Cloudflare

For instructions for how to enable Cloudflare support in Juggernaut Firewall visit here

As Cloudflare is a reverse proxy, any attacking IP addresses (so far as iptables is concerned) come from the Cloudflare IP's. To counter this, an Apache module mod_cloudflare is available that obtains the true attackers IP from a custom HTTP header record (similar functionality is available for other HTTP daemons.

However, despite now knowing the true attacking IP address, iptables cannot be used to block that IP as the traffic is still coming from the Cloudflare servers.

To work around this, Cloudflare have provided a Firewall feature within the user account where rules can be added to block, challenge or whitelist IP addresses. Using the Cloudflare API, this feature adds and removes attacking IPs from that firewall and provides CLI (and via the UI) additional commands.

Restrictions when using the Cloudflare Firewall

  1. All lfd blocks will be temporary blocks so that csf/lfd can keep blocks in sync with Cloudflare.
  2. Automatic blocks via lfd are limited to LF_MODSEC as only through these can the domain name be determined. Any users that own domains that are involved in the trigger will get a block in their Cloudflare Firewall. Additionally, any users with the special case "any" will also get blocks.
  3. The temporary/permanent config of the lfd settings are ignored and CF_TEMP is used instead.
  4. LF_TRIGGER must not be used, the feature will not work with it enabled.
  5. mod_cloudflare or similar must be used to report real IP in the Apache logs.
  6. URLGET must be set to 2 (i.e. LWP) must be used.
  7. If PERMBLOCK is used, the last tempblock will remain and never be cleared. So any Cloudflare Firewall entries must be manually cleared in Cloudflare or via CLI.
  8. There are restrictions imposed by Cloudflare to the number of rules that can be created depending on the type of account used. See https://support.cloudflare.com/hc/en-us/articles/200434798-How-many-IPs-can-I-add-to-rules-in-the-IP-Firewall- for more information
  9. When restarting csf, any old temporary blocks will still be created for lfd to clear when it restarts.
  10. All interaction with Cloudflare is at User-level, not Zone-level.

CF_TEMP should be configured taking into account the maximum number of rules that the Cloudflare account allows: https://support.cloudflare.com/hc/en-us/articles/200434798-How-many-IPs-can-I-add-to-rules-in-the-IP-Firewall-

All Cloudflare users for the domains that are involved in LF_MODSEC will have a Cloudflare rule added. Any Cloudflare accounts configured to use the special case "any" field value in /etc/csf/csf.cloudflare will have a Cloudflare rule added regardless of domain.