I currently use Cloudflare for DNS, and they advertise that they will hide the IP address of my server if I proxy through them. Should I worry about this since the IP points to a dedicated server (not a home network or anything)?
Are there any security concerns or general risks associated with exposing a server's IP address?
-
1I'm not aware of any attacks that simply masking your IP address would prevent. The benefit of letting it go through their proxy is that they may have some firewall/filtering in place to protect you. Otherwise, if all they're doing is NATting your IP address, most attacks will simply get forwarded to your otherwise "hidden" IP address. Maybe someone here is more familiar with their proxy services.– TreborCommented Dec 10, 2020 at 0:52
-
1To add to @Trebor - yes, there are huge risks having your server IP address exposed, my web hosting business server is under continued attack. But if security is hardened properly it shouldn't be a problem. Your server IP has to be exposed at some level or nothing will be able to connect to it.– SteveCommented Dec 10, 2020 at 7:22
-
@trebor They Cloudflare is not natting your IP address. They proxy and accelerate it - is the web requests terminate on their servers and they on turn make a request to yours. They can monitor and modify traffic, including SSL certs and discern bad actors based on content.– davidgoCommented Dec 10, 2020 at 11:47
-
Cloudflare offers a DDoS protection service. If the attacker knows the address of your server then they can just bypass Cloudflare and attack your server directly, so Cloudflare won't help. That's why Cloudflare wants to hide your server's IP address.– user20574Commented Dec 10, 2020 at 16:14
Add a comment
|
1 Answer
"Are there any security concerns or general risks associated with exposing a server's IP address" - yes
A server can often run more then one service, including mistakenly exposing services that should not be exposed. Each of these exposed services poses a (possibly small, but not non-existent) security risk. By hiding your server you will frustrate exploits against these services.
Similarly, if you were, say, hit by a DDoS, which hits your server, Cloudflare can't protect your IP address, only the stuff that they proxy to you.
If you are using Cloudflare for these benefits you may be able to get most of the benefits by only allowing your and Cloudflare IPs to connect directly to your server.
