I've recently gotten denial of service attacks from multiple proxy ips, so I installed cloudflare to prevent this. Then I started noticing that they're bypassing cloudflare by connecting directly to the server's ip address and forging the host header.
What is the most performant way to return 403 on connections that aren't from the 18 ip addresses used by cloudflare?
denying all then explicitly
allowing the cloudflare ips but this doesn't work since I've set it up so that
CF-Connecting-IP sets the ip
allow tests for.
I'm using nginx 1.6.0.