Skip to main content
Back to Category

Cloudflare Integration: DDoS Protection and CDN

Complete guide to Cloudflare setup, DNS configuration, WAF rules, Page Rules, Under Attack mode, and origin IP hiding to protect your server from DDoS attacks.

Read time: 15 min DDoS Protection & Security
cloudflareddoscdnwafdnssecuritypage-rules
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Cloudflare Integration: DDoS Protection and CDN

Cloudflare is a powerful platform that protects your website from DDoS attacks, provides a content delivery network (CDN), and improves performance. This guide covers integrating Cloudflare with your server, DNS configuration, creating WAF rules, and advanced protection features.

On REXE servers, Cloudflare integration can be used alongside Path Panel DDoS protection to provide multi-layered security.

Creating a Cloudflare Account and Adding a Site

To get started with Cloudflare, you need to create an account and add your site.

Account Creation

  1. Go to cloudflare.com
  2. Click the "Sign Up" button
  3. Register with your email and password
  4. Complete email verification

Adding a Site

  1. Click "Add a Site" on the Dashboard
  2. Enter your domain name (e.g., example.com)
  3. Select a plan (Free plan includes DDoS protection)
  4. Cloudflare automatically scans your existing DNS records

DNS Configuration

For Cloudflare to work, you need to point your domain's nameservers to Cloudflare.

Nameserver Change

Cloudflare provides two nameserver addresses:

ns1.cloudflare.com
ns2.cloudflare.com

Update these addresses from your domain registrar's panel.

DNS Record Management

Manage your records in the Cloudflare DNS panel:

Type   Name           Content             Proxy
A      example.com    185.x.x.x          Proxied (orange cloud)
A      www            185.x.x.x          Proxied
A      api            185.x.x.x          Proxied
MX     example.com    mail.example.com    DNS only (gray cloud)
TXT    example.com    v=spf1 ...         DNS only

Keep email records like MX, SPF, and DKIM in "DNS only" (gray cloud) mode. Email services won't work in proxy mode.

Proxy Status (Orange/Gray Cloud)

StatusDescription
Proxied (Orange)Traffic passes through Cloudflare, DDoS protection active
DNS Only (Gray)DNS resolution only, no protection
hljs bash
# DNS resolution check
dig +short example.com
# If Cloudflare proxy is active, Cloudflare IPs will appear

# Real IP check
curl -s https://www.cloudflare.com/ips-v4

Origin IP Hiding

One of Cloudflare's most important advantages is hiding your server's real IP address. However, you need to watch out for certain leak points.

IP Leak Points and Solutions

hljs bash
# 1. IP leak from mail server headers
# Solution: Use a different IP/server for email

# 2. Old DNS records (SecurityTrails, Shodan)
# Solution: Change IP after Cloudflare setup

# 3. Direct IP access
# Solution: Only allow traffic from Cloudflare IPs on the server

Cloudflare IP Restriction on Server

hljs bash
# Allow only Cloudflare IPs with iptables
#!/bin/bash

# Cloudflare IPv4 ranges
CF_IPS=$(curl -s https://www.cloudflare.com/ips-v4)

# Clear existing HTTP/HTTPS rules
iptables -D INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null
iptables -D INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null

# Allow only Cloudflare IPs
for ip in $CF_IPS; do
    iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT
    iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT
done

# Block other HTTP/HTTPS traffic
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

echo "Cloudflare IP restriction applied."

Getting Real IP with Nginx

When using Cloudflare proxy, your server sees all requests as coming from Cloudflare IPs. To get the real visitor IP:

hljs nginx
# /etc/nginx/conf.d/cloudflare.conf

# Cloudflare IPv4
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

real_ip_header CF-Connecting-IP;
hljs bash
# Test and reload Nginx configuration
sudo nginx -t
sudo systemctl reload nginx

WAF (Web Application Firewall) Rules

Cloudflare WAF protects your web application from SQL injection, XSS, and other attacks.

Managed Rules

From Cloudflare Dashboard > Security > WAF:

  1. Cloudflare Managed Ruleset: Contains OWASP rules
  2. Cloudflare OWASP Core Ruleset: SQL injection, XSS protection
  3. Cloudflare Leaked Credentials Check: Leaked credential checking

Custom WAF Rules

# Block traffic from specific countries
(ip.geoip.country eq "XX") -> Block

# Block specific User-Agents
(http.user_agent contains "BadBot") -> Block

# Allow wp-admin access only from specific IP
(http.request.uri.path contains "/wp-admin" and not ip.src eq 1.2.3.4) -> Block

# Rate limiting: More than 100 requests per minute
(http.request.uri.path eq "/api/*") -> Rate Limit (100 req/min)

Page Rules Configuration

Page Rules allow you to define custom behaviors for specific URL patterns.

