Cloudflare Integration: DDoS Protection and CDN

Cloudflare is a powerful platform that protects your website from DDoS attacks, provides a content delivery network (CDN), and improves performance. This guide covers integrating Cloudflare with your server, DNS configuration, creating WAF rules, and advanced protection features.

On REXE servers, Cloudflare integration can be used alongside Path Panel DDoS protection to provide multi-layered security.

Creating a Cloudflare Account and Adding a Site

To get started with Cloudflare, you need to create an account and add your site.

Account Creation

Go to cloudflare.com
Click the "Sign Up" button
Register with your email and password
Complete email verification

Adding a Site

Click "Add a Site" on the Dashboard
Enter your domain name (e.g., example.com)
Select a plan (Free plan includes DDoS protection)
Cloudflare automatically scans your existing DNS records

DNS Configuration

For Cloudflare to work, you need to point your domain's nameservers to Cloudflare.

Nameserver Change

Cloudflare provides two nameserver addresses:

ns1.cloudflare.com
ns2.cloudflare.com

Update these addresses from your domain registrar's panel.

DNS Record Management

Manage your records in the Cloudflare DNS panel:

Type   Name           Content             Proxy
A      example.com    185.x.x.x          Proxied (orange cloud)
A      www            185.x.x.x          Proxied
A      api            185.x.x.x          Proxied
MX     example.com    mail.example.com    DNS only (gray cloud)
TXT    example.com    v=spf1 ...         DNS only

Keep email records like MX, SPF, and DKIM in "DNS only" (gray cloud) mode. Email services won't work in proxy mode.

Proxy Status (Orange/Gray Cloud)

Status	Description
Proxied (Orange)	Traffic passes through Cloudflare, DDoS protection active
DNS Only (Gray)	DNS resolution only, no protection

hljs bash

# DNS resolution check
dig +short example.com
# If Cloudflare proxy is active, Cloudflare IPs will appear

# Real IP check
curl -s https://www.cloudflare.com/ips-v4

Origin IP Hiding

One of Cloudflare's most important advantages is hiding your server's real IP address. However, you need to watch out for certain leak points.

IP Leak Points and Solutions

hljs bash

# 1. IP leak from mail server headers
# Solution: Use a different IP/server for email

# 2. Old DNS records (SecurityTrails, Shodan)
# Solution: Change IP after Cloudflare setup

# 3. Direct IP access
# Solution: Only allow traffic from Cloudflare IPs on the server

Cloudflare IP Restriction on Server

hljs bash

# Allow only Cloudflare IPs with iptables
#!/bin/bash

# Cloudflare IPv4 ranges
CF_IPS=$(curl -s https://www.cloudflare.com/ips-v4)

# Clear existing HTTP/HTTPS rules
iptables -D INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null
iptables -D INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null

# Allow only Cloudflare IPs
for ip in $CF_IPS; do
    iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT
    iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT
done

# Block other HTTP/HTTPS traffic
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

echo "Cloudflare IP restriction applied."

Getting Real IP with Nginx

When using Cloudflare proxy, your server sees all requests as coming from Cloudflare IPs. To get the real visitor IP:

hljs nginx

# /etc/nginx/conf.d/cloudflare.conf

# Cloudflare IPv4
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

real_ip_header CF-Connecting-IP;

hljs bash

# Test and reload Nginx configuration
sudo nginx -t
sudo systemctl reload nginx

WAF (Web Application Firewall) Rules

Cloudflare WAF protects your web application from SQL injection, XSS, and other attacks.

Managed Rules

From Cloudflare Dashboard > Security > WAF:

Cloudflare Managed Ruleset: Contains OWASP rules
Cloudflare OWASP Core Ruleset: SQL injection, XSS protection
Cloudflare Leaked Credentials Check: Leaked credential checking

Custom WAF Rules

# Block traffic from specific countries
(ip.geoip.country eq "XX") -> Block

# Block specific User-Agents
(http.user_agent contains "BadBot") -> Block

# Allow wp-admin access only from specific IP
(http.request.uri.path contains "/wp-admin" and not ip.src eq 1.2.3.4) -> Block

# Rate limiting: More than 100 requests per minute
(http.request.uri.path eq "/api/*") -> Rate Limit (100 req/min)

Page Rules Configuration

Page Rules allow you to define custom behaviors for specific URL patterns.

Common Page Rules

# 1. Always use HTTPS
URL: http://*example.com/*
Setting: Always Use HTTPS

# 2. Disable cache for API
URL: *example.com/api/*
Setting: Cache Level = Bypass

# 3. Aggressive cache for static files
URL: *example.com/static/*
Setting: Cache Level = Cache Everything
         Edge Cache TTL = 1 month

# 4. Increase security for admin panel
URL: *example.com/admin/*
Setting: Security Level = High
         Browser Integrity Check = On

Under Attack Mode

Enable Under Attack mode during an active DDoS attack.

Manual Activation

Log in to Cloudflare Dashboard
Select "Under Attack Mode" from the top menu
Or: Security > Settings > Security Level > I'm Under Attack!

Activation via API

hljs bash

# Enable Under Attack mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"under_attack"}'

# Return to normal mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"medium"}'

SSL/TLS Configuration

SSL/TLS configuration through Cloudflare:

# Dashboard > SSL/TLS > Overview

Encryption Mode:
- Off: No SSL (not recommended)
- Flexible: SSL between Cloudflare and visitor (origin HTTP)
- Full: Self-signed certificate on origin
- Full (Strict): Valid certificate on origin (recommended)

Cloudflare API Usage

You can automate with the Cloudflare API:

hljs bash

# Get zone information
curl -s "https://api.cloudflare.com/client/v4/zones" \
  -H "Authorization: Bearer API_TOKEN" | jq '.result[] | {name, id}'

# List DNS records
curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
  -H "Authorization: Bearer API_TOKEN" | jq '.result[] | {name, type, content}'

# Purge cache
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"purge_everything":true}'

REXE + Cloudflare Best Practices

Dual-layer protection: Path Panel + Cloudflare WAF
Origin IP hiding: Cloudflare proxy + iptables restriction
SSL Full Strict: End-to-end encryption with origin certificate
Rate Limiting: Request limiting for API endpoints
Bot Management: Filter malicious bots
Cache optimization: CDN cache for static content

Troubleshooting

hljs bash

# Cloudflare connection check
curl -sI https://example.com | grep -i 'cf-ray\|server\|cf-cache'

# DNS propagation check
dig +trace example.com

# SSL certificate check
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -dates

# Cloudflare error codes
# 520: Web server returns unknown error
# 521: Web server is down
# 522: Connection timed out
# 523: Origin unreachable
# 524: Timeout occurred

Conclusion

Cloudflare integration provides a powerful DDoS protection layer, CDN performance, and WAF security for your REXE server. By properly configuring DNS, origin IP hiding, and WAF rules, you can comprehensively protect your server.

Cloudflare Integration: DDoS Protection and CDN

Table of Contents