{"id":15289013,"url":"https://github.com/c0m4r/cloudflare-only-nginx","last_synced_at":"2026-01-24T20:54:55.997Z","repository":{"id":213625251,"uuid":"734548158","full_name":"c0m4r/cloudflare-only-nginx","owner":"c0m4r","description":"CloudFlare-only nginx","archived":false,"fork":false,"pushed_at":"2024-02-05T21:32:06.000Z","size":78,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-05T14:34:34.701Z","etag":null,"topics":["cloudflare","cloudflare-only","cloudflare-only-nginx","iptables","ipv6","nginx","nginx-configuration"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/c0m4r.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":["https://en.wosp.org.pl/fundacja/jak-wspierac-wosp/wesprzyj-online"]}},"created_at":"2023-12-22T01:15:22.000Z","updated_at":"2025-12-22T13:08:51.000Z","dependencies_parsed_at":"2024-02-05T22:47:15.425Z","dependency_job_id":null,"html_url":"https://github.com/c0m4r/cloudflare-only-nginx","commit_stats":null,"previous_names":["c0m4r/cloudflare-only-nginx"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/c0m4r/cloudflare-only-nginx","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0m4r%2Fcloudflare-only-nginx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0m4r%2Fcloudflare-only-nginx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0m4r%2Fcloudflare-only-nginx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0m4r%2Fcloudflare-only-nginx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/c0m4r","download_url":"https://codeload.github.com/c0m4r/cloudflare-only-nginx/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0m4r%2Fcloudflare-only-nginx/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28736791,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-24T19:23:36.361Z","status":"ssl_error","status_checked_at":"2026-01-24T19:23:28.966Z","response_time":89,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloudflare","cloudflare-only","cloudflare-only-nginx","iptables","ipv6","nginx","nginx-configuration"],"created_at":"2024-09-30T15:55:34.734Z","updated_at":"2026-01-24T20:54:55.964Z","avatar_url":"https://github.com/c0m4r.png","language":"Python","funding_links":["https://en.wosp.org.pl/fundacja/jak-wspierac-wosp/wesprzyj-online"],"categories":[],"sub_categories":[],"readme":"#  CloudFlare-only nginx\n\n[![Python](https://img.shields.io/badge/made%20with-python-blue?logo=python\u0026logoColor=ffffff)](https://www.python.org/)\n[![Python](https://img.shields.io/badge/pypi-cloudflare--only--nginx-blue?logo=pypi\u0026logoColor=ffffff)](https://pypi.org/project/cloudflare-only-nginx/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Test](https://github.com/c0m4r/cloudflare-only-nginx/workflows/lint_python/badge.svg)](https://github.com/c0m4r/cloudflare-only-nginx/actions)\n[![CodeFactor](https://www.codefactor.io/repository/github/c0m4r/cloudflare-only-nginx/badge)](https://www.codefactor.io/repository/github/c0m4r/cloudflare-only-nginx)\n\nThis repository contains a complete configuration examples for CloudFlare-only nginx.\n\nThe goal is to close your web server to cloudflare-only traffic using firewall rules and [CloudFlare IP list](https://www.cloudflare.com/ips/).\n\nYou can accept traffic from both IPv4 and IPv6, however even having IPv6 only server doesn't mean that you cannot serve your website to IPv4 clients. You can use CloudFlare to achieve that. It's enough to set up only AAAA record in the CloudFlare DNS configuration. CloudFlare will communicate with your origin server via IPv6 and send responses to clients connecting from both IPv4 and IPv6 addresses.\n\nUse [Origin CA Certificates](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/) for strict end-to-end encryption.\n\nKeep in mind that CloudFlare will only use tcp/443 port (HTTPS). We don't need to expose 80/tcp.\n\n## Log real client IP\n\nWith [realip module](https://nginx.org/en/docs/http/ngx_http_realip_module.html) you can log real client IP sent by CloudFlare in [CF-Connecting-IP header](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/).\n\nEdit nginx.conf and add these settings inside `http` section:\n\n## nginx configuration\n\n```\n# realip\ninclude cloudflare.ipv4.conf;\ninclude cloudflare.ipv6.conf;\nreal_ip_header CF-Connecting-IP;\n```\n\n## iptables\n\nBefore you use the script, make sure that incoming tcp/443 traffic is pointing to CLOUDFLARE chain.\n\n```\n-N CLOUDFLARE\n-A INPUT -p tcp -m tcp --dport 443 -j CLOUDFLARE\n```\n\nIf your INPUT default policy is ACCEPT, make sure to run cloudflare_ips_reload.py with `--target DROP`\n\n## Helper script\n\n```\nusage: cloudflare_ips_reload.py [-h] [-4] [-6] [-s] [--chain CHAIN] [--target TARGET]\n\nCloudFlare-only nginx\nhttps://github.com/c0m4r/cloudflare-only-nginx\n\noptions:\n  -h, --help       show this help message and exit\n  -4, --ipv4       only reload configuration for IPv4\n  -6, --ipv6       only reload configuration for IPv6\n  -s, --silent     silent mode - only prints errors\n  --chain CHAIN    iptables chain name (default: CLOUDFLARE)\n  --target TARGET  iptables chain target (default: RETURN)\n```\n\nThis script will recreate iptables CLOUDFLARE chain and allow traffic from only CloudFlare networks, then recreate realip configuration and reload nginx.\n\nBy default, with no options passed, it will recreate rules for both IPv4 and IPv6.\n\n### PyPI installation\n\n```\npip install cloudflare-only-nginx\ncloudflare-only-nginx --help\n```\n\n#### via venv\n\n```\npython3 -m venv .venv\n. .venv/bin/activate\npip install cloudflare-only-nginx\ncloudflare-only-nginx --help\n```\n\n## License\n\n\u003e MIT License\n\u003e \n\u003e Copyright (c) 2023 c0m4r\n\u003e \n\u003e Permission is hereby granted, free of charge, to any person obtaining a copy\n\u003e of this software and associated documentation files (the \"Software\"), to deal\n\u003e in the Software without restriction, including without limitation the rights\n\u003e to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n\u003e copies of the Software, and to permit persons to whom the Software is\n\u003e furnished to do so, subject to the following conditions:\n\u003e \n\u003e The above copyright notice and this permission notice shall be included in all\n\u003e copies or substantial portions of the Software.\n\u003e \n\u003e THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n\u003e IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n\u003e FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n\u003e AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n\u003e LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n\u003e OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n\u003e SOFTWARE.\n\n## Funding\n\nIf you found this software helpful, please consider [making donation](https://en.wosp.org.pl/fundacja/jak-wspierac-wosp/wesprzyj-online) to a charity on my behalf. Thank you.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fc0m4r%2Fcloudflare-only-nginx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fc0m4r%2Fcloudflare-only-nginx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fc0m4r%2Fcloudflare-only-nginx/lists"}