Package: cf-ips-to-hcloud-fw
Update Hetzner Cloud Firewall Rules with Current Cloudflare IP RangesThis tool,cf-ips-to-hcloud-fw, helps you keep your Hetzner Cloud firewall
rules up-to-date with the current Cloudflare IP ranges.Table of ContentsOverviewInstallationUsing PythonUsing pipx (Recommended)Using pipDocker and KubernetesConfigurationPreparing the Hetzner Cloud FirewallConfiguring the ApplicationOverviewcf-ips-to-hcloud-fwfetches the currentCloudflare IP
rangesand updates your Hetzner Cloud firewall
rules using thehcloud
API.The tool specifically targetsincomingfirewall rules andreplacesthe
networks with Cloudflare networks if their description contains__CLOUDFLARE_IPS_V4__,__CLOUDFLARE_IPS_V6__or__CLOUDFLARE_IPS__.Text in rule descriptionCloudflare IP ranges__CLOUDFLARE_IPS_V4__IPv4 only__CLOUDFLARE_IPS_V6__IPv6 only__CLOUDFLARE_IPS__IPv4 + IPv6Note: Having both__CLOUDFLARE_IPS_V4__and__CLOUDFLARE_IPS_V6__in a rule
description is equivalent to having__CLOUDFLARE_IPS__there.InstallationUsing PythonTo installcf-ips-to-hcloud-fwusing Python, we recommend usingpipx.pipxis a tool for installing and running
Python applications in isolated environments.Using pipx (Recommended)Installcf-ips-to-hcloud-fwusing pipx:pipxinstallcf-ips-to-hcloud-fwVerify the installation:cf-ips-to-hcloud-fw-hYou should see the usage information forcf-ips-to-hcloud-fw.To upgradecf-ips-to-hcloud-fw, run:[!TIP]
To upgradecf-ips-to-hcloud-fw, runpipx upgrade cf-ips-to-hcloud-fw.Using pipWe strongly recommend using a virtual environment when installing Python
packages with pip. This helps to avoid conflicts between packages and allows you
to manage packages on a per-project basis.Create a virtual environment:python3-mvenvcf-ips-to-hcloud-fw-venvInstallcf-ips-to-hcloud-fwinto the virtual environment:./cf-ips-to-hcloud-fw-venv/bin/pip3installcf-ips-to-hcloud-fwVerify the installation:./cf-ips-to-hcloud-fw-venv/bin/cf-ips-to-hcloud-fw-hYou should see the usage information forcf-ips-to-hcloud-fw.[!TIP]
To upgradecf-ips-to-hcloud-fwin your virtual environment, run./cf-ips-to-hcloud-fw-venv/bin/pip3 install --upgrade cf-ips-to-hcloud-fw.Docker and KubernetesAs an alternative,cf-ips-to-hcloud-fwcan be run using Docker or a Kubernetes
CronJob.  Simply mount your configuration file as/usr/src/app/config.yaml.Here's an example using Docker:dockerrun--rm\--mounttype=bind,source=$(pwd)/config.yaml,target=/usr/src/app/config.yaml,readonly\jkreileder/cf-ips-to-hcloud-fw:1.0.8(Add--pull=alwaysif you use a rolling image tag.)Docker images forcf-ips-to-hcloud-fware available for bothlinux/amd64andlinux/arm64architectures.  The Docker images support the following tags:1: This tag always points to the latest1.x.xrelease.1.0: This tag always points to the latest1.0.xrelease.1.0.8: This tag points to the specific1.0.8release.main: This tag points to the most recent development version ofcf-ips-to-hcloud-fw. Use this at your own risk as it may contain unstable
changes.You can find the Docker images at:Docker HubQuay.ioGitHub PackagesHere's an example of how to create a Kubernetes Secret for yourconfiguration:apiVersion:v1kind:Secretmetadata:name:cf-ips-to-hcloud-fw-configtype:OpaquestringData:config.yaml:|- token: API_TOKEN_FOR_PROJECT_1firewalls:- firewall-1- firewall-2- token: API_TOKEN_FOR_PROJECT_2firewalls:- defaultAnd here's an example of a Kubernetes CronJob that uses the Secret:apiVersion:batch/v1kind:CronJobmetadata:name:cf-ips-to-hcloud-fwspec:schedule:"0****"# Run every hourjobTemplate:spec:template:spec:securityContext:runAsNonRoot:truerunAsUser:65534containers:-name:cf-ips-to-hcloud-fwimage:jkreileder/cf-ips-to-hcloud-fw:1.0.8# imagePullPolicy: Always # Uncomment this if you use a rolling image tagsecurityContext:allowPrivilegeEscalation:falsereadOnlyRootFilesystem:truecapabilities:drop:-ALLvolumeMounts:-name:config-volumemountPath:/usr/src/app/config.yamlsubPath:config.yamlvolumes:-name:config-volumesecret:secretName:cf-ips-to-hcloud-fw-configrestartPolicy:OnFailureConfigurationPreparing the Hetzner Cloud FirewallTo prepare your Hetzner Cloud Firewall:Set the rule descriptions: Include__CLOUDFLARE_IPS_V4__,__CLOUDFLARE_IPS_V6__, or__CLOUDFLARE_IPS__in the description of any
incoming firewall rule where you want to insert Cloudflare networks. This
will be used as a marker to identify which rules should be updated with the
Cloudflare IP ranges.Generate an API token: You'll need an API token with write permissions
for the project that contains the firewall. This token will be used to
authenticate your requests to the Hetzner Cloud API. You can generate a token
in the Hetzner Cloud Console by going to "Security" > "API Tokens" >
"Generate API Token".Configuring the ApplicationTo configure the application, you'll need to create aconfig.yamlfile with
your API tokens and the names of the firewalls you want to update:-token:API_TOKEN_FOR_PROJECT_1# Token with read-write permissions for a Hetzner Cloud projectfirewalls:-firewall-1-firewall-2-token:API_TOKEN_FOR_PROJECT_2# Token with read-write permissions for another Hetzner Cloud projectfirewalls:-default