ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Vultr Firewall added Cloudflare

    IT Discussion
    vultr firewall cloudflare
    6
    31
    4.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JaredBuschJ
      JaredBusch @black3dynamite
      last edited by

      @black3dynamite said in Vultr Firewall added Cloudflare:

      @JaredBusch care to explain why selecting cloudflare instead of just allowing port 80 and 443?

      I'm only allowing Cloudflare IP blocks on the HTTP/S ports.

      That means nothing can possibly hit my server by IP. It is 100% safe from direct attacks.

      M 1 Reply Last reply Reply Quote 5
      • M
        Mario Jakovina @JaredBusch
        last edited by

        @JaredBusch said in Vultr Firewall added Cloudflare:

        I'm only allowing Cloudflare IP blocks on the HTTP/S ports.
        That means nothing can possibly hit my server by IP. It is 100% safe from direct attacks.

        Can you please explain this a little more.
        Do you mean that your server is then only accessible by domain name (if not by IP address)?
        If so, why is it safer to be accessible by domain name, then by IP adress?

        DashrenderD JaredBuschJ 2 Replies Last reply Reply Quote 0
        • DashrenderD
          Dashrender @Mario Jakovina
          last edited by

          @Mario-Jakovina said in Vultr Firewall added Cloudflare:

          @JaredBusch said in Vultr Firewall added Cloudflare:

          I'm only allowing Cloudflare IP blocks on the HTTP/S ports.
          That means nothing can possibly hit my server by IP. It is 100% safe from direct attacks.

          Can you please explain this a little more.
          Do you mean that your server is then only accessible by domain name (if not by IP address)?
          If so, why is it safer to be accessible by domain name, then by IP adress?

          He means hackers can't attack HTTP or HTTPS on his server directly because he's only allowing CloudFlare to have access. CloudFlare is his proxy - so all the legitimate traffic goes to CloudFlare, Cloudfare cleans it up, then forwards what it needs to onto JB's server.

          Of course the hackers can still attack his server on any other ports he doesn't have locked down similarly, not that he said anything about that, I'm just mentioning it in case you were wondering.

          JaredBuschJ 1 Reply Last reply Reply Quote 0
          • JaredBuschJ
            JaredBusch @Dashrender
            last edited by

            @Dashrender said in Vultr Firewall added Cloudflare:

            on any other ports he doesn't have locked down similarly, not that he said anything about that,

            It is a deny all, as visible in the screen shot.

            DashrenderD 1 Reply Last reply Reply Quote 0
            • DashrenderD
              Dashrender @JaredBusch
              last edited by

              @JaredBusch said in Vultr Firewall added Cloudflare:

              @Dashrender said in Vultr Firewall added Cloudflare:

              on any other ports he doesn't have locked down similarly, not that he said anything about that,

              It is a deny all, as visible in the screen shot.

              So it does - I didn't look at your picture.

              1 Reply Last reply Reply Quote 0
              • JaredBuschJ
                JaredBusch @Mario Jakovina
                last edited by JaredBusch

                @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                Do you mean that your server is then only accessible by domain name (if not by IP address)?

                Yes, this does mean it is only accessible by the FQDN.
                You cannot hit a site by the IP of the proxy, Cloudflare in this case. Because the proxy would have no clue what to do with the traffic.

                ML is behind Cloudflare. The IP resolves as 104.26.3.183, among others. If you go to that IP, Cloudflare has no clue WTF to send you to and says so.
                8d61070d-7053-4de3-b8c8-e745eb7826a5-image.png

                The site I protected as mentioned in the screenshots above is on Vultr and has IP on the Vultr network, obviously. But a lookup only returns the Cloudflare info.
                8a389f00-3264-4503-9a2f-3edbae82be32-image.png

                But even if someone scraped, or the IP was leaked (it is 173.199.114.195), the Vultr Firewall will let nothing connect to that IP except SSH from 2 specific IP addresses and http/https only from the Cloudflare network.

                M 1 Reply Last reply Reply Quote 0
                • M
                  Mario Jakovina @JaredBusch
                  last edited by Mario Jakovina

                  @JaredBusch OK, but why is access by FQDN safer then access by IP adress?
                  And how can Cloudflare distinguish legitimate user from hacker if they both try to access via FQDN?

                  (We have one server on Vultr and we access it through IP address. We also have one server on other provider)

                  DashrenderD JaredBuschJ 2 Replies Last reply Reply Quote 0
                  • DashrenderD
                    Dashrender @Mario Jakovina
                    last edited by

                    @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                    @JaredBusch OK, but why is access by FQDN safer then access by IP adress?
                    And how can Cloudflare distinguish legitimate user from hacker if they both try to access via FQDN?

                    (We have one server on Vultr and we access it through IP address. Also one on other provider)

                    It's not about the FQDN - it's about the fact that from the outside world's point of view, the website lives at CloudFlare... the legit visitors and the hackers only the the IP of CloudFlare, unless there is leakage, as JB mentioned, but even then, the firewall at Vultr prevents the hackers making a connection.

                    All legit connections to JB's server in Vultr MUST come through CloudFlare, expect the listed IPs that have access to SSH.

