Cloudflare: HTTP whitelist only*

Question

How would I go about whitelisting ONLY Cloudflare for inbound Port 80/443 traffic for the their IP's (found here - https://www.cloudflare.com/ips), BUT also allowing all HTTP traffic to flow through that was initiated by us, such as remote API requests which we need a response back from.

Running Amazon Linux on EC2.

Thanks

Answer 1

You have two main options:

• Network ACLs (NACLs). These are more like a traditional firewall, they run on the network, preventing traffic hitting the server / instance if it's not authorized. There's a limited number of rules, which from memory is lower than the number of CloudFlare servers. They're stateless so you need to add inbound and outbound rules.
• Security groups. These are a stateful firewall running on the instance. If you define a rule reply traffic is automatically allowed. There's a higher limit of rules than NACLs

You need the security group associated with your EC2 instance to have the CloudFlare IP addresses and your own IP addresses, allowing access on the ports required. I've done this, it's easy.

You can of course make your API requests through CloudFlare, but direct is probably slightly faster and more reliable.

CloudFormation

Setting up all the CloudFlare IP addresses can take some copy and pasting - maybe ten minutes, so not so bad. If you want to learn a bit of CloudFormation you can automate creation and update of the security group with CloudFlare IP addresses. If they add more IPs you just update your script and run it again. It tends to be best to create your VPC, subnets, security group, rules, etc, all in the CloudFormation script. If you don't want to start again then you can have it refer to existing resources. I could add a script that would give you a starting point, but it would take a little bit of time to tweak it.

If you don't know CloudFormation it might take a day or so to get it working, but for a production environment there are plenty of advantages doing things this way.