How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN?

Support
3

You can prevent a lot of leaking by doing the following

  • set up a proxy server like Tinyproxy on a different VPS
  • set the environment variable HTTPS_PROXY and HTTP_PROXY so Discourse will use that (set them in the env section of your app.yml)
  • set NO_PROXY='127.0.0.1, localhost, <internal-network>'

See also Install discourse with internet access only via proxy, Configuration outbound proxy and Discourse Link previews through a proxy server? - #14 by supermathie

Also, when you’re behind CF, you can modify the firewall on your Discourse host to only allow incoming traffic from your Cloudflare IPs (and the host you access it from yourself)

4 Likes