Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to allow only HTTP(S) traffic coming from CloudFlare. In that way attackers cannot attack the server directly. I know CloudFlare is not mainly a DDoS mitigator, but I would like to try it either way.

I'm currently only having access to iptables (ipv4 only), but will try to install ip6tables soon. I just need to have this fixed soon. (we're getting (D)DoSed atm.)

I was thinking about something like this:

iptables -I INPUT -s <CloudFlare IP> --dport 80 -j ACCEPT
iptables -I INPUT -s <CloudFlare IP> --dport 443 -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -j DROP
iptables -I INPUT -p tcp --dport 443 -j DROP

I know that CloudFlare has multiple IPs, but just for an example.

Would this be the right way?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Yes, that would work. You can also use ! to negate like this:

iptables -I INPUT ! -s <cloud_flare ip> -p tcp --dport 80 -j DROP
iptables -I INPUT ! -s <cloud_flare ip> -p tcp --dport 443 -j DROP
share|improve this answer
    
Ah great, I didn't know about that. Is it also possible to use that with multiple IPs? I need to accept about 10 IP ranges from CloudFlare. –  Martin Nov 7 '12 at 10:30
    
From the manpage: Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D). –  miono Nov 7 '12 at 10:31
    
so like: iptables -I INPUT ! -s <cloud_flare ip1> -p tcp --dport 80 -j DROP iptables -I INPUT ! -s <cloud_flare ip2> -p tcp --dport 80 -j DROP? –  Martin Nov 7 '12 at 10:33
    
Ah sweet. Thanks a bunch, I will try it soon –  Martin Nov 7 '12 at 10:36
1  
Sorry, obviously it's not possible to give many addresses when used with !, you'll have to create multiple rules. –  miono Nov 7 '12 at 10:38
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.