps it's being allowed through the firewall but the webserver or Apache or whatever is blocking it?

IIsaac McFadyen Perhaps it's being allowed through the firewall but the webserver or Apache or w...

Kasumi•3/21/24, 1:04 PM

No why it should

Kasumi•3/21/24, 1:04 PM

https, http, 443,80 is allowed

KKasumi It should log everything

Isaac McFadyen•3/21/24, 1:05 PM

I don't see any logs for allowed connections.

Isaac McFadyen•3/21/24, 1:05 PM

Only REJECT messages

IIsaac McFadyen I don't see any logs for allowed connections.

Kasumi•3/21/24, 1:05 PM

Why it should show allowed things when Cloudflare is getting blocked

Kasumi•3/21/24, 1:05 PM

Or doesnt even send anything or so

KKasumi Or doesnt even send anything or so

Isaac McFadyen•3/21/24, 1:06 PM

That's what I mean. If the firewall is working fine and allowing Cloudflare through but something else is blocking it (i.e. Apache) then you wouldn't see any logs

Isaac McFadyen•3/21/24, 1:06 PM

Which is the case here

Kasumi•3/21/24, 1:06 PM

And tcpdump is useless af too because there are just a lot of arpa things spamming around

SZ3R0•3/21/24, 1:06 PM

Hi there. Where i can make a report about a website used for scamming and hosted on cloudfire?

SSZ3R0 Hi there. Where i can make a report about a website used for scamming and hosted...

Isaac McFadyen•3/21/24, 1:06 PM

?abuse

Flare•3/21/24, 1:06 PM

If you feel that a site is engaging in illegal or inappropriate activities, you can submit an abuse report at https://abuse.cloudflare.com/. The Trust and Safety team will review the details and reply if appropriate. You can also report the site to your relevant local authorities. Reports cannot be filed via Discord or with individual employees or Champs.

Firewall for HTTP or SSH?

Similar Threads

Similar Threads

Similar Threads