Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a way to pass all incoming traffic through Cloudflare so even if attackers resolved the server ip they still couldn't (D)dos it directly.

This is exactly what they said: "Simply config your servers iptables to only allow incoming connections from CloudFlares IP ranges then set it to allow only your IP/IP range to connect on port 21 (SSH)"

Could someone help me on what command I'd need to run for Ubuntu to get this effect?

share|improve this question

migrated from Jun 17 '12 at 13:37

This question came from our site for professional and enthusiast programmers.

SSH is port 22 :) – Paulpro Jun 13 '12 at 21:33
21 is FTP while 22 is by default SSH – TryTryAgain Jun 16 '12 at 8:04
Well yes I am aware of the ports, I've actually changed a lot of the defaults, that was posted exactly as he said it though. – Nick Jun 17 '12 at 14:22

As a note here -- we ACTIVELY discourage this kind of setup for any customer that isn't using the business level of service (at the very least). Only our business and enterprise level plans include the advanced DDoS protection option. The free and pro level plans include basic DDoS protection which mean if an attack negatively impacts other CloudFlare customer's we'll need to route that site off CloudFlare -- and then if you are only allowing traffic from CloudFlare IPs you'd then be blocking all legit traffic to your site.

p.s. I work for CloudFlare.

share|improve this answer
Is this still actively discouraged?… doesn't indicate anything about this. – mrP Sep 23 '15 at 22:14
@mrP We don't recommend it by default. More technical users can do it though as long as they understand what they are doing (so they don't lock themselves out of their own server). – xxdesmus Sep 23 '15 at 23:09
understood. thanks for clarifying. – mrP Sep 24 '15 at 1:52
iptables --append INPUT --source --protocol tcp --destination-port 22 --jump ACCEPT
iptables --append INPUT --source --jump ACCEPT
iptables --policy INPUT DROP is your IP, for SSH access. is CloudFlare's IP range (if there's multiple, you'll probably have to add several rules).

Maybe you can use --in-interface to further specify which rule matches what.

Keep in mind this is a very simple example, just intended to point you in the general direction. Consult man iptables for more. Also, beware of locking yourself out.

share|improve this answer

In Addendum to Gnarfoz's reply, this is the list of IP ranges used by cloudflare:

/ Michael

share|improve this answer
To note -- that's the wrong link. is correct. – xxdesmus Dec 16 '14 at 23:37
Thanks for updating the link :) – Michael Sørensen Jan 3 '15 at 12:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.