Question CloudFlare and Fail2ban

[MuddyMoe]

Server operating system version

AlmaLinux 9.4

Plesk version and microupdate number

Plesk Obsidian Version 18.0.62 #2

What is the best/most current approach to working with CloudFlare and Fail2Ban such that Fail2Ban doesn't ban CloudFlare IPs and Fail2Ban bans are passed on to CloudFlare?

Thank you!

 

[WebHostingAce]

You can configure to see the real IPs.

https://support.plesk.com/hc/en-us/articles/12377061126807-Incorrect-IP-addresses-are-logged-by-Plesk-behind-a-Cloudflare-or-Google-Cloud-Load-Balancing

 

[Bitpalast]

Technically, you can exclude Cloudflare IPs from Fail2Ban in the /etc/fail2ban/jail.local file. To exclude them, simply add them to the [DEFAULT] section's ignoreip directive. Example:

[DEFAULT]
ignoreip = 34.147.110.144/28 ... and so on ... 127.0.0.1/8 ::1

The subnets that Cloudflare uses, are listed here: IP Ranges

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

What I do recommend though is to exclude Google IP ranges from your server. Those can be found here: https://developers.google.com/search/apis/ipranges/googlebot.json

 

[MuddyMoe]

Technically, you can exclude Cloudflare IPs from Fail2Ban in the /etc/fail2ban/jail.local file. To exclude them, simply add them to the [DEFAULT] section's ignoreip directive. Example:

[DEFAULT]
ignoreip = 34.147.110.144/28 ... and so on ... 127.0.0.1/8 ::1

The subnets that Cloudflare uses, are listed here: IP Ranges

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

What I do recommend though is to exclude Google IP ranges from your server. Those can be found here: https://developers.google.com/search/apis/ipranges/googlebot.json

Thank you!! I have a follow up question. Does CloudFlare use Google IP ranges or do we have a separate set that we would need to exclude?

 

[Bitpalast]

Cloudflare does not use Google IP ranges, but Google does. If you want your website indexed in Google, do not block the Google IP ranges.