Once you start using Cloudflare as a CDN solution for your hosting, you are adding another firewall into the equation, albeit a very good one, but you may want to pass your servers local firewall fail2bans IP blocks over to Cloudflare and keep the two firewalls synchronised. This guide is using ServerPilot/fail2ban on a Vultr instance but similar hosting will be the same.
2 problems need to be overcome, the first is the transparency of Cloudflares IP addresses and the second is pushing the fail2ban IP bans on your server firewall over to the Cloudflare firewall.
Reveal True IP Addresses
Cloudflare wraps a visitors IP address in its own address, this can cause issues with the fail2ban IP rules as you may be blocking the wrong addresses, so the real IPs need to be revealed – this is referenced on the Cloudflare site, and has a number of solutions for different web serving apps.
ServerPilot uses nginx as a front end tool and have already made these changes in their nginx config. Check /etc/nginx-sp/nginx.conf
# CloudFlare proxy addresses.
# Do not modify this list. If you believe the CloudFlare proxy address list is
# out of date, please contact [email protected].
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;
real_ip_header X-Forwarded-For;
So that’s great – already done here, if you are not using ServerPilot look at the earlier referenced link for a solution.
Pushing fail2ban IP rules to Cloudflare
For every fail2ban jail client you set up, as in the one set up for wordpress-hard you can add an action when the fail2ban rule is triggered, there is a whole bunch of actions in /etc/fail2ban/action.d/ directory including a cloudflare.conf one, which synchronises your local firewall to the Cloudflare one.
However the one supplied on your webhost may be old and fail to work, but the latest one on github from fail2ban 0.11.2 works fine.
You just rename/backup the old cloudflare.conf and add in the new one above and add in your Cloudflare username/email and API key at the bottom where indicated on lines 81 & 83.
Then you reference the action in your jail.local file under the WordPress defined jail.
Now you will see your Cloudflare firewall updated with your ServerPilots fail2ban banned IP addresses and if you unban addressess they will also be sync’ed.
So if you unban an IP address at your server firewall (example below uses our wordpress_hard jail…
fail2ban-client set wordpress-hard unbanip 1.2.3.4
It will be sync’ed to Cloudflare so also removed there.
