Hacker News Reader

This technique is in use for years, just get IP classes from CF website and set them in your iptables for ports 80/443 + any other IPs (yours, from your organization etc) and drop the rest.

Another way to get IPs is reading e-mail headers (register account on target website to get e-mail etc), so many sites behind CloudFlare expose their webservers IPs there.

View on HN

It's also possible to bypass Cloudflare if the target allows remote / external file upload (e.g avatar upload on forums, host the the relevant avatar on your own server and check your webserver access logs).

Unfortunately, iptables can't protect against all forms of DDOS attacks. Even just getting flooded by packets being routed to a particular IP can cause a datacenter's network to be affected. Something like CloudFlare Warp is the only way to truly prevent packets from being routed to your servers in the first place (I don't work for CloudFlare).

If it's not known where your servers are (because you got new IPs in a new hosting facility and never allowed them to communicate with the outside world directly), it's true that a packet flood would affect you, but it you would be awful hard to target.

Reply on news.ycombinator.com