Only allow cloudflare IPs

sirfpsycho

Hello, my website is under ddos attack. I bought cloudflare pro plan but still my website is down. I contacted cloudflare team and they said your website is accepting other IPs too. So, block all other IPs and allow only cloudflare IPs for your website.
Can you please provide me any nginx rule for my particular website so that attackers can not bypass cloudflare?

aaP_strong

sirfpsycho install SYS Firewall block port 80 & 443
and allow cloudflare ip https://www.cloudflare.com/ips-v4

COLBYLICIOUS

You can do that in WAF settings on Cloudflare.

sirfpsycho

COLBYLICIOUS they said you have to do in your server.

sirfpsycho

aaP_strong I have multiple websites on this server and I want for only one website.

aaPanel_Kern

sirfpsycho
Hi, try adding the following to the URL rewrite of the website: then restart nginx
location ~ / { allow 173.245.48.0/20; allow 103.21.244.0/22; allow 103.22.200.0/22; allow 103.31.4.0/22; allow 141.101.64.0/18; allow 108.162.192.0/18; allow 190.93.240.0/20; allow 188.114.96.0/20; allow 197.234.240.0/22; allow 198.41.128.0/17; allow 162.158.0.0/15; allow 104.16.0.0/13; allow 104.24.0.0/14; allow 172.64.0.0/13; allow 131.0.72.0/22; deny all; }

sirfpsycho

aaPanel_Kern After adding this website shows 403 Forbidden
nginx
I am using wp website.

aaPanel_Kern

sirfpsycho
Hello, check if the ip accessed by the website log is in allow? If not please add it to the allow list

sirfpsycho

aaPanel_Kern to allow do I need to use sys firewall?

aaPanel_Kern

sirfpsycho
403 means that the site can already be accessed, but nginx has denied your access, which should have nothing to do with the firewall.
I am talking about the allow of the location given to you above, add your ip to it,
For example: my ip is 192.168.247.129, add an allow 192.168.247.129;.

sirfpsycho

aaPanel_Kern cloudflare team says that if I allow only cloudflare IPs then all of the traffic goes through cloudflare then there will be no attack. But here I allowed only cloudflare IPs then it gives 403.
If allow only my internet IP then my website will be unavailable for other visitors.

aaPanel_Kern

sirfpsycho
There are documents on the cloudflare website that suggest you to check it out, or ask the cloudflare team how to set it up.

sirfpsycho

aaPanel_Kern cloudflare team told me to contact hosting provider. We don't support.

aaPanel_Kern

sirfpsycho
The above setting is to allow only cloudflare IP and of course only ipv4. You need to check which ip is not added to allow according to the log.
https://www.cloudflare.com/zh-cn/ips/

sirfpsycho

aaPanel_Kern I have added ipv4 and ipv6 both like this:

allow 173.245.48.0/20;
allow 103.21.244.0/22;
allow 103.22.200.0/22;
allow 103.31.4.0/22;
allow 141.101.64.0/18;
allow 108.162.192.0/18;
allow 190.93.240.0/20;
allow 188.114.96.0/20;
allow 197.234.240.0/22;
allow 198.41.128.0/17;
allow 162.158.0.0/15;
allow 104.16.0.0/13;
allow 104.24.0.0/14;
allow 172.64.0.0/13;
allow 131.0.72.0/22;
allow 2400:cb00::/32;
allow 2606:4700::/32;
allow 2803:f800::/32;
allow 2405:b500::/32;
allow 2405:8100::/32;
allow 2a06:98c0::/29;
allow 2c0f:f248::/32;

aaPanel_Kern

sirfpsycho
Don't set it in URL rewrite, add it directly in the site's configuration file:
allow 173.245.48.0/20; allow 103.21.244.0/22; allow 103.22.200.0/22; allow 103.31.4.0/22; allow 141.101.64.0/18; allow 108.162.192.0/18; allow 190.93.240.0/20; allow 188.114.96.0/20; allow 197.234.240.0/22; allow 198.41.128.0/17; allow 162.158.0.0/15; allow 104.16.0.0/13; allow 104.24.0.0/14; allow 172.64.0.0/13; allow 131.0.72.0/22; allow 2400:cb00::/32; allow 2606:4700::/32; allow 2803:f800::/32; allow 2405:b500::/32; allow 2405:8100::/32; allow 2a06:98c0::/29; allow 2c0f:f248::/32; deny all;

sirfpsycho

aaPanel_Kern still same error

aaPanel_Kern

sirfpsycho
My test here is normal, please check whether the ip of the website log is in the allow, if it does not exist, add it to allow, otherwise it will be a 403 error.