https://github.com/jakejarvis/cloudflare-ufw-updater

🔥 🧱 UFW rule updater to only allow HTTP and HTTPS traffic from Cloudflare IP address ranges
https://github.com/jakejarvis/cloudflare-ufw-updater

bash cloudflare firewall linux security shell ubuntu ufw

Last synced: about 2 months ago
JSON representation

🔥 🧱 UFW rule updater to only allow HTTP and HTTPS traffic from Cloudflare IP address ranges

• Host: GitHub
• URL: https://github.com/jakejarvis/cloudflare-ufw-updater
• Owner: jakejarvis
• License: mit
• Created: 2019-12-06T16:08:19.000Z (about 5 years ago)
• Default Branch: master
• Last Pushed: 2022-05-13T15:18:01.000Z (over 2 years ago)
• Last Synced: 2024-11-02T11:51:39.731Z (2 months ago)
• Topics: bash, cloudflare, firewall, linux, security, shell, ubuntu, ufw
• Language: Shell
• Homepage:
• Size: 4.88 KB
• Stars: 21
• Watchers: 3
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.md

Awesome Lists containing this project

README

        
# Cloudflare + UFW Rule Updater 🔥 🧱



Inspired by Paul-Reed/cloudflare-ufw and Leow Kah Man.


A simple bash script that downloads a list of IP address ranges (both v4 and v6) [belonging to Cloudflare](https://www.cloudflare.com/ips/) and adds them as rules to UFW (Ubuntu's [Uncomplicated Firewall](https://wiki.ubuntu.com/UncomplicatedFirewall)).

In other words, the easiest way to protect your origin server from direct attacks circumventing Cloudflare's protection.

## Usage

### Run once:

Check your current rules first (`sudo ufw status numbered`); if you're already allowing traffic to ports 80 and 443 from **anywhere**, delete those rules with `sudo ufw rule delete X` (replace X with the matching rule number).

**Make sure you're allowing SSH traffic for yourself before enabling UFW!** Run `sudo ufw allow ssh` to be "safe" — you can restrict SSH to your own IPs later if you'd like to _actually_ be safe. 😉

Download (and skim through it — don't trust strangers on the internet with `sudo` permissions!) and run this script once as root (`sudo bash ./cf-ufw.sh`).

Once you've checked that it worked (`sudo ufw status numbered` once again), you can run `sudo ufw enable` to lock everything down.



### Run as a daily cron job:

Cloudflare might add new IPs to their lists at any time. Therefore, it's important to keep your UFW rules up-to-date by running this script automatically at a set interval via a [cron job](https://en.wikipedia.org/wiki/Cron).

1. `sudo crontab -e`

2. Add this line to the end and save:

```

@daily /location/of/cf-ufw.sh &> /dev/null

```

If you'd like an interval other than daily, [crontab.guru](https://crontab.guru/) is a nifty tool to generate the syntax to replace `@daily`.

## Customization

`cf-ufw.sh` can easily be modified and adjusted to your liking. By default, it only restricts ports `80` and `443` via TCP — likely the reason you're using Cloudflare in the first place. Those can be changed to any other port number (or literally every port). You can also remove either one of the first two lines if your server isn't using IPv6 or IPv4.

In any case, I'd recommend skimming Ubuntu's [full UFW documentation](https://help.ubuntu.com/community/UFW) before enabling, as it's easy to lock yourself out of your own server if you're not careful!

## License

This project is distributed under the [MIT license](LICENSE.md).