如何保护服务器的 IP 免遭泄露？

[RedBear]

我的论坛启用了 CloudFlare，当插入来自该服务的一个 URL 时，我可以获取到服务器的真实 IP，这对 DDoS 攻击来说是一个巨大的隐患。

我在 Discourse Meta 上也检查过，该论坛也没有 URL 过滤功能。

IPlogger 阻止的域名无法提供帮助，因为攻击者可以使用自定义域名来记录 IP 地址。我认为需要使用白名单来过滤可以使用 onebox 的域名。

示例：如果管理员只允许来自 Youtube、Twitter、Imgur 的 URL，其他所有 URL 都将被阻止。

也许 Discourse 有这个设置？我找不到

更新
/admin/site_settings/category/onebox 页面上的 blocked onebox domains 和 allowed inline onebox domains 设置无效。

我创建了这些规则：

Onebox 显示如下：

[supermathie (Michael Brown)]

我们没有一个完整的端到端指南来完成此操作，但这里有其他相关主题：

Hiding the origin on cloudflare

While researching Cloudflare and best practices to use to protect my server I ran into an article by Cloudflare about protecting the origin IP (the IP where the website is actually being ran from) because you would be able to circumvent all of Cloudflares ddos protection if you had it. What interested me was specifically this section: Never initiate an outbound connection based on user action If the attacker can get your web server to connect to an arbitrary address, they will reveal your …

Discourse Link previews through a proxy server?

I keep my forum’s server behind cloud flare due to a large amount of attacks against the site. The link previews and emails can leak the server’s backend IP Address. The email issue was resolved by setting up a SMTP relay that strips headers (if the user pulls email headers to get the IP, they get the relay and not the forum’s IP). Is there a way to make the link previews go through a proxy server?

[RedBear]

我认为我找到了一个使用 CSP 的解决方案。我设法只允许来自我的域的图片，需要一些时间来消化，然后我会分享解决方案。

[kuydiyadri]

请分享，我多次更改IP地址，因为黑客通过iplogger获取了我的IP。