How to Lock Down Your VPS or Dedicated Server Behind Cloudflare

Cloudflare can only filter the traffic that actually passes through it. If an attacker learns your server's real IP address, they can connect to it directly and skip every WAF rule, challenge, and DDoS protection you have set up. On a VPS or dedicated server you control the firewall, so you can close that gap and force all web traffic through Cloudflare. This guide covers the three ways to do it: a firewall allowlist, Authenticated Origin Pulls, and Cloudflare Tunnel.

01. Why Your Origin IP Is the Real Weak Point

When you put a site behind Cloudflare, visitors connect to Cloudflare's network, and Cloudflare connects back to your server, which is called the origin. All your protection lives on that first hop. The second hop, Cloudflare to your origin, is a normal connection to your server's real IP address. If an attacker can make that second connection themselves, they are talking straight to your server and Cloudflare never sees it.

Finding an origin IP is easier than most people expect. Common leaks include:

• DNS history. The IP your domain used before you added Cloudflare is recorded in historical DNS databases forever.
• Other DNS records. A mail, ftp, cpanel, or direct subdomain pointing at the server with the grey cloud exposes the IP even while the main site is proxied.
• Certificate transparency logs. Public logs of every SSL certificate ever issued often tie a hostname straight to an origin.
• Email headers. Mail sent from the server stamps its IP into the message headers.

Assume your origin IP is already known. Attackers routinely scan for WordPress sites whose IP answers directly and then brute force the login or hammer the server while completely ignoring Cloudflare. Locking the origin is what turns your Cloudflare rules from a suggestion into a wall.

02. Three Ways to Lock It Down

There are three practical approaches. They are not mutually exclusive, and the strongest setups combine the firewall allowlist with one of the other two.

If you are not sure, start with Method 1. It gives you most of the benefit in a few minutes, and you can layer Method 2 or move to Method 3 later.

03. Method 1: Allow Web Traffic Only From Cloudflare

The idea is simple: accept connections on ports 80 and 443 only from Cloudflare's IP ranges, and drop everyone else. Cloudflare publishes its ranges at https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6.

Here is a portable example using ipset and iptables. It builds a set of Cloudflare's IPv4 ranges, allows web ports from that set, and drops web traffic from anywhere else:

ipset create cf-v4 hash:net
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    ipset add cf-v4 "$ip"
done

iptables -A INPUT -p tcp -m multiport --dports 80,443 -m set --match-set cf-v4 src -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP

Save the rules so they survive a reboot (for example with netfilter-persistent or your distribution's firewall service), and repeat the same pattern for IPv6 if your server answers on it.

04. Method 2: Authenticated Origin Pulls

A firewall allowlist trusts any request coming from a Cloudflare IP. Authenticated Origin Pulls (AOP) go further: Cloudflare presents a client certificate when it connects to your origin, and your web server refuses any connection that does not present that certificate. Because only Cloudflare holds the certificate, this proves the request genuinely came through your Cloudflare account, not just from somewhere on Cloudflare's network.

Turn it on in two places:

1. In Cloudflare, open SSL/TLS > Origin Server > Authenticated Origin Pulls and enable it for the zone.
2. On your server, download Cloudflare's origin pull CA certificate (Cloudflare documents the current download location), then tell your web server to require and verify it.

For nginx, inside the HTTPS server block:

ssl_client_certificate /etc/nginx/certs/cloudflare_origin_pull_ca.pem;
ssl_verify_client on;

For Apache, inside the HTTPS virtual host:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /etc/apache2/certs/cloudflare_origin_pull_ca.pem

After reloading the web server, a request that arrives without Cloudflare's certificate is rejected during the TLS handshake, so a direct hit to your IP fails even if it somehow came from a Cloudflare address.

05. Method 3: Cloudflare Tunnel

Cloudflare Tunnel takes a different approach: instead of Cloudflare connecting in to your server, a small program on your server (cloudflared) makes an outbound connection to Cloudflare and holds it open. Traffic rides back down that connection. Because nothing connects in, you can close every inbound web port at the firewall. There is no origin IP to find, because the server never accepts an inbound web connection at all.

The basic setup, after installing cloudflared and logging in:

cloudflared tunnel login
cloudflared tunnel create my-site
cloudflared tunnel route dns my-site www.example.com

Then a small config file maps the hostname to your local web server:

tunnel: my-site
credentials-file: /root/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: www.example.com
    service: http://localhost:80
  - service: http_status:404

Run it as a system service (cloudflared service install) so it starts on boot. Once traffic is flowing through the tunnel, you can drop inbound 80 and 443 entirely at the firewall and leave only your management ports (locked to your own IP).

06. Do Not Forget SSH, Mail, and a Leaked IP

Locking ports 80 and 443 to Cloudflare does nothing for your other services. Cloudflare's web proxy does not carry SSH, mail, FTP, or control panel traffic, so those ports are still open to the whole internet on your real IP. Handle them separately:

• SSH (port 22). Restrict it to your own IP address or a VPN, or put it behind a jump host. Never leave it open to the world on a server you have just made attractive by hardening everything else.
• Mail (25, 465, 587, 993, 995). These must stay reachable for mail to work and cannot go through Cloudflare's web proxy. Keep them patched and rate-limited.
• Control panel (for example 2083 and 2087 on cPanel). Restrict these to your own IP wherever possible.

Finally, remember that your origin IP has almost certainly leaked already. The firewall allowlist is what protects you going forward regardless, because it drops the direct connections the leaked IP would otherwise accept. If an old IP is under constant direct attack, ask us about moving the server to a fresh IP so the historical records point at nothing.

07. Verify the Lockdown

Test from a machine that is not inside your allowlist. The goal is simple: a direct connection to your origin IP should fail, while the same request through Cloudflare should succeed.

# Direct to the origin IP - should now fail (timeout, refused, or a TLS error):
curl -I --resolve www.example.com:443:YOUR_ORIGIN_IP https://www.example.com/

# Through Cloudflare - should still return your site normally:
curl -I https://www.example.com/

What a blocked direct hit looks like depends on the method. The firewall allowlist makes the connection time out or get refused. Authenticated Origin Pulls complete the connection but reject it with a certificate error such as "No required SSL certificate was sent." With Tunnel there is no open port to connect to at all. Any of these means the lockdown is working.

Quick Recap: Locking Down Your Origin

If you only do these things, do these:

1. Assume your origin IP is already known and that direct-to-origin attacks bypass every Cloudflare rule you have
2. Firewall ports 80 and 443 to Cloudflare's published ranges only, and refresh that list on a schedule
3. Add Authenticated Origin Pulls so the server also requires Cloudflare's client certificate, or use Cloudflare Tunnel to remove open ports entirely
4. Lock down SSH, mail, and your control panel separately, since Cloudflare does not carry that traffic
5. Verify from outside that a direct hit to your IP fails while the Cloudflare path still works

Last updated October 2026 · Browse all Server Maintenance articles