Skip to content

Instantly share code, notes, and snippets.

@stefanpejcic

stefanpejcic/whitelist_cloudflare.sh

Created January 23, 2024 22:17
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stefanpejcic/dc826efdc5429801a59ea03ec4c6d90a to your computer and use it in GitHub Desktop.
Save stefanpejcic/dc826efdc5429801a59ea03ec4c6d90a to your computer and use it in GitHub Desktop.
Download ZIP
UFW block 89 and 443, allow only access from Cloudflare proxy
Raw
whitelist_cloudflare.sh
#!/bin/bash
CLOUDFLARE_IPS_V4=$(/usr/bin/curl -s --max-time 10 https://www.cloudflare.com/ips-v4)
CLOUDFLARE_IPS_V6=$(/usr/bin/curl -s --max-time 10 https://www.cloudflare.com/ips-v6)
if [ -n "$CLOUDFLARE_IPS_V4" ] && [ -n "$CLOUDFLARE_IPS_V6" ]; then
/usr/sbin/ufw --force reset
/usr/sbin/ufw default allow incoming
/usr/sbin/ufw default allow outgoing
for IP in $CLOUDFLARE_IPS_V4; do
/usr/sbin/ufw allow from $IP to any port 80
/usr/sbin/ufw allow from $IP to any port 443
done
for IP in $CLOUDFLARE_IPS_V6; do
/usr/sbin/ufw allow from $IP to any port 80
/usr/sbin/ufw allow from $IP to any port 443
done
/usr/sbin/ufw deny 80/tcp
/usr/sbin/ufw deny 443/tcp
/usr/sbin/ufw --force enable
fi
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment