Protect the origin path

Every control from the previous lesson shares one assumption: traffic goes through Cloudflare. An attacker who finds your origin’s real address can connect to it directly and skip the WAF, the rate limits, and the DDoS protection entirely.

A proxied DNS record hides the origin address from ordinary lookups. It does not erase history.

How origin addresses leak

DNS history services archive the records your zone had before you enabled the proxy. Email records are another classic leak, because mail cannot go through the HTTP proxy:

dig +short mail.example.com A
# 198.51.100.23

If that mail server sits on the same machine as the website, the “hidden” origin is public. Other leaks: DNS-only subdomains like ftp.example.com, verbose error pages that print the server IP, and outbound requests from your server that reveal its address.

Make the origin reject direct traffic

Restrict the origin to expected Cloudflare traffic when the architecture permits it. Cloudflare publishes its IP ranges, so a firewall can allow only those:

curl -s https://www.cloudflare.com/ips-v4
# 173.245.48.0/20
# 103.21.244.0/22
# ...

Feed those ranges into your firewall’s allow list for ports 80 and 443, and refresh them on a schedule because the list can change.

IP filtering alone can be spoofed in some setups, so also authenticate the Cloudflare-to-origin connection. Authenticated Origin Pulls makes Cloudflare present a client certificate on the origin leg; your web server rejects any connection that lacks it. Then a direct request fails even from an address inside an allowed range.

Verify the bypass is closed

Test it the way an attacker would, by connecting straight to the origin IP:

curl -m 5 -o /dev/null -sw '%{http_code}\n' https://198.51.100.23 -H 'Host: example.com' -k
# 000  (connection refused or timed out — good)

A 200 here means the front door is decorative.

Two things remain. Patch the host: origin protection does not fix a vulnerable application. And keep a recovery path — document how you reach the machine for administration when the firewall drops everything that is not Cloudflare.

Now audit every DNS record in your practice zone, including MX and DNS-only entries, and document which addresses remain directly reachable and why.