How do I prevent attackers from discovering my real hosting IP (where I'm hosting my website) that is hidden behind CloudFlare Proxy?
-
1@StephenOstermiller I wonder if you inverted the meaning of the original post with your edit ? I can't see why the OP would be asking to expose their real IP through Cloudflare, but that seems to be the thrust of the original quiestion?– davidgoCommented Nov 20, 2020 at 4:38
-
@davidgo that's right!– TonyCommented Nov 20, 2020 at 9:10
-
I asked for clarifications and this is what they said they meant in the comments. I then deleted those comments once I edited them into the question. The comment was " I want to make sure that my server IP won't be ever exposed to potential attacker "– Stephen Ostermiller ♦Commented Nov 20, 2020 at 11:59
Add a comment
|
2 Answers
If Cloudflare Proxy is in use, you are pointing your DNS to Cloudflare, so this very action prevents people from seeing where you are hosting your website. So the only thing to do is to ensure there is nothing in your zone file which leaks this information through a related subdomain.
-
That's what I thought but I'm afraid there may be methods that will bypass this protection anyway– TonyCommented Nov 20, 2020 at 9:12
-
Its fairly robust protection. If someone could back your site through Cloudflare they might be able to force it to divulge its real address. Failing that it would be close to impossible. (3letter agencies can no doubt ask cloudflare, there might be some timing analysis attacks a privileged few network operators could do, but these are edge cases)– davidgoCommented Nov 20, 2020 at 9:39
-
1The origin server is still on the public internet. It could be discovered through other means such as scans that look at all IP addresses in a block. Are there firewall rules that could be used to protect it so that only Cloudflare can access it? Commented Nov 20, 2020 at 12:06
Like davidgo said once you change your domain's nameservers to Cloudflares' and activate the CDN your hosting IP will be covered. If you are still worried I recommended using Cloudflare Pro.
