• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • (Plesk for Windows):
    MySQL Connector/ODBC 3.51, 5.1, and 5.3 are no longer shipped with Plesk because they have reached end of life. MariaDB Connector/ODBC 64-bit 3.2.4 is now used instead.
  • Our UX team believes in the in the power of direct feedback and would like to invite you to participate in interviews, tests, and surveys.
    To stay in the loop and never miss an opportunity to share your thoughts, please subscribe to our UX research program. If you were previously part of the Plesk UX research program, please re-subscribe to continue receiving our invitations.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Question CloudFlare and Fail2ban

MuddyMoe

New Pleskian
Server operating system version
AlmaLinux 9.4
Plesk version and microupdate number
Plesk Obsidian Version 18.0.62 #2
What is the best/most current approach to working with CloudFlare and Fail2Ban such that Fail2Ban doesn't ban CloudFlare IPs and Fail2Ban bans are passed on to CloudFlare?

Thank you!
 
Technically, you can exclude Cloudflare IPs from Fail2Ban in the /etc/fail2ban/jail.local file. To exclude them, simply add them to the [DEFAULT] section's ignoreip directive. Example:
Code:
[DEFAULT]
ignoreip = 34.147.110.144/28 ... and so on ... 127.0.0.1/8 ::1
The subnets that Cloudflare uses, are listed here: IP Ranges

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

What I do recommend though is to exclude Google IP ranges from your server. Those can be found here: https://developers.google.com/search/apis/ipranges/googlebot.json
 
Technically, you can exclude Cloudflare IPs from Fail2Ban in the /etc/fail2ban/jail.local file. To exclude them, simply add them to the [DEFAULT] section's ignoreip directive. Example:
Code:
[DEFAULT]
ignoreip = 34.147.110.144/28 ... and so on ... 127.0.0.1/8 ::1
The subnets that Cloudflare uses, are listed here: IP Ranges

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

What I do recommend though is to exclude Google IP ranges from your server. Those can be found here: https://developers.google.com/search/apis/ipranges/googlebot.json
Thank you!! I have a follow up question. Does CloudFlare use Google IP ranges or do we have a separate set that we would need to exclude?
 
Cloudflare does not use Google IP ranges, but Google does. If you want your website indexed in Google, do not block the Google IP ranges.
 
But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.


It's worth noting that for many of us, Fail2Ban will end up blocking normal Cloudflare traffic and thus Fail2Ban is routinely deactivated. Therefore whitelisting Cloudflare IPs and reactivating Fail2Ban will actually increase protection, not decrease it.

Cloudflare is not typically an outbound service - unless users are using Zero Trust for general internet access, or possibly using applications. Using Cloudflare as DNS does not place Cloudflare between outbound requests from a server - so malicious traffic from a server where DNS is behind Cloudflare will use it's original IP (unless some other spoofing is taking place).
 
Back
Top