A script to generate a config to allow or additionally allow cloudflare addresses for a specific domain

generate-nginx-cloudflare-allow.sh

#!/bin/bash

set -e

cf_ips() {
  echo "# https://www.cloudflare.com/ips"

  for type in v4 v6; do
    echo "# IP$type"
    curl -sL "https://www.cloudflare.com/ips-$type/" | sed "s|^|allow |g" | sed "s|\$|;|g"
    echo
  done

  echo "# Generated at $(LC_ALL=C date)"
}

cf_ips > allow-cloudflare.conf
(cf_ips && echo "deny all; # deny all remaining ips") > allow-cloudflare-only.conf

thanks @zhil - this probably saved a future me a good bit of troubleshooting

@poldim how did you resolve the issue with blocking the proxied (X-Forwarded-For) IPs vs real IPs?

@poldim how did you resolve the issue with blocking the proxied (X-Forwarded-For) IPs vs real IPs?

On each server block, I check if the IP is coming from a known list of CF IPs and non CF IPs get 403s: if ($cloudflare_ip != 1) { return 403; }

Thank you @poldim. Sorry if this is a dumb question, but how do you populate $cloudflare_ip? would you be able to share a snippet?

Take a look at this: ergin/nginx-cloudflare-real-ip#3