{"id":13493244,"url":"https://github.com/Paul-Reed/cloudflare-ufw","last_synced_at":"2025-03-28T11:32:06.717Z","repository":{"id":38326173,"uuid":"64698008","full_name":"Paul-Reed/cloudflare-ufw","owner":"Paul-Reed","description":"Script to update UFW with Cloudflare IPs","archived":false,"fork":false,"pushed_at":"2024-10-02T19:52:24.000Z","size":23,"stargazers_count":640,"open_issues_count":0,"forks_count":141,"subscribers_count":19,"default_branch":"master","last_synced_at":"2024-10-25T04:50:49.510Z","etag":null,"topics":["cloudflare","security","ufw-firewall"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Paul-Reed.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-08-01T20:08:32.000Z","updated_at":"2024-10-24T10:35:11.000Z","dependencies_parsed_at":"2024-10-24T16:14:42.490Z","dependency_job_id":null,"html_url":"https://github.com/Paul-Reed/cloudflare-ufw","commit_stats":{"total_commits":22,"total_committers":7,"mean_commits":3.142857142857143,"dds":0.2727272727272727,"last_synced_commit":"de5ffc544eaf5e7d89bfc69cb0182c6d07cd0b59"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paul-Reed%2Fcloudflare-ufw","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paul-Reed%2Fcloudflare-ufw/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paul-Reed%2Fcloudflare-ufw/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paul-Reed%2Fcloudflare-ufw/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Paul-Reed","download_url":"https://codeload.github.com/Paul-Reed/cloudflare-ufw/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":222376246,"owners_count":16974312,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloudflare","security","ufw-firewall"],"created_at":"2024-07-31T19:01:13.470Z","updated_at":"2024-10-31T07:31:21.229Z","avatar_url":"https://github.com/Paul-Reed.png","language":"Shell","readme":"# cloudflare-ufw\nScript to update UFW with Cloudflare IPs.\n\n### Setup\nAssuming that you already have ufw installed (now a pre-installed package in most linux distros), firstly ensure that ufw is not enabled;\n\n```sudo ufw status verbose```\n\nIf it's not enabled, the response should be ```Status: inactive``` but if not, let's disable it;\n\n```sudo ufw disable```\n\nClear out any existing rules;\n\n```sudo ufw reset```\n\nand set the default rules to deny incoming and allow outgoing connections;\n\n```sudo ufw default deny incoming```  \n```sudo ufw default allow outgoing```\n\nIt's important at this stage to prevent being accidently being locked out of your system by adding 2 rules, before going further.  \nAdd a localhost rule;\n\n```sudo ufw allow from 192.168.1.0/24```\n\nand also allow SSH access;\n\n```sudo ufw allow ssh```\n\nProvided those rules were succesfully added, time to enable your firewall;\n\n```sudo ufw enable```\n\nYou will receive a warning that says the \"command may disrupt existing ssh connections.\" We have already set up a firewall rule that allows SSH connections so it should be fine to continue. Respond to the prompt with y.  \nYou can run the ```sudo ufw status verbose``` command to see the rules that are set.\n\n### Install the script\n\nGit clone this repo to your system, and run the bash script in the normal manner;\n\n```sudo /your/path/cloudflare-ufw/./cloudflare-ufw.sh```\n\nThe script will then download Cloudflare's current v4 \u0026 v6 IP's, and install them into ufw's configuration. Check that the rules have been successfuly added; ```sudo ufw status verbose```\n\n### Scheduling\n\nEverytime the script is run, it will add any new Cloudflare IP addresses, so consider running the script weekly to ensure that it's kept up to date.  \nThe script can run automatically by using cron;\n\n```sudo crontab -e```\n\nand add the event;\n\n```0 0 * * 1 /your/path/cloudflare-ufw/cloudflare-ufw.sh \u003e /dev/null 2\u003e\u00261```\n\n**OR**\n\nIf using node-red, simply add ```sudo /your/path/cloudflare-ufw/./cloudflare-ufw.sh``` to an 'exec node' and inject it every week.\n\n### Other UFW commands\n\n#### Delete a single rule\nFirstly get a numbered list of all rules  \n```sudo ufw status numbered```\n\nand then delete the rule by number  \n```sudo ufw delete 34```\n\nThis concept was originally [developed by Leow Kah Man](https://www.leowkahman.com/2016/05/02/automate-raspberry-pi-ufw-allow-cloudflare-inbound/).\n","funding_links":[],"categories":["Shell"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPaul-Reed%2Fcloudflare-ufw","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPaul-Reed%2Fcloudflare-ufw","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPaul-Reed%2Fcloudflare-ufw/lists"}