Sure, but which of those 4 billion IPs is the right one if you can’t tell them apart?
With proper opsec (e.g. firewall rules to only allow Cloudflare in and whitelisted traffic out) means you will be pretty safe. Until you aren’t because you missed a leak 
For example, better proxy all your DNS as well.
Guess I’m lucky not to be hold any classified national military secrets! 
Thanks everyone, I ended up switching to Frantech solutions who hooked me up with Voxalitys DDoS Filtering. Using a proxy is no longer needed
Is it not possible to disable discourse’s parsing of these images/urls that cause the IP leak of the origin server?
Or at least make it so there is a whitelist of a certain set of domains that will be parsed?