Fireware blocking rules not working

[erin4]

What is the name of the domain?

Vite + React

What is the issue you’re encountering

Fireware IP blocking rule not working

What is the current SSL/TLS setting?

Flexible

What are the steps to reproduce the issue?

I’ve set up a firewall rule to block all access to my site except for a specific list of IP addresses. However, I’m still able to access the site from any device I own. I’ve also tried creating additional firewall rules (e.g., user-agent blocking), but nothing seems to work. I have proxies enabled, and from the developer tools, I can see that my server traffic is coming through Cloudflare. My code is deployed on OnRender.

Screenshot of the error

[sjr]

@erin4

My code is deployed on OnRender.

If you are CNAMEing to something.onrender.com it looks like Render use a CNAME setup on Cloudflare, so requests won’t pass through your Cloudflare zone.

dig +short something.onrender.com
gcp-us-west1-1.origin.onrender.com.
gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net.
216.24.57.252
216.24.57.4

[erin4]

I’m using an A record to point to OnRender’s IP address, though I’m not sure if that makes a difference. Is there any way to bypass OnRender’s Cloudflare and use my own instead? Or do I need to switch hosting providers?

[sjr]

@erin4

Is there any way to bypass OnRender’s Cloudflare and use my own instead?

They are not using Cloudflare for SaaS, so no. Their IP addresses use Cloudflare’s anycast network and requests will go direct to them.