How do I protect my subdomain with Cloudflare?

Security
#1

Ok so I “own” (manage) this domain (talkstaindcommunity.cf)! I’ve recently added a firewall rule(s) ( that blocks or challenges countries with the highest hacking rate) but the subdomain (community.talkstaindcommunity.cf) is NOT protected by the firewall rule(s) (as I had put the allowance for IP’s, including mine, lower than the block, and did not get challenged, despite being from a country set to challenge requests)! This made me assume that the subdomain is NOT protected by the firewall rule(s)! So how do I protect it? The firewall rule(s) was were/are mainly made to protect the subdomain from hacking from countries that commonly have hacking!

The expression for the challenge is as follows

(ip.geoip.country eq "TW") or (ip.geoip.country eq "TR") or (ip.geoip.country eq "BR") or (ip.geoip.country eq "IN") or (ip.geoip.country eq "US") or (ip.geoip.country eq "RO") or (ip.geoip.country eq "IT") or (ip.geoip.country eq "HU")

The expression for the block is as follows

(ip.geoip.country eq "RU") or (ip.geoip.country eq "CN") or (ip.geoip.country eq "UA")

Please note: The block on Ukraine (UA) is temporary and is for security reasons only!

Again, how do I protect the subdomain (which again is community.talkstaindcommunity.cf)!

Do I need to add community.talkstaindcommunity.cf as a DNS record (and then proxy it through Cloudflare)?

Please note that I “own” this domain with @Neeraj_1 but I am the one who put the block/challenge in place!

#2

Yep. Cloudflare can only action traffic that has a proxied record.

1 Like
#3

So add community.talkstaindcommunity.cf as a proxied record? (but of what type)?

CNAME?

#4

Depends entirely on what’s behind it - if your hosting provider gives you an IPv4 address then A, IPv6 then AAAA or a domain name then CNAME.

#5

How long will it take for it to start protecting the subdomain?

image
image983×148 11.8 KB

#6

From minutes to the usual 48/72 hours of DNS propagation.

1 Like
#7

So it usually takes 2 or 3 days (but can take only a few minutes)?

#8

Yeah. It’s outside of yours or Cloudflare’s control. It also depends on how the record was setup before…

I’m gonna say it’s usually way less than 48h, but it might take up to 48/72hrs.

#9

Ok, but once it applies, allowed, challenged, and blocked requests from the subdomain will be logged?

#10

Of course, everything within the bounds and limits of the selected plan. To note, it will apply at different times to different people, most will get it in minutes, some random cache might still serve stale records for a while longer.

1 Like
#11

Was just noticing that this setup for protecting the community subdomain makes no sense…

#12

Yeah, I think it’s screwing it up (slowing it down, making it almost unreachable)!

As a result, I have deproxied the record and will see if that fixes the issue!

#13

You have no record for community.talkstaindcommunity.cf at the moment. Add one and proxy that :slight_smile:

#14

Proxying a domain shouldn’t make it slower at all?

#15

Added an A record, how long until the DNS_PROBE_FINSHED_NXDOMAIN error is gone?

#16

This.

#17

■■■■, did I make a mistake changing it from a CNAME to an A record?

#18

It depends on how you are setting things up, if an A record is required (as I suspect) a CNAME will never work.

#19

So if I screwed something up by changing it, it’ll return a CF branded error?

#20

And can there be multiple proxied A records?