Package: cloudflare-only-nginx
CloudFlare-only nginxThis repository contains a complete configuration examples for CloudFlare-only nginx.The goal is to close your web server to cloudflare-only traffic using firewall rules andCloudFlare IP list.You can accept traffic from both IPv4 and IPv6, however even having IPv6 only server doesn't mean that you cannot serve your website to IPv4 clients. You can use CloudFlare to achieve that. It's enough to set up only AAAA record in the CloudFlare DNS configuration. CloudFlare will communicate with your origin server via IPv6 and send responses to clients connecting from both IPv4 and IPv6 addresses.UseOrigin CA Certificatesfor strict end-to-end encryption.Keep in mind that CloudFlare will only use tcp/443 port (HTTPS). We don't need to expose 80/tcp.Log real client IPWithrealip moduleyou can log real client IP sent by CloudFlare inCF-Connecting-IP header.Edit nginx.conf and add these settings insidehttpsection:nginx configuration# realip
include cloudflare.ipv4.conf;
include cloudflare.ipv6.conf;
real_ip_header CF-Connecting-IP;iptablesBefore you use the script, make sure that incoming tcp/443 traffic is pointing to CLOUDFLARE chain.-N CLOUDFLARE
-A INPUT -p tcp -m tcp --dport 443 -j CLOUDFLAREIf your INPUT default policy is ACCEPT, make sure to run cloudflare_ips_reload.py with--target DROPHelper scriptusage: cloudflare_ips_reload.py [-h] [-4] [-6] [-s] [--chain CHAIN] [--target TARGET]

CloudFlare-only nginx
https://github.com/c0m4r/cloudflare-only-nginx

options:
  -h, --help       show this help message and exit
  -4, --ipv4       only reload configuration for IPv4
  -6, --ipv6       only reload configuration for IPv6
  -s, --silent     silent mode - only prints errors
  --chain CHAIN    iptables chain name (default: CLOUDFLARE)
  --target TARGET  iptables chain target (default: RETURN)This script will recreate iptables CLOUDFLARE chain and allow traffic from only CloudFlare networks, then recreate realip configuration and reload nginx.By default, with no options passed, it will recreate rules for both IPv4 and IPv6.PyPI installationpip install cloudflare-only-nginx
cloudflare-only-nginx --helpLicenseMIT LicenseCopyright (c) 2023 c0m4rPermission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.FundingIf you found this software helpful, please considermaking donationto a charity on my behalf. Thank you.