DOCSEARCHbyAlgolia
Submit Docs

cloudflare-ufw

repository·master·Indexed 20 days ago

https://github.com/paul-reed/cloudflare-ufw

A bash script that automatically updates Uncomplicated Firewall (UFW) rules with the current Cloudflare IPv4 and IPv6 address ranges. Includes instructions for preparing UFW to prevent lockout, installing the script, and scheduling automatic updates via cron or Node-RED.

Tokens
1.2K
Snippets
7
Records
7
Agent score
22%

What's inside cloudflare-ufw

  1. Prepare UFW for Cloudflare IP ranges

    master

    Before installing the script, ensure UFW is configured correctly to prevent lockout.

    1. Check status: Run sudo ufw status verbose. If it shows Status: inactive, you can skip to the installation. If active, disable it with sudo ufw disable.
    2. Reset rules: Run sudo ufw reset to return to default settings.
    3. Set default policies: Set the firewall to deny all incoming connections and allow all outgoing connections:
      • sudo ufw default deny incoming
      • sudo ufw default allow outgoing
    4. Prevent lockout: Crucially, allow your local network and SSH before enabling the firewall:
      • Allow local network (example: sudo ufw allow from 192.168.1.0/24)
      • Allow SSH: sudo ufw allow ssh
    5. Enable UFW: Run sudo ufw enable. When prompted with a warning about disrupting SSH connections, type Y to continue.
    sudo ufw status verbose
sudo ufw disable
sudo ufw reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.1.0/24
sudo ufw allow ssh
sudo ufw enable

  2. Prepare UFW for cloudflare-ufw

    master

    Before installing the script, you must configure UFW to a clean state with safe default rules to avoid being locked out of your system.

    1. Check status: Ensure UFW is currently inactive using sudo ufw status verbose. If it is active, disable it with sudo ufw disable.
    2. Reset rules: Clear existing rules with sudo ufw reset.
    3. Set defaults: Configure the firewall to deny all incoming and allow all outgoing connections:
      • sudo ufw default deny incoming
      • sudo ufw default allow outgoing
    4. Prevent lockout: Add essential rules for local network access and SSH before enabling the firewall:
      • Add a localhost rule (adjust the subnet to your specific local network, e.g., 192.168.1.0/24): sudo ufw allow from 192.168.1.0/24
      • Allow SSH: sudo ufw allow ssh
    5. Enable firewall: Run sudo ufw enable and respond with y to the connection disruption warning.
    sudo ufw status verbose
sudo ufw disable
sudo ufw reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.1.0/24
sudo ufw allow ssh
sudo ufw enable

  3. Schedule automatic Cloudflare IP updates

    master

    Cloudflare IP ranges change periodically. You should schedule the script to run weekly to keep your firewall rules up to date.

    Using Cron

    1. Open the crontab editor: sudo crontab -e.
    2. Add the following line to run the script every Monday at midnight: 0 0 * * 1 /path/to/cloudflare-ufw.sh > /dev/null 2>&1

    Using Node-RED

    If you use Node-RED, add an 'exec node' with the path to the script: sudo /path/to/cloudflare-ufw/./cloudflare-ufw.sh and schedule it to run weekly.

    # Add to sudo crontab -e
0 0 * * 1 /path/to/cloudflare-ufw.sh > /dev/null 2>&1

  4. Delete a single UFW rule

    master

    If you need to manually remove a specific rule from UFW:

    1. List all rules with their corresponding index numbers using sudo ufw status numbered.
    2. Delete the desired rule using its number with sudo ufw delete <number>.
    sudo ufw status numbered
sudo ufw delete 34

  5. Schedule cloudflare-ufw updates with cron

    master

    Since Cloudflare periodically updates its IP ranges, you should run the script regularly (e.g., weekly) to keep your firewall rules current.

    To automate this using cron, run sudo crontab -e and add the following entry to run the script every Monday at midnight:

    0 0 * * 1 /your/path/cloudflare-ufw/cloudflare-ufw.sh > /dev/null 2>&1

    Alternatively, if you use Node-RED, you can add sudo /your/path/cloudflare-ufw/./cloudflare-ufw.sh to an 'exec node' and trigger it weekly.

    # Add this to sudo crontab -e
0 0 * * 1 /your/path/cloudflare-ufw/cloudflare-ufw.sh > /dev/null 2>&1

  6. Install the cloudflare-ufw script

    master

    To install the Cloudflare IP ranges into UFW, clone the repository to your machine, then execute the script with sudo privileges. The script automatically fetches the current IPv4 and IPv6 ranges from Cloudflare and applies them to your UFW configuration.

    Verify the rules were added by running sudo ufw status verbose.

    sudo /path/to/./cloudflare-ufw.sh

  7. Manage UFW rules by number

    master

    If you need to manually remove specific rules added by the script or other processes, you can delete them by their index number.

    1. List rules with numbers: Run sudo ufw status numbered to see the list of rules and their corresponding IDs.
    2. Delete a rule: Use the delete command followed by the rule number. For example, to delete rule number 34, run sudo ufw delete 34.
    sudo ufw status numbered
sudo ufw delete 34