{"id":2895,"date":"2019-10-23T16:15:45","date_gmt":"2019-10-23T08:15:45","guid":{"rendered":"https:\/\/www.mondoze.com\/guide\/?post_type=kb&#038;p=2895"},"modified":"2022-10-05T08:00:43","modified_gmt":"2022-10-05T00:00:43","slug":"how-do-i-whitelist-cloudflares-ip-addresses-in-iptables","status":"publish","type":"kb","link":"https:\/\/www.mondoze.com\/guide\/kb\/how-do-i-whitelist-cloudflares-ip-addresses-in-iptables","title":{"rendered":"How do I whitelist Cloudflare&#8217;s IP addresses in iptables?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2895\" class=\"elementor elementor-2895\" data-elementor-settings=\"[]\">\n\t\t\t\t\t\t<div class=\"elementor-inner\">\n\t\t\t\t\t\t\t<div class=\"elementor-section-wrap\">\n\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-167e7de2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"167e7de2\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t\t\t<div class=\"elementor-row\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-76d2dd6c\" data-id=\"76d2dd6c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-column-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3fc99ac elementor-widget elementor-widget-heading\" data-id=\"3fc99ac\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How do I whitelist Cloudflare's IP address?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-abcb145 elementor-widget elementor-widget-text-editor\" data-id=\"abcb145\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-text-editor elementor-clearfix\">\n\t\t\t\t<p>Cloudflare&#8217;s IP ranges can be add to iptables using the following steps below. This should be done to ensure none of our connections will be drop, which could otherwise result in timeouts and other <strong>connectivity issues<\/strong>.\u00a0<\/p><p><strong>IPv4:\u00a0<\/strong>For each of the ranges listed here:\u00a0https:\/\/www.cloudflare.com\/ips-v4\u00a0, you&#8217;ll need to enter the following command at the terminal, replacing $ip with one of the\u00a0IPs in the list:<br \/><code>iptables -I INPUT -p tcp -m multiport --dports http,https -s \"$ip\" -j ACCEPT<\/code><\/p><p><strong>IPv6:<\/strong>\u00a0For each of the ranges listed here:\u00a0https:\/\/www.cloudflare.com\/ips-v6\u00a0, you&#8217;ll need to enter the following command at the terminal, replacing $ip with one of the IPs in the list:<br \/><code>ip6tables -I INPUT -p tcp -m multiport --dports http,https -s \"$ip\" -j ACCEPT<\/code><\/p><p>An alternative to having a long list of iptables rules for each network range is to use a utility called ipset. If you don&#8217;t have this installed on your origin server, you can install it using your package manager.<\/p><p><strong>Debian:\u00a0<\/strong>sudo apt-get install ipset<\/p><p>Create an ipset set:<br \/>ipset create cf hash:net<\/p><p>Now populate the set with Cloudflare IP ranges:<br \/>for x in $(curl\u00a0https:\/\/www.cloudflare.com\/ips-v4); do ipset add cf $x; done<\/p><p><strong>Note:\u00a0<\/strong>The ipset you have create is store in memory and will be gone after reboot by default. Remember to save it and\/or restore it after reboot.<\/p><p>You can use the &#8216;cf&#8217; set now in a iptables rule like so:<br \/>iptables -A INPUT -m set &#8211;match-set cf src -p tcp -m multiport &#8211;dports http,https -j ACCEPT<\/p><p>Once you run the iptables commands, you will need to save the iptables rules. The top two commands are use for IPv4 and the bottom two for IPv6.<\/p><p><strong>Debian\/Ubuntu:<\/strong>\u00a0<code>iptables-save &gt; \/etc\/iptables\/rules.v4<\/code><br \/><strong>RHEL\/CentOS:<\/strong>\u00a0<code>iptables-save &gt; \/etc\/sysconfig\/iptables<\/code><br \/><strong>Debian\/Ubuntu:<\/strong>\u00a0<code>ip6tables-save &gt; \/etc\/iptables\/rules.v6<\/code><br \/><strong>RHEL\/CentOS:<\/strong>\u00a0<code>ip6tables-save &gt; \/etc\/sysconfig\/ip6tables<\/code><\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>How do I whitelist Cloudflare&#8217;s IP address? Cloudflare&#8217;s IP ranges can be add to iptables using the following steps below. This should be done to ensure none of our connections will be drop, which could otherwise result in timeouts and other connectivity issues.\u00a0 IPv4:\u00a0For each of the ranges listed here:\u00a0https:\/\/www.cloudflare.com\/ips-v4\u00a0, you&#8217;ll need to enter the &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"https:\/\/www.mondoze.com\/guide\/kb\/how-do-i-whitelist-cloudflares-ip-addresses-in-iptables\"> <span class=\"screen-reader-text\">How do I whitelist Cloudflare&#8217;s IP addresses in iptables?<\/span> Read More \u00bb<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}}},"kbtopic":[53],"kbtag":[110],"mkb_version":[],"_links":{"self":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb\/2895"}],"collection":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/comments?post=2895"}],"version-history":[{"count":9,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb\/2895\/revisions"}],"predecessor-version":[{"id":18984,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb\/2895\/revisions\/18984"}],"wp:attachment":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/media?parent=2895"}],"wp:term":[{"taxonomy":"kbtopic","embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kbtopic?post=2895"},{"taxonomy":"kbtag","embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kbtag?post=2895"},{"taxonomy":"mkb_version","embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/mkb_version?post=2895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}