Posted inSecurity

Stop Unauthorized IP Access: Configuring Authenticated Origin Pulls (Cloudflare & Nginx)

Security tutorial - IT technology blog
Security tutorial - IT technology blog

5-Minute Quick Deployment

Using Cloudflare and Nginx? This is the fastest way to “lock down” your server and block any requests that don’t pass through Cloudflare’s proxy.

  1. Get the root certificate from Cloudflare: You need the CA file so Nginx can verify the requests. Run the following command:
sudo mkdir -p /etc/nginx/certs
sudo curl -s https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem -o /etc/nginx/certs/cloudflare.crt
  1. Configure Nginx: Open your domain configuration file (usually located in /etc/nginx/sites-available/). Add these two authentication lines to the server block (port 443):
server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /path/to/your/fullchain.pem;
    ssl_certificate_key /path/to/your/privkey.pem;

    # Enable client-side authentication
    ssl_client_certificate /etc/nginx/certs/cloudflare.crt;
    ssl_verify_client on;

    location / {
        try_files $uri $uri/ =404;
    }
}
  1. Apply configuration: Check the syntax and reload the service.
sudo nginx -t && sudo systemctl restart nginx
  1. Activate on the Dashboard: Go to Cloudflare -> SSL/TLS -> Origin Server. Toggle the Authenticated Origin Pulls switch to On.

From this moment on, any direct request to the server IP will be flatly rejected by Nginx with a 400 Bad Request error code.

Why IP Whitelisting Alone Isn’t Enough

Many sysadmins believe that simply using a Firewall (UFW/iptables) to restrict access to Cloudflare’s 15 IP ranges is secure. In reality, it’s not that simple.

Imagine an attacker also uses Cloudflare. They could point their own domain (e.g., attack-site.com) directly at your server’s IP address. If your Nginx default_server isn’t configured carefully, the server will process that request as valid traffic from Cloudflare. The result? Your entire web content could be “borrowed” by a junk domain, severely impacting your SEO and brand reputation.

Authenticated Origin Pulls completely solves this problem using Mutual TLS (mTLS). Not only does the browser check the server, but now the server also requires Cloudflare to “show its ID” (client certificate) before allowing entry.

Choosing the Right Certificate Mode

Depending on your desired level of security, you can choose one of two methods:

Using a Global Certificate

This is the default option. Cloudflare uses a shared certificate for all users. It is extremely easy to deploy and secure enough for 90% of common websites. Nginx will check the server_name in combination with this certificate to reject spoofed requests.

Using a Custom Certificate

If you are operating a financial system or handling sensitive data, you should create your own certificate. In the Cloudflare Dashboard, select Upload Custom Certificate in the Origin Server section. At this point, only traffic passing through your own Cloudflare account will have the key to open the gate to your server.

How to Test Your “Fortress”

Don’t just trust your gut; use actual data. Try simulating an attack by curl-ing the server IP directly (replace 1.2.3.4 with your actual IP):

curl -k https://1.2.3.4

If the server returns a 400 No required <a href="https://itfromzero.com/en/security-en/mastering-openssl-from-creating-self-signed-certs-to-lightning-fast-tls-debugging.html">SSL certificate</a> was sent error, your system is secure. You have successfully established a very solid traffic filtering layer at the protocol level.

Optimizing Resources: Don’t Forget the Network-Level Firewall

While mTLS is very secure, letting Nginx handle too many failed TLS Handshakes still wastes resources. Each failed handshake still consumes CPU and a small portion of the server’s RAM.

My advice: Stop them at the gate.

Use an automated script to sync Cloudflare IP ranges with ufw. When you do this, an attacker won’t even see port 443 as open (it will show as Filtered). The combination of an IP Firewall and mTLS creates a perfect double layer of security.

Hard-Learned Lessons

  • Port 80 Vulnerability: mTLS only runs on HTTPS. If you forget to close port 80 or don’t implement a strict 301 redirect, hackers can still sneak in through this port. Configure Always Use HTTPS on Cloudflare immediately.
  • Conflict with Certbot: Let’s Encrypt usually uses the http-01 challenge. If you lock down your server, Certbot won’t be able to renew the SSL certificate. You should switch to using the dns-01 challenge via the Cloudflare API so that renewals happen silently and securely.
  • Monitor Logs: If your website suddenly shows a 502 error, check /var/log/nginx/error.log. If you see the error client sent no required SSL certificate from a valid IP, Cloudflare’s CA certificate might have expired (they usually have a very long lifespan, but it’s still worth noting).

Implementing Authenticated Origin Pulls is a “$0 investment” that provides massive security value. You’ll sleep better knowing your server is truly hidden from mass IP scans on the internet.

Share:
Tags: