My forum has CloudFlare and when inserting a URL from this service, I can get the real IP of my server, this is a big gift for DDoS attacks. I checked it on the Discourse Meta and this forum don’t have URL-filtration too. [1] [2] Blocked domain by IPlogger can’t help because the attacker can use a custom domain using the script for logger ip address. I think need use whitelist to filter domain who can use onebox. Example: if admin allow only url from Youtube, Twitter, Imgur, all other url will be blocked. Maybe Discourse have this setting? I can’t found :frowning: Update Setting blocked onebox domains and allowed inline onebox domains in this page /admin/site_settings/category/onebox not work. I create this rules: [3] Onebox show it: [4]

We don’t have a complete end-to-end guide on doing this, but here are other relevant topics: [image] Hiding the origin on cloudflare Support While researching Cloudflare and best practices to use to protect my server I ran into an article by Cloudflare about protecting the origin IP (the IP where the website is actually being ran from) because you would be able to circumvent all of Cloudflares ddos protection if you had it. What interested me was specifically this section: Never initiate an outbound connection based on user action If the attacker can get your web server to connect to an arbitrary address, they will reveal your … [image] Discourse Link previews through a proxy server? Self-hosting I keep my forum’s server behind cloud flare due to a large amount of attacks against the site. The link previews and emails can leak the server’s backend IP Address. The email issue was resolved by setting up a SMTP relay that strips headers (if the user pulls email headers to get the IP, they get the relay and not the forum’s IP). Is there a way to make the link previews go through a proxy server?

I think I found a solution with setting CSP. I managed to allow images only from my domain, need time for the dough and I will share the decision.

How to protect a server's IP from being exposed?

Product Support Self-hosting

kuydiyadri May 28, 2023, 6:45am 6

please share, i have change many time ip address coz the hacker get my ip from iplogger.

Reverse proxy for Discourse | Real IP masking

Topic		Replies	Views
Hiding the origin on cloudflare Product Support	2	1473	August 12, 2018
How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN? Product Support	10	756	September 15, 2024
How to stop Discourse from crawling/embedding links Self-hosting	4	262	May 15, 2024
Reverse proxy for Discourse \| Real IP masking Self-hosting	14	2229	August 19, 2023
Preventing DDoS on a Discourse instance? Product Support	9	2217	March 14, 2022

How to protect a server's IP from being exposed?

Related topics