Cloudflare CDN系统防火墙白名单规则

通过BASH SHELL脚本为Linux系统配置关于Cloudflare CDN防火墙白名单规则:限制所有入站访问,入站访问仅向特定IP段特定协议以及端口开放:对CDN IP段开放正常回源访问,解决方案代码实现如下:

#!/bin/bash
# Name  : Anti IP Leakage
# Author: Larix
# Date  : 2019-07-15

# 禁止来自IPv4的所有HTTP/S访问请求
iptables -I INPUT -p tcp --dport 80 -j DROP
iptables -I INPUT -p tcp --dport 443 -j DROP

# 对Cloudflare CDN IPv4地址开放HTTP/S入站访问
for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -s $i -p tcp --dport 80 -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -s $i -p tcp --dport 443 -j ACCEPT; done

# 禁止来自IPv6的所有HTTP/S访问请求
ip6tables -I INPUT -p tcp --dport 80 -j DROP
ip6tables -I INPUT -p tcp --dport 443 -j DROP

# 对Cloudflare CDN IPv6地址开放HTTP/S入站访问
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I INPUT -s $i -p tcp --dport 80 -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I INPUT -s $i -p tcp --dport 443 -j ACCEPT; done

# 保存iptables配置
iptables-save
ip6tables-save

# 注意:80/443为默认HTTP/S协议通讯使用端口,若实际应用有使用非80/443端口进行,请依葫芦画瓢自行修改脚本
# Ubuntu系统可以使用UFW则类似:for i in `curl https://www.cloudflare.com/ips-v4`; do ufw allow proto tcp from $i to any port 80; done
# 基于Linux系统兼容性考虑脚本使用iptables配置系统防火墙,请自行根据各自系统、防火墙不同做相应配置调整实施

快速验证防火墙配置是否正确、有效,本地直接访问源站应该返回失败:

curl -svo /dev/null http://源站IP -H "host:域名"

对比本地通过Cloudflare CDN正常访问:

curl -svo /dev/null http://104.20.0.0 -H "host:域名"

验证HTTPS请求则:

curl --resolve "larix.cc:443:源站IP" -svo /dev/null https://larix.cc/

Cloudflare CDN IP Ranges

# Update: 2019-07-15
Some applications or host providers might find it handy to know about Cloudflare’s IPs. This page is intended to be the definitive source of Cloudflare’s current IP ranges.
IPv4:                      IPv6:                
173.245.48.0/20            2400:cb00::/32
103.21.244.0/22            2606:4700::/32
103.22.200.0/22            2803:f800::/32
103.31.4.0/22              2405:b500::/32
141.101.64.0/18            2405:8100::/32
108.162.192.0/18           2a06:98c0::/29
190.93.240.0/20            2c0f:f248::/32
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/12
172.64.0.0/13
131.0.72.0/22

附 Cloudflare CDN网络工作IP段:https://www.cloudflare.com/ips/

点赞

发表评论

电子邮件地址不会被公开。必填项已用 * 标注