Tunning the server exclusively for the cloudflare

First ensure Centmin Mod Nginx is setup to detect real IP addresses behind Cloudflare. For my Centmin Mod Nginx users I wrote a specific guide for them including a script to auto generate the latest Cloudflare IPs for the configuration at Nginx Cloudflare & Incapsula (reverse proxy HttpRealIpModule) - CentminMod.com LEMP Nginx web stack for CentOS

If using Centmin Mod 123.09beta01 or newer branches, the generated Nginx vhost already have setup automated script to pull latest Cloudflare IPs for CSF Firewall whitelisting outlined here. The generated Nginx vhost will have an include file /usr/local/nginx/conf/cloudflare.conf that is prepopulated with Cloudflare IPs pulled in via a cronjob you manually setup as outlined here.

Code (Text):

  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  include /usr/local/nginx/conf/cloudflare.conf;

cronjob you manually setup once only

Code (Text):

23 */36 * * * /usr/local/src/centminmod/tools/csfcf.sh auto >/dev/null 2>&1

Then ensure to whitelist your ISP ip address in CSF Firewall

Code (Text):

csf -a youripaddress

add ip to /etc/csf/csf.ignore as well

Then backup CSF Firewall config naming backup profile = b4-cfsecurity

Code (Text):

csf --profile backup b4-cfsecurity

Then just remove port 80 and 443 only from CSF Firewall's /etc/csf/csf.conf config file for TCP_IN/TCP6_IN whitelisted ports. Don't remove all ports as you may not be able to update Centmin Mod if you do.

Then restart CSF Firewall

Code (Text):

csf -ra

Then keep existing SSH client window session connected and try a 2nd new SSH connection to server to make sure you can still SSH into server properly. If you can't connect, then use existing connected SSH client window session to reverse and fix changes you made.

 

yeah those still valid ports

CSF Firewall supports whitelisting dynamic ISP addresses via dynamic hostname setups too. See CSF Firewall section titled How To Whitelist ISP Dynamic IP Address In CSF Firewall? Or use a dedicated VPN IP to whitelist too just as added precaution.

 

Utilise Cloudflare's Firewall Rules, User Agent blocking to help ideas at https://community.centminmod.com/th...-like-china-on-your-production-servers.18678/