[judge2020]

From helping on the Cloudflare Community forum for a while, this seems to be a fairly common issue[0] - users set up Cloudflare and then continue to get attacked since the firewall isn't properly set up to only allow connections from Cloudflare IPs.

Something I don't like is how Cloudflare themselves don't really suggest you firewall off connections that aren't from CF ips, as there's only a support article on whitelisting and not blocking[1]. This is an area I hope CF can improve since any competent, targeted DDOS attacker will know the IP the server had before the owner went to CF, and/or can use a tool like curryfinger to figure it out.

0: https://community.cloudflare.com/search?q=firewall%20cloudfl...

1: https://support.cloudflare.com/hc/en-us/articles/201897700-W...

[693471]

A firewall doesn't stop the traffic from being sent

[CodeWriter23]

It does however defeat this probe method.

[693471]

Correct, but it won't stop someone from killing the backend/origin server if it is known.

[Buge]

What if you use a firewall provided by AWS or GCP?

[leetbulb]

A nice way to route your web servers through CloudFlare is using Argo. No ports exposed :)