IPTables and UFW problems

[pfaffman (Jay Pfaffman)]

The web template adds a redirect for the IP (and any connection), so you could un-do that bit.

Allowing Cloudflare IP addresses only in Nginx | inDev. Journal describes how to allow only cloudflare IPs. Figuring out how to get a template to do that is a bit of work for someone who understands the templates, but it should be possible.

@Genisis

if only allowing cf ip’s and im using the cf config to get real ip, would that mess it up? I

No. The real address is in another header.

@pfaffman

Docker does stuff that breaks IP tables. You should Google that, I think.

https://www.google.com/search?q=iptables+docker&oq=iptables+docker

and the first hit (Packet filtering and firewalls | Docker Docs) describes

Packet filtering and firewalls

By default, all external source IPs are allowed to connect to the Docker host. To allow only a specific IP or network to access the containers, insert a negated rule at the top of the DOCKER-USER filter chain. For example, the following rule restricts external access from all IP addresses except 192.168.1.1

So you’d need to change the cloudflare script accordingly.