After implementing Cloudflare for DDoS protection, I discovered attackers were bypassing it by:

• Connecting directly to origin server IP
• Spoofing Host headers
• Using proxy networks to mimic legitimate traffic

The common approach of deny all; allow Cloudflare_IPs; fails because:

# This doesn't work when using CF-Connecting-IP
http {
    set_real_ip_from  Cloudflare_IPs;
    real_ip_header    CF-Connecting-IP;
}

Option 1: Dual Layer Validation

Combine IP whitelisting with Host header verification:

server {
    listen 80;
    
    # Cloudflare IPv4/IPv6 ranges (updated 2023)
    include /etc/nginx/cloudflare-ips.conf;
    
    # First layer: IP verification
    allow 173.245.48.0/20;
    allow 103.21.244.0/22;
    # [Add all Cloudflare IP ranges...]
    deny all;
    
    # Second layer: Host verification
    if ($host != "yourdomain.com") {
        return 403;
    }
    
    # Handle legitimate traffic
    location / {
        # Your normal configuration
    }
}

Option 2: GeoIP Module Approach

For dynamic IP range handling:

geo $realip_remote_addr $is_cloudflare {
    default 0;
    173.245.48.0/20 1;
    103.21.244.0/22 1;
    # [All other Cloudflare ranges]
}

server {
    if ($is_cloudflare = 0) {
        return 403;
    }
}

Benchmarks show:

Create a cron job to auto-update IP ranges:

#!/bin/bash
curl -s https://www.cloudflare.com/ips-v4 > /etc/nginx/cloudflare-ips-v4.conf
curl -s https://www.cloudflare.com/ips-v6 > /etc/nginx/cloudflare-ips-v6.conf
nginx -t && nginx -s reload

For kernel-level blocking (requires root):

iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    iptables -I INPUT -p tcp --dport 80 -s $ip -j ACCEPT
    iptables -I INPUT -p tcp --dport 443 -s $ip -j ACCEPT
done

After setting up Cloudflare to mitigate DDoS attacks, I discovered attackers were bypassing the protection by:

• Connecting directly to my origin server's IP
• Forging HTTP Host headers
• Using proxy IPs not in Cloudflare's network

The standard approach of:

allow 173.245.48.0/20;
deny all;

fails when using CF-Connecting-IP because Nginx evaluates the rules against the real client IP, not the Cloudflare-proxied IP.

Here's the complete working configuration:

# Cloudflare IP ranges (updated 2023)
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

# Use CF-Connecting-IP header
real_ip_header CF-Connecting-IP;

# Block all non-Cloudflare traffic
location / {
    allow 173.245.48.0/20;
    allow 103.21.244.0/22;
    # ... (all other Cloudflare ranges)
    deny all;
    
    # Your normal proxy settings
    proxy_pass http://backend;
    # ... other proxy settings
}

For optimal performance:

• Place the allow/deny rules in the http context if applying globally
• Use geo module for large IP ranges:

geo $realip_remote_addr $cloudflare_ip {
    default 0;
    173.245.48.0/20 1;
    103.21.244.0/22 1;
    # ... other ranges
    1;
}

server {
    if ($cloudflare_ip = 0) {
        return 403;
    }
    # ... rest of config
}

Test your configuration with:

curl -H "Host: yourdomain.com" http://your.server.ip
curl -H "Host: yourdomain.com" -H "CF-Connecting-IP: 1.2.3.4" http://your.server.ip

The first should return 403, while the second (with a valid Cloudflare IP) should reach your backend.

Keep your configuration up-to-date:

• Subscribe to Cloudflare's IP list updates
• Set up automated checks for IP range changes
• Consider using a configuration management tool to deploy updates