                    1 Reply Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @Mario Jakovina
                      last edited by

                      @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                      @JaredBusch OK, but why is access by FQDN safer then access by IP adress?

                      No one said it is safer. It was only said that it can only be accessed that way.

                      1 Reply Last reply Reply Quote 0
                      • M
                        Mario Jakovina
                        last edited by

                        @JaredBusch said in Vultr Firewall added Cloudflare:

                        No one said it is safer. It was only said that it can only be accessed that way.

                        @Dashrender said in Vultr Firewall added Cloudflare:

                        All legit connections to JB's server in Vultr MUST come through CloudFlare,

                        But what is the benefit of allowing only through Cloudflare if it is not safer?
                        Do you need to subscribe to some service at Cloudflare to use that or not?

                        JaredBuschJ 1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch
                          last edited by

                          Let me use this example.

                          I have a blog on blog.jaredbusch.com (I don't) and it is run using WordPress on Vultr.

                          I do the basic and have the traffic going through Cloudflare with the orange cloud.

                          Any hacker will hit the site in the legal way through Cloudflare. The Cloudflare network has a lot of defense capabilities built in that you can use depending on your subscription level.

                          But assuming you have none of that, it still protects you by not exposing your public IP if nothing else.

                          But If I do not restrict access http/https access to the live IP, botnets will quickly discover that IP 10.11.12.13 is running a WP instance. Then the WP hacking bots will attach the system directly via https://10.11.12.13/wp-login.php?WTFEVERHACKWORKSONVERSION etc.

                          The Vultr filewall settings as discussed 100% eliminate that possibility.

                          1 Reply Last reply Reply Quote 0
                          • JaredBuschJ
                            JaredBusch @Mario Jakovina
                            last edited by

                            @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                            But what is the benefit of allowing only through Cloudflare if it is not safer?
                            Do you need to subscribe to some service at Cloudflare to use that or not?

                            All proxy services can provide protection. It is a matter of what the service provides for what cost and what you want to protect.

                            This thread is not a discussion of the specific uses of Cloudflare. Feel free to make a thread for that.

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              Mario Jakovina @JaredBusch
                              last edited by

                              @JaredBusch Thank you.
                              I will read a little about Cloudflare and its services... I am not familiar with that.

                              JaredBuschJ 1 Reply Last reply Reply Quote 0
                              • JaredBuschJ
                                JaredBusch @Mario Jakovina
                                last edited by

                                @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                                @JaredBusch Thank you.
                                I will read a little about Cloudflare and its services... I am not familiar with that.

                                Even my personal domain, with like no content or traffic was protected from random drive by attacks. For free.

                                5a8c2198-244a-4ebc-a639-7579e965ac05-image.png

                                2353780b-8db7-479e-88ee-27fb9e9cb870-image.png

                                M 1 Reply Last reply Reply Quote 1
                                • M
                                  Mario Jakovina @JaredBusch
                                  last edited by

                                  @JaredBusch OK.
                                  Is there any reason not to use at least Cloudflare Free plan and setup Vultr FW to allow only Cloudflare traffic, if we have FQDN for our server?

                                  JaredBuschJ DashrenderD 2 Replies Last reply Reply Quote 0
                                  • JaredBuschJ
                                    JaredBusch @Mario Jakovina
                                    last edited by

                                    @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                                    @JaredBusch OK.
                                    Is there any reason not to use at least Cloudflare Free plan and setup Vultr FW to allow only Cloudflare traffic, if we have FQDN for our server?

                                    Pretty much never a reason not to do it.

                                    I always use Cloudflare already to handle DNS.

                                    1 Reply Last reply Reply Quote 2
                                    • DashrenderD
                                      Dashrender @Mario Jakovina
                                      last edited by

                                      @Mario-Jakovina said in Vultr Firewall added Cloudflare:

                                      @JaredBusch OK.
                                      Is there any reason not to use at least Cloudflare Free plan and setup Vultr FW to allow only Cloudflare traffic, if we have FQDN for our server?

                                      No reason not to have FQDN for your stuff - it's completely free from CloudFlare.

                                      JaredBuschJ M 2 Replies Last reply Reply Quote 0
                                      • JaredBuschJ
                                        JaredBusch @Dashrender
                                        last edited by

                                        @Dashrender said in Vultr Firewall added Cloudflare:

                                        No reason not to have FQDN for your stuff - it's completely free from CloudFlare.

                                        That's not how anything works.

                                        You must pay for a domain name.

                                        Now you can use all the sub domains you want. But that also gets int other configurations.

                                        You do not just have a FQDN.

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          Mario Jakovina @Dashrender
                                          last edited by

                                          @Dashrender Really! We use DynDNS paid service for our in-house servers
                                          If you can point me how to get free FQDN from Cloudflare, I would be grateful?

                                          scottalanmillerS 1 Reply Last reply Reply Quote 0
                                          • M
                                            Mario Jakovina @JaredBusch
                                            last edited by

                                            @JaredBusch said in Vultr Firewall added Cloudflare:

                                            You must pay for a domain name.

                                            OK, thanks

                                            DashrenderD scottalanmillerS 2 Replies Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post