Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a way to pass all incoming traffic through Cloudflare so even if attackers resolved the server ip they still couldn't (D)dos it directly.

This is exactly what they said: "Simply config your servers iptables to only allow incoming connections from CloudFlares IP ranges then set it to allow only your IP/IP range to connect on port 21 (SSH)"

Could someone help me on what command I'd need to run for Ubuntu to get this effect?

share|improve this question

migrated from stackoverflow.com Jun 17 '12 at 13:37

This question came from our site for professional and enthusiast programmers.

1  
SSH is port 22 :) –  Paulpro Jun 13 '12 at 21:33
    
21 is FTP while 22 is by default SSH blog.cloudflare.com/cloudflare-now-supporting-more-ports –  TryTryAgain Jun 16 '12 at 8:04
    
Well yes I am aware of the ports, I've actually changed a lot of the defaults, that was posted exactly as he said it though. –  Nick Jun 17 '12 at 14:22
add comment

3 Answers

As a note here -- we ACTIVELY discourage this kind of setup for any customer that isn't using the business level of service (at the very least). Only our business and enterprise level plans include the advanced DDoS protection option. The free and pro level plans include basic DDoS protection which mean if an attack negatively impacts other CloudFlare customer's we'll need to route that site off CloudFlare -- and then if you are only allowing traffic from CloudFlare IPs you'd then be blocking all legit traffic to your site.

p.s. I work for CloudFlare.

share|improve this answer
add comment
iptables --append INPUT --source 111.222.333.444 --protocol tcp --destination-port 22 --jump ACCEPT
iptables --append INPUT --source 123.123.123.0/24 --jump ACCEPT
iptables --policy INPUT DROP

111.222.333.444 is your IP, for SSH access. 123.123.123.0/24 is CloudFlare's IP range (if there's multiple, you'll probably have to add several rules).

Maybe you can use --in-interface to further specify which rule matches what.

Keep in mind this is a very simple example, just intended to point you in the general direction. Consult man iptables for more. Also, beware of locking yourself out.

share|improve this answer
add comment

In Addendum to Gnarfoz's reply, this is the list of IP ranges used by cloudflare: https://www.cloudflare.com/wiki/What_are_the_CloudFlare_IP_address_ranges

/ Michael

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.