All of our servers, site and Discourse community (discussions.ftw.in) sit behind Cloudflare. Can we set at the Discourse server level to only allow Cloudflare IPs and deny all other IP traffic? We’ve been under a DDoS layer 7 attack and learned our main site IP was exposed. To fix this, we update…

This does not matter; once your IP is exposed it can be attacked and you must either Move to a new IP Get your upstream network provider to block the unwanted traffic (it is usually not https) After that you must be very careful to not expose your IP at any time.

[image] codinghorror: This does not matter; once your IP is exposed it can be attacked Layer 7 attacks can be blocked in nginx by blocking everything but CF. @Brock_Busby Here are some pointers, don’t know how to do it in Docker config though. Make sure you are using an email provider, oth…

This is perfect @michaeld . Thank you! And yes, we are on SparkPost. Hopefully after this change it will only expose the Cloudflare IP. [image] codinghorror: Move to a new IP Get your upstream network provider to block the unwanted traffic (it is usually not https) And correct. We will move …

Hey everyone, I am reading this thread and we need to know this information as well. We are running Discourse using the docker install on an Ubuntu server hosted on AWS. How would we whitelist Cloudflare IPs with this build? I just ssh’d in and did not see any obvious NGINX paths within the cont…

Look at how ./templates/cloudflare.template.yml downloads the IP list and constructs set_real_ip_from from that list. So you’d copy or modify that file to also generate allow directives, and add a deny all;.

Also not being familiar with nginx and yaml, I followed your instructions @riking and created a copy named ./templates/cloudflare.allowdeny.yml with the following code. Can you please verify this will do the job? Much appreciated. run: - file: path: /tmp/add-cloudflare-ips chmod: +x …

Well, you’re going to need the other rules too, so we might as well only download the list once. You missed replacing real_ip_header with deny all. Here’s a combined version: run: - file: path: /tmp/add-cloudflare-ips chmod: +x contents: | #!/bin/bash -e # Downlo…

This is great thanks @riking , but since you maintain cloudflare.template.yml I would not like to remove or mess with it, and let it download twice. …or does it download for every user or just when the container is built?

Nah, the file hasn’t changed in a while and I don’t think it will anytime soon. The primary priority here is to not break git pull, hence having a copy. Yes, it’s only when the container is built; but the fastest code is the code that doesn’t run. Why download twice when you can do it once.

Got it. You rock. We will test and report back!

Only allow Cloudflare IPs for Discourse server

Support Self-hosting

pain Septembre 22, 2017, 3:15 15

they probably got your ip by posting an ip logger
my post mentioned here where i had same problem https://meta.discourse.org/t/disable-discourse-from-crawling-links/69778

Sujet		Réponses	Vues
IPTables and UFW problems Self-hosting	10	412	Juin 20, 2024
Discourse shows server IP/localhost as user's IP Self-hosting unsupported-install	18	2407	Juillet 12, 2022
How to block an IP range? "Screened IPs" not being blocked Support	22	929	Décembre 5, 2025
Discourse with jwilder/nginx-proxy howtos? Self-hosting	11	8236	Avril 6, 2019
All users have the same IP (the Servers IP)? Self-hosting	13	4344	Juillet 28, 2018

Only allow Cloudflare IPs for Discourse server

Sujets connexes