My website uses Discourse. Initially, it wasn’t protected by Cloudflare and suffered a DDoS attack. Later, I changed the IP address and implemented Cloudflare. However, the website was attacked again by DDoS, seemingly due to a leak of the origin server’s IP. When using Cloudflare CDN, how can we …

You can prevent a lot of leaking by doing the following set up a proxy server like Tinyproxy on a different VPS set the environment variable HTTPS_PROXY and HTTP_PROXY so Discourse will use that (set them in the env section of your app.yml) set NO_PROXY='127.0.0.1, localhost, <internal-network>' S…

I don’t know but the IP of every servers online will be leaked out at the same time that is created.

[صورة] Richard - Communiteq: modify the firewall on your Discourse host to only allow incoming traffic from your Cloudflare This is the solution. Security by obscurity isn’t secure. Then it won’t matter if your ip is common knowledge.

[صورة] Richard - Communiteq: you can modify the firewall on your Discourse host to only allow incoming traffic from your Cloudflare IPs This or alternatively, a simpler approach would be to use what’s called a cloudflare tunnel. It should be a one-time setup and then you should be able to mos…

[صورة] Richard - Communiteq: Also, when you’re behind CF, you can modify the firewall on your Discourse host to only allow incoming traffic from your Cloudflare IPs (and the host you access it from yourself) I believe I went with this a while ago (without the proxy setup u mentioned). I’m not…

[صورة] MarcP: but in my case with ufw, it’s worth mentioning docker bypasses ufw by default so you need to make sure to apply the rules to your internal docker ip’s as well. You will want to use the firewall that your VPS provider provides for you. Using a host based firewall will be far less…

I think most large providers do offer DDOS protection by default? Shouldn’t this be sufficient? Adding CloudFlare IP’s manually through the interface seems like a hassle (my custom bash script takes 2 seconds and auto fetches the CF IP’s for example). Have to say I usually read the opposite, ufw/lo…

[صورة] MarcP: Adding CloudFlare IP’s manually through the interface seems like a hassle Most providers have an API for that nowadays? [صورة] MarcP: if the main IP is hidden correctly from the start, ddos shouldn’t be an issue right? Correct! But that’s a pretty big “if”…

Actually wrong. Just because the IP isn’t never hidden. Ddos isn’t an issue if a reverse proxy or similar has tools to stop it. And even then when there is real attack something more is needed than entry level solution. And if bots or slave users are knocking closed ports or IP-limited ports that is…

[صورة] Jakke Flemming: Just because the IP isn’t never hidden. It depends on your definition of hidden. Yes, all IP addresses are public. But then which of the 4 billion IP addresses is the correct one? I think, for this discussion, the IP can be considered hidden if there is no way to determ…

كيفية حل مشكلة تسرب عنوان IP المصدر وهجمات DDEven عند استخدام Cloudflare CDN

الدعم

pfaffman (Jay Pfaffman) 14 سبتمبر 2024، 9:59ص 4

هذا هو الحل. الأمان عن طريق الإخفاء ليس آمنًا. بعد ذلك لن يهم إذا كانت معلومات IP الخاصة بك معروفة للجميع.

الموضوع		الردود	مرات العرض
Preventing DDoS on a Discourse instance? Support	9	2192	14 مارس 2022
How to protect a server's IP from being exposed? Self-hosting	3	1685	28 مايو 2023
Hiding the origin on cloudflare Support	2	1447	12 أغسطس 2018
Mailgun leaking server's real IP behind Cloudflare Support	20	7244	16 مايو 2019
Query regarding adding Cloudflare Self-hosting	5	1039	5 مارس 2020

كيفية حل مشكلة تسرب عنوان IP المصدر وهجمات DDEven عند استخدام Cloudflare CDN

الموضوعات ذات الصلة