Skip to main content

Restricting Traffic To Cloudflare Only

Overview

This guide explains how to configure MDOQ’s Nginx settings to block direct access to the origin server, allowing web traffic only from Cloudflare’s known IP address ranges.

By restricting access at the Nginx level, requests must pass through Cloudflare before reaching the website. This helps ensure that Cloudflare’s security features, including its Web Application Firewall (WAF) and DDoS protection, cannot be bypassed by accessing the origin server directly.

Prerequisites

Before making any changes, ensure the following requirements are met:

  • Cloudflare is configured in proxy mode: The relevant DNS records must have the orange cloud enabled in Cloudflare.
  • Access to MDOQ: You must have sufficient permissions to modify the production instance’s Nginx settings and synchronize components.
  • A suitable maintenance window: Applying the configuration will briefly interrupt service while Nginx is reconfigured.

Configuration Steps

1. Update the Nginx version

  1. Open the relevant production instance in MDOQ.
  2. Navigate to Settings → Nginx.
  3. Change the Nginx version to 1.28.3 or later.

2. Select Cloudflare as the WAF provider

While still in Production Instance → Settings → Nginx:

  1. Locate the WAF Provider setting.
  2. Select Cloudflare.

This configures the instance to use Cloudflare as the designated WAF provider.

3. Enable the firewall

While still in Production Instance → Settings → Nginx:

Enable the Firewall setting within the Nginx configuration.

This activates the firewall configuration intended to restrict incoming connections to Cloudflare’s published IP address ranges, preventing direct access to the origin server from other sources.

4. Save the settings

Save the changes made to the Nginx configuration.

5. Synchronize the required components

The updated settings must be synchronized to apply the configuration to the production instance.

  1. Select Sync.
  2. Choose Select components to sync.
  3. Enable Advanced mode.
  4. Check Only synchronize selected components.
  5. Select the following components:
    • Site Nginx
    • Helpers
  6. Click Synchronize.

This applies the relevant Nginx configuration and helper changes to the instance.

Important: The synchronization process will cause a brief period of downtime while Nginx is reconfigured. Perform this step during an appropriate maintenance window and allow the process to complete before validating the site.

Testing and Validation

Once synchronization has completed, verify that direct access to the origin server is blocked.

Run the following commands from a machine that can reach the server IP address. Replace DOMAIN with the website’s hostname and SERVER_IP with the origin server’s IP address.

Test HTTP access

bash
curl -IX GET -H "Host: DOMAIN" http://SERVER_IP/

Test HTTPS access

bash
curl -IX GET -H "Host: DOMAIN" https://SERVER_IP/

Expected result

Both commands should fail to establish a connection and return an error indicating:

text
Connection refused

This indicates that direct connections to the origin server are being rejected. The website should remain accessible through Cloudflare using its normal public domain.

Note: Connection refused is the expected result for this specific validation procedure, but it is not the only possible indication that direct access is blocked. A timeout or another network-level rejection may also occur depending on the firewall implementation. Confirm that the website remains accessible through Cloudflare and that the origin cannot be reached directly.

Completion Criteria

The configuration can be considered complete when:

  • Nginx is running version 1.28.3 or later.
  • Cloudflare is selected as the WAF provider.
  • The firewall is enabled and the required components have synchronized successfully.
  • Direct HTTP and HTTPS access to the origin server is blocked.
  • The website remains accessible through Cloudflare.

Maintenance Considerations

MDOQ will automatically check Cloudflare’s published IP address ranges regularly to keep the origin server’s allowlist up to date. This helps ensure that legitimate traffic routed through Cloudflare continues to be permitted as Cloudflare’s IP ranges change, while direct access to the origin server remains restricted.

No manual updates to the Cloudflare IP allowlist should be necessary as part of routine maintenance, provided MDOQ’s automatic checks and configuration updates are operating correctly.

Powered by Zendesk