IP visible even with cloudflare active, what did i do wrong?

#1

Hi, hopefully i can get some help with my issue.
I did a security check on my site, and i notice that it’s possible to view all kinds of information on
shodan.io & censys.io such as:
IP
ISP
Country
Web Technologies
HTTP/1.1
Server:
Date:
Content-Type:
Content-Length:
Connection:
Location: https://
Expires:
Cache-Control:
Ports
Services
SSL Certificate
Ect

Obviously i wish to block shodan & censys from being able to scan my domain.
Im still new to security on webservers and sites but it was my understanding that cloudflare would block most of this information.
So i must have missed to configure something. I would like some help to fix this.
I asked scott helme for advice and he told me,

" You’d need to configure your server to only answer requests from Cloudflare.
It’s likely becuse your servers are accepting traffic on your IP address from anywhere. If your server is behind Cloudflare, or any CDN, you should restrict it to only answer requests that come from a Cloudflare IP address. "

So i have been trying to do as scott suggested but i’ve gotten nowhere.
He also told me that he had been using iptables in the past but as i understand that is only available for linux. And as i use windows as a server os, how would i configure this on windows?

I have HTTP Proxy (CDN) active

Thx in advance :slight_smile:

0 Likes

#2

You can’t hide historical data about your site. So you’d better patch up what you’ve got.

I don’t use Windows Server, so I don’t know what’s available for blocking ports and firewalling non-Cloudflare IP addresses. Sometimes the Host Provider has their own firewall setup that’s good at this. I know DigitalOcean and Vultr have such features.

0 Likes

#3

Hi sdayman, i see,
tho i don’t use DigitalOcean or Vultr, i host my own server.

Btw is it possible to do what scott suggested in the router somehow ?

0 Likes

#4

It depends on the router. But I bet Windows Server has its own firewall you can configure to block non-Cloudflare access to Ports 80 and 443, plus any other ports you want to protect.

1 Like

#5

I still need help with this…

Does anyone know exactly how to do this in windows ?

0 Likes

#6

Anyone ???

0 Likes

#7

Do you use IIS?

0 Likes

#8

Hey matteo,
my bad i forgot to add what software i use =P
i use nginx and i have it in reverse proxy :slight_smile:

0 Likes

#9

Simply googling would have given you a guide, way better than what we could have done in way less lines here.

Use cloudflare.com/ips

2 Likes

#10

I did google it :confused:

I’ll check out the link you gave me Thx man :slight_smile:

Quick question before i start, will that config work even tho im on windows?
some configs for nginx works on linux and not windows.

0 Likes

#11

For that I have no clue. Never used nginx on Windows.

0 Likes

#12

trial and error then i guess :slight_smile:
Thx again matteo!

1 Like

closed #13

This topic was automatically closed after 30 days. New replies are no longer allowed.

0 Likes