When you encounter Cloudflare's "Error 1003 - Direct IP access not allowed", you're witnessing a fundamental security feature in action. Cloudflare implements this through:

if (request.host_header == server_ip_address) {
    return Error_1003;
} else {
    process_request();
}

Cloudflare's edge servers examine the HTTP Host header to determine which website to serve. Without a valid hostname, the request fails. This is implemented at the web server level before DNS resolution occurs.

While DNS operates at a higher layer, Cloudflare's infrastructure combines multiple layers of control:

• Network-level IP blocking at edge servers
• DNS-based routing decisions
• HTTP/HTTPS protocol enforcement

Here's how you might implement similar functionality in Nginx:

server {
    listen 80 default_server;
    server_name _;
    
    if ($host ~* "^[0-9.]+$") {
        return 403 "Direct IP access not allowed";
    }
    
    # Normal website configuration
    server_name example.com;
    ...
}

For testing purposes, you can modify your local hosts file or use curl with proper headers:

curl -H "Host: example.com" http://104.16.123.96/

This blocking mechanism prevents:

• IP-based scanning attacks
• Bypassing of security filters
• SSL certificate mismatches

Cloudflare operates a reverse proxy architecture where:

1. All traffic routes through their Anycast network
2. Edge servers validate requests before forwarding
3. IP-based access would bypass critical security checks

When you attempt direct IP access to a Cloudflare-protected site, you encounter Error 1003 because of Cloudflare's strict Host header validation. Here's what happens at the protocol level:

# Example HTTP request without Host header (will be blocked)
GET / HTTP/1.1
User-Agent: curl/7.68.0
Accept: */*

# Valid HTTP request
GET / HTTP/1.1
Host: example.com
User-Agent: curl/7.68.0
Accept: */*

While DNS operates at a higher layer than IP, Cloudflare functions as both a DNS provider and reverse proxy:

• Their edge servers listen on shared IP addresses for multiple customers
• Without Host header, they can't route requests to correct origin server
• Prevents IP scanning and direct attacks bypassing DNS-based security

Here's how Cloudflare likely implements this at their edge (simplified Nginx config):

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    
    server_name _;
    
    if ($host = "") {
        return 403 "Error 1003\nDirect IP access not allowed";
    }
    
    # Proxying logic for valid host headers
    location / {
        proxy_pass https://$host;
        proxy_set_header Host $host;
    }
}

You can reproduce the behavior with these commands:

# This will be blocked (missing Host header)
curl http://104.16.12.34

# This succeeds (proper Host header)
curl -H "Host: example.com" http://104.16.12.34

Blocking direct IP access provides several security benefits:

• Prevents attackers from bypassing DNS-based WAF rules
• Stops port scanners from identifying origin servers
• Maintains SSL/TLS validity (certificates are issued for domains, not IPs)