- Shell 100%
Paul Git
50c62b546b
Bump version to 3.3. Update README and help text to document UDP/QUIC default behavior and the new --no-quic option. Implement UDP allow/delete rules for port 443, add cfufw_noquic flag and examples. |
||
|---|---|---|
| LICENSE | ||
| README.md | ||
| ufw-cf | ||
ufw-cloudflare v3.3
█░█ █▀▀ █░█░█ █▀▀ █▀▀
█▄█ █▀░ ▀▄▀▄▀ █▄▄ █▀░
This is a forked and updated verison of drvy's script ufw-cloudflare v2. It's essentially the same but has additional options for IPv6 skipping, cron mode, custom destination IPs, and QUIC/HTTP3 support.
This script will automatically whitelist Cloudflare IPs (subnets) within UFW and get an easier way to delete old rules. A simple SH script that will fetch Cloudflare's IPs and subnets (IPV4 & IPV6) and will create rules for them automatically in UFW (Uncomplicated Firewall) thus allowing Cloudflare traffic to port 80 (http) and 443 (ssl/https) via TCP, and port 443 (QUIC/HTTP3) via UDP.
Usage
Install by running the following commands
sudo wget -O /usr/local/bin/ufw-cf \
https://code.paulg.it/paulgit/ufw-cloudflare/raw/branch/master/ufw-cf
sudo chmod +x /usr/local/bin/ufw-cf
Run the script as root. The script will download a temporary file (cloudflare-ips.txt) into the /tmp folder and will parse it to add the IPs to UFW.
The IPs are provided by Cloudflare: IPv4, IPv6.
Options
Purge/delete rules
The script has the ability to purge all the previously created rules in UFW. Keep in mind it deletes only those rules commented as "cloudflare".
sudo ufw-cf --purge
This will delete existing Cloudflare rules, fetch the IPs and create new rules. You can also delete/purge the rules without creating new ones.
sudo ufw-cf --purge --no-new
Skip IPv6
Use the --skip-ipv6 option to only apply IPv4 rules and skip IPv6 rules entirely.
sudo ufw-cf --skip-ipv6
Skip IPv4
Use the --skip-ipv4 option to only apply IPv6 rules and skip IPv4 rules entirely.
sudo ufw-cf --skip-ipv4
Disable QUIC/HTTP3
By default, the script enables UDP port 443 for QUIC/HTTP3 support. Use the --no-quic option to skip creating UDP rules and only allow TCP traffic.
sudo ufw-cf --no-quic
This is useful if you want to disable QUIC protocol support or if your application doesn't support HTTP/3.
No new downloads
Use the --no-new (-n) option to avoid downloading Cloudflare IP lists and to skip adding any new rules. This is useful when you only want to purge existing Cloudflare rules without creating replacements.
sudo ufw-cf --no-new
Cron mode
Use the --cronmode (-c) option to suppress progress output and only show meaningful messages, errors, or a summary when changes are made. This mode is suitable for running the script from cron.
sudo ufw-cf --cronmode
Custom destination IP
Use the --ip (-i) option to specify a destination IP address. When provided, the script will allow Cloudflare traffic to reach only that specific destination IP instead of any destination.
sudo ufw-cf --ip 192.0.2.1
This creates rules that allow traffic FROM Cloudflare IPs TO the specified IP on ports 80 and 443. You can combine it with --purge to remove old rules before adding the new ones:
sudo ufw-cf --purge --ip 203.0.113.5
IPv6 Support
The option also supports IPv6 addresses. When using IPv6, provide the address in CIDR notation:
sudo ufw-cf --ip 2606:4700:4700::1111/128
For IPv6 subnets:
sudo ufw-cf --ip 2606:4700:4700::/32
Combining options
Options can be combined together:
sudo ufw-cf --cronmode --skip-ipv6
sudo ufw-cf --purge --no-new --cronmode
sudo ufw-cf --ip 192.0.2.1 --cronmode
sudo ufw-cf --no-quic --skip-ipv6
sudo ufw-cf --purge --ip 192.0.2.1 --no-quic