Question CloudFlare and Fail2ban

[MuddyMoe]

Server operating system version

AlmaLinux 9.4

Plesk version and microupdate number

Plesk Obsidian Version 18.0.62 #2

What is the best/most current approach to working with CloudFlare and Fail2Ban such that Fail2Ban doesn't ban CloudFlare IPs and Fail2Ban bans are passed on to CloudFlare?

Thank you!

 

[WebHostingAce]

You can configure to see the real IPs.

https://support.plesk.com/hc/en-us/articles/12377061126807-Incorrect-IP-addresses-are-logged-by-Plesk-behind-a-Cloudflare-or-Google-Cloud-Load-Balancing

 

[Bitpalast]

Technically, you can exclude Cloudflare IPs from Fail2Ban in the /etc/fail2ban/jail.local file. To exclude them, simply add them to the [DEFAULT] section's ignoreip directive. Example:

[DEFAULT]
ignoreip = 34.147.110.144/28 ... and so on ... 127.0.0.1/8 ::1

The subnets that Cloudflare uses, are listed here: IP Ranges

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

What I do recommend though is to exclude Google IP ranges from your server. Those can be found here: https://developers.google.com/search/apis/ipranges/googlebot.json

 

[MuddyMoe]

Technically, you can exclude Cloudflare IPs from Fail2Ban in the /etc/fail2ban/jail.local file. To exclude them, simply add them to the [DEFAULT] section's ignoreip directive. Example:

[DEFAULT]
ignoreip = 34.147.110.144/28 ... and so on ... 127.0.0.1/8 ::1

The subnets that Cloudflare uses, are listed here: IP Ranges

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

What I do recommend though is to exclude Google IP ranges from your server. Those can be found here: https://developers.google.com/search/apis/ipranges/googlebot.json

Thank you!! I have a follow up question. Does CloudFlare use Google IP ranges or do we have a separate set that we would need to exclude?

 

[Bitpalast]

Cloudflare does not use Google IP ranges, but Google does. If you want your website indexed in Google, do not block the Google IP ranges.

 

[designgroop]

But: I recommend to NOT to do this, because it will allow attackers to brute-force your server as they also come through Cloudflare for domains that have their DNS with Cloudflare. When you list a CF subnet in ignoreip, requests coming from that ip range will be excluded from F2B, so attackers will have all the time they need to break into your server.

It's worth noting that for many of us, Fail2Ban will end up blocking normal Cloudflare traffic and thus Fail2Ban is routinely deactivated. Therefore whitelisting Cloudflare IPs and reactivating Fail2Ban will actually increase protection, not decrease it.

Cloudflare is not typically an outbound service - unless users are using Zero Trust for general internet access, or possibly using applications. Using Cloudflare as DNS does not place Cloudflare between outbound requests from a server - so malicious traffic from a server where DNS is behind Cloudflare will use it's original IP (unless some other spoofing is taking place).