Creates or updates a firewall on DigitalOcean based on CloudFlare's current list of IPs.

digitalocean-cloudflare-firewall.sh

#!/bin/bash

FIREWALL_NAME="cloudflare"
# for new use: POST /v2/firewalls
# for update use: PUT /v2/firewalls/$FIREWALL_ID
API_URL="https://api.digitalocean.com/v2/firewalls"
API_METHOD="POST"
API_TOKEN=""

ips=`curl https://www.cloudflare.com/ips-v4`

print_cfips() {
    local passedFirst=0

    for ip in $ips
    do
        if [ "$passedFirst" == "0" ]
        then
            passedFirst=1
        else
            json+=", "
        fi
        json+="\"$ip\""
    done
}

# print a member of inbound_rules
print_inbound() {
    json+="{\"protocol\": \"tcp\", \"ports\": $1, \"sources\": { \"addresses\": ["
    print_cfips
    json+="]}}"
}

create_firewall() {
    json="{\"name\": \"$FIREWALL_NAME\", \"inbound_rules\": ["

    print_inbound 80
    json+=", "
    print_inbound 443
    json+="], \"outbound_rules\": [], \"droplet_ids\": null, \"tags\": null}"
}

create_firewall

curl -X POST "https://api.digitalocean.com/v2/firewalls" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $API_TOKEN" \
    --data "$json"