While researching Cloudflare and best practices to use to protect my server I ran into an article by Cloudflare about protecting the origin IP (the IP where the website is actually being ran from) because you would be able to circumvent all of Cloudflares ddos protection if you had it. DDoS Prevention: Protecting The Origin One of the many great features that CloudFlare provides is protection from Distributed Denial of Service (DDoS) attacks. A malicious party who wants to make your website or web service unavailable could try to overwhelm it with requests from... What interested me was specifically this section: Never initiate an outbound connection based on user action If the attacker can get your web server to connect to an arbitrary address, they will reveal your origin IP. Features like “upload from URL” that allow the user to upload a photo from a given URL should be configured so that the server doing the download is not the website origin server. This is important because if an attacker can choose the URL entered, they can set up a web site specifically to monitor who connects to it, or use a public service that monitors the IPs that contact unique URLs. I have tested this and indeed it does appear to get the origin IP from the server when uploading a remote image, so my question is what if anything can I do to stop that?

it gets IP because the image is parsed, you’d have to set up a proxy on the back end

Related topics: [image] Mailgun leaking server's real IP behind Cloudflare Support Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks. Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UTC) No DDoSers have discovered this yet. Additionally, a security researcher just pasted me the following information and told me it was pulled using “linux dig” IP address **REAL IP HERE** Reverse … [image] Discourse Link previews through a proxy server? Self-hosting I keep my forum’s server behind cloud flare due to a large amount of attacks against the site. The link previews and emails can leak the server’s backend IP Address. The email issue was resolved by setting up a SMTP relay that strips headers (if the user pulls email headers to get the IP, they get the relay and not the forum’s IP). Is there a way to make the link previews go through a proxy server?

Hiding the origin on cloudflare

Product Support

Falco (Falco) August 12, 2018, 1:01am 3

Topic		Replies	Views
How to protect a server's IP from being exposed? Self-hosting	3	1700	May 28, 2023
How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN? Product Support	10	734	September 15, 2024
Global setting to hide origin IP from everywhere - is it possible? Product Support	5	842	June 4, 2022
Mailgun leaking server's real IP behind Cloudflare Product Support	20	7294	May 16, 2019
Hide Origin IP in discourse Product Support	5	852	December 14, 2019