Security foundations
Protect the origin path
Prevent attackers from bypassing Cloudflare by restricting origin reachability and removing leaked addresses.
Every control from the previous lesson shares one assumption: traffic goes through Cloudflare. An attacker who finds your origin’s real address can connect to it directly and skip the WAF, the rate limits, and the DDoS protection entirely.
A proxied DNS record hides the origin address from ordinary lookups. It does not erase history.
How origin addresses leak
DNS history services archive the records your zone had before you turned on the proxy. Email records are another classic leak, because mail can’t go through the HTTP proxy:
dig +short mail.example.com A
# 198.51.100.23If that mail server runs on the same machine as the website, the “hidden” origin is public. Other leaks: DNS-only subdomains like ftp.example.com, verbose error pages that print the server IP, and outbound requests from your server that reveal where they came from.
Make the origin reject direct traffic
Restrict the origin to Cloudflare traffic when your architecture allows it. Cloudflare publishes its IP ranges, so a firewall can allow only those:
curl -s https://www.cloudflare.com/ips-v4
# 173.245.48.0/20
# 103.21.244.0/22
# ...Feed those ranges into your firewall’s allow list for ports 80 and 443. Refresh them on a schedule, because the list can change.
IP filtering alone can be spoofed in some setups, so also authenticate the Cloudflare-to-origin connection. With Authenticated Origin Pulls, Cloudflare presents a client certificate on the origin leg, and your web server rejects any connection that lacks it. Then a direct request fails even from an address inside an allowed range.
Verify the bypass is closed
Test it the way an attacker would, by connecting straight to the origin IP:
curl -m 5 -o /dev/null -sw '%{http_code}\n' https://198.51.100.23 -H 'Host: example.com' -k
# 000000 means the connection was refused or timed out. That’s what you want. A 200 here means the front door is decorative.
Two things remain. Patch the host, because origin protection does not fix a vulnerable application. And keep a recovery path. Write down how you reach the machine for administration when the firewall drops everything that isn’t Cloudflare.
Try this: audit every DNS record in your practice zone, including MX and DNS-only entries. Note which addresses remain directly reachable and why.
Lesson completed