Automatically allow Cloudflare IPs in UFW

cf-ufw.sh

#!/bin/bash
# simple script to fetch cloudflare IPs and allow them in UFW
# inspired by https://github.com/Paul-Reed/cloudflare-ufw

UFW="/usr/sbin/ufw"
DIR="$HOME/cf-ufw"

rm $DIR/ips.old
mv $DIR/ips $DIR/ips.old

curl -sw '\n' https://www.cloudflare.com/ips-v{4,6}/ > $DIR/ips

# print diff if changed, will be emailed by cron
git diff --no-index --no-renames $DIR/ips.old $DIR/ips

while read ip; do $UFW delete allow proto tcp from "$ip" to any port 80,443 comment 'Cloudflare' > /dev/null; done < $DIR/ips.old

while read ip; do $UFW allow proto tcp from "$ip" to any port 80,443 comment 'Cloudflare' > /dev/null; done < $DIR/ips

$UFW reload > /dev/null