Common Page Rules

# 1. Always use HTTPS
URL: http://*example.com/*
Setting: Always Use HTTPS

# 2. Disable cache for API
URL: *example.com/api/*
Setting: Cache Level = Bypass

# 3. Aggressive cache for static files
URL: *example.com/static/*
Setting: Cache Level = Cache Everything
         Edge Cache TTL = 1 month

# 4. Increase security for admin panel
URL: *example.com/admin/*
Setting: Security Level = High
         Browser Integrity Check = On

Under Attack Mode

Enable Under Attack mode during an active DDoS attack.

Manual Activation

  1. Log in to Cloudflare Dashboard
  2. Select "Under Attack Mode" from the top menu
  3. Or: Security > Settings > Security Level > I'm Under Attack!

Activation via API

hljs bash
# Enable Under Attack mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"under_attack"}'

# Return to normal mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"medium"}'

SSL/TLS Configuration

SSL/TLS configuration through Cloudflare:

# Dashboard > SSL/TLS > Overview

Encryption Mode:
- Off: No SSL (not recommended)
- Flexible: SSL between Cloudflare and visitor (origin HTTP)
- Full: Self-signed certificate on origin
- Full (Strict): Valid certificate on origin (recommended)

Cloudflare API Usage

You can automate with the Cloudflare API:

hljs bash
# Get zone information
curl -s "https://api.cloudflare.com/client/v4/zones" \
  -H "Authorization: Bearer API_TOKEN" | jq '.result[] | {name, id}'

# List DNS records
curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
  -H "Authorization: Bearer API_TOKEN" | jq '.result[] | {name, type, content}'

# Purge cache
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"purge_everything":true}'

REXE + Cloudflare Best Practices

  1. Dual-layer protection: Path Panel + Cloudflare WAF
  2. Origin IP hiding: Cloudflare proxy + iptables restriction
  3. SSL Full Strict: End-to-end encryption with origin certificate
  4. Rate Limiting: Request limiting for API endpoints
  5. Bot Management: Filter malicious bots
  6. Cache optimization: CDN cache for static content

Troubleshooting

hljs bash
# Cloudflare connection check
curl -sI https://example.com | grep -i 'cf-ray\|server\|cf-cache'

# DNS propagation check
dig +trace example.com

# SSL certificate check
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -dates

# Cloudflare error codes
# 520: Web server returns unknown error
# 521: Web server is down
# 522: Connection timed out
# 523: Origin unreachable
# 524: Timeout occurred

Conclusion

Cloudflare integration provides a powerful DDoS protection layer, CDN performance, and WAF security for your REXE server. By properly configuring DNS, origin IP hiding, and WAF rules, you can comprehensively protect your server.

Frequently Asked Questions

Does the Cloudflare Free plan provide DDoS protection?

Yes, the Cloudflare Free plan offers unlimited DDoS protection. It provides automatic protection against Layer 3, 4, and 7 attacks. Pro and Business plans offer additional WAF rules and advanced analytics.

Can my origin IP leak while using Cloudflare?

Yes, it can leak through email headers, old DNS records (services like SecurityTrails), direct IP access, and subdomains. It's recommended to change IP after Cloudflare setup, use a separate server for email, and apply iptables Cloudflare IP restrictions.

When should Under Attack mode be used?

Enable Under Attack mode when you detect an active DDoS attack. This mode applies a JavaScript challenge to all visitors and filters bot traffic. Remember to return to normal mode after the attack ends, otherwise legitimate users will experience delays.

Which Cloudflare SSL mode should I choose?

Full (Strict) mode is recommended. This mode applies SSL encryption between Cloudflare and the visitor, and between Cloudflare and the origin server. You need to install a Cloudflare Origin CA certificate on your origin server.

Can Cloudflare be used together with Path Panel?

Yes, Cloudflare and Path Panel can be used together for dual-layer protection. Cloudflare provides Layer 7 (HTTP/HTTPS) protection and CDN, while Path Panel performs network-level (Layer 3/4) filtering. This combination offers the most comprehensive protection.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps