Question Prevent direct access with ip address

[seferdemirci]

Hi Plesk family,

I think this question concerns a lot of people with security concerns. We use various proxy services like Cloudflare or Amazon CloudFront to hide the real IP address of the server. However, some port control bots can scan various server IP addresses from the IP pools and opened ports and see which domains host on the IP addresses. (This can be done by SSL certificates pointing to which domains)

For instance, you can check your domain via this tool search.censys.io

So my point is; how can we prevent direct access to the server IP for all ports that are used by Plesk? (80, 443, 21, 3306 etc.)

Thanks

 

[Bitpalast]

As a server is always and only addressed by its IP address I wonder what alternative you are suggesting? The TCP/IP stack is based on IP addresses, not on domain names. If you cannot address a server by its address, you cannot address it at all.

 

[seferdemirci]

As a server is always and only addressed by its IP address I wonder what alternative you are suggesting? The TCP/IP stack is based on IP addresses, not on domain names. If you cannot address a server by its address, you cannot address it at all.

I found a solution, but it didn't make much sense. We can limit direct access to the server's IP address to the Cloudflare IP ranges located at this address. But these IP addresses can change in a while, and in my example, it is necessary to define many rules on AWS EC2 security groups according to these IP addresses.

What I was wondering is is it possible to configure this on the server-side or on Plesk? Is it possible to configure it to only accept traffic from Cloudflare IP ranges?

 

[seferdemirci]

As a server is always and only addressed by its IP address I wonder what alternative you are suggesting? The TCP/IP stack is based on IP addresses, not on domain names. If you cannot address a server by its address, you cannot address it at all.

By the way, I found a repository that can update AWS EC2 Security rules daily if you have cron it according to Cloudflare IP ranges. So right now, our server really hides behind the Cloudflare proxy servers.

For sure, my solution was based on AWS, but we are open to any suggestions. If you have any additional ideas that can do via Nginx or Plesk firewall, do not hesitate to contribute.

 

[seferdemirci]

By the way, I found a repository that can update AWS EC2 Security rules daily if you have cron it according to Cloudflare IP ranges. So right now, our server really hides behind the Cloudflare proxy servers.

For sure, my solution was based on AWS, but we are open to any suggestions. If you have any additional ideas that can do via Nginx or Plesk firewall, do not hesitate to contribute.

Repository here
GitHub - johnmccuk/cloudflare-ip-security-group-update: Lambda function to retrieve Cloudflare's IP address list and update the specified security group