Just wondering if it is possible to use Fail2ban on a server with CloudFlare in front of it?
Server <-> CloudFlare <-> Internet
The issue is that it seems the incoming web traffic has the IP of the CloudFlare servers, rather than the originating IP.
For example, I banhammer people probing for vulnerabilities of systems not in use.
*.log:173.245.55.134 - - [12/Oct/2016:23:06:32 -0400] "GET /CFIDE/administrator/ HTTP/1.1" 403 5423 "-" "-"
The above appears to be an attempt to exploit ColdFusion... Whatever that is. So I banhammer them, but now the incoming IP is listed as CloudFlare, so that is not going to work.
General IP Information
IP: 173.245.55.134
Decimal: 2918528902
Hostname: cf-173-245-55-134.cloudflare.com
ASN: 13335
ISP: CloudFlare
Organization: CloudFlare
Therefore, is it possible to still use fail2ban with CloudFlare in front of it? What is the solution?
Aucun commentaire:
Enregistrer un commentaire