Website Protection: Firewall Settings

Even behind protection, someone can try to attack your site directly via the server’s IP address, bypassing the filtering. To close this loophole, allow access to the web ports only from the scrubbing servers.

We strongly recommend configuring a firewall on your server that lets only the scrubbing servers reach ports 80/tcp and 443/tcp.

Networks to add to the firewall allow list:

77.220.207.0/24
45.10.240.0/24
45.10.241.0/24
45.10.242.0/24
186.2.160.0/24
186.2.164.0/24
186.2.167.0/24
186.2.168.0/24
185.178.209.197/32
190.115.30.44/32

Below are sample settings for popular firewalls.

These are sample commands, not a ready-made configuration for your server. Apply them only after making sure they will not break your project.

iptables example

iptables -I INPUT -s 77.220.207.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 77.220.207.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 45.10.240.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 45.10.240.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 45.10.241.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 45.10.241.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 45.10.242.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 45.10.242.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.160.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.160.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.164.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.164.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.167.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.167.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.168.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.168.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 185.178.209.197 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 185.178.209.197 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 190.115.30.44 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 190.115.30.44 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

UFW example

sudo ufw allow from 77.220.207.0/24 to any port 80 proto tcp
sudo ufw allow from 77.220.207.0/24 to any port 443 proto tcp
sudo ufw allow from 45.10.240.0/24 to any port 80 proto tcp
sudo ufw allow from 45.10.240.0/24 to any port 443 proto tcp
sudo ufw allow from 45.10.241.0/24 to any port 80 proto tcp
sudo ufw allow from 45.10.241.0/24 to any port 443 proto tcp
sudo ufw allow from 45.10.242.0/24 to any port 80 proto tcp
sudo ufw allow from 45.10.242.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.160.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.160.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.164.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.164.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.167.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.167.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.168.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.168.0/24 to any port 443 proto tcp
sudo ufw allow from 185.178.209.197 to any port 80 proto tcp
sudo ufw allow from 185.178.209.197 to any port 443 proto tcp
sudo ufw allow from 190.115.30.44 to any port 80 proto tcp
sudo ufw allow from 190.115.30.44 to any port 443 proto tcp
sudo ufw deny 80 proto tcp
sudo ufw deny 443 proto tcp

nftables example

These rules work until the server reboots:

nft add table ip ddg_filter
nft add chain ip ddg_filter input '{ type filter hook input priority 0; policy accept; }'
nft add rule ip ddg_filter input ip saddr 77.220.207.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 45.10.240.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 45.10.241.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 45.10.242.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.160.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.164.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.167.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.168.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 185.178.209.197 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 190.115.30.44 tcp dport {80, 443} accept
nft add rule ip ddg_filter input tcp dport {80, 443} drop

To make the rules permanent, add them to /etc/nftables.conf:

table ip ddg_filter {
        chain input {
                type filter hook input priority filter; policy accept;
                ip saddr 77.220.207.0/24 tcp dport { 80, 443 } accept
                ip saddr 45.10.240.0/24 tcp dport { 80, 443 } accept
                ip saddr 45.10.241.0/24 tcp dport { 80, 443 } accept
                ip saddr 45.10.242.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.160.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.164.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.167.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.168.0/24 tcp dport { 80, 443 } accept
                ip saddr 185.178.209.197 tcp dport { 80, 443 } accept
                ip saddr 190.115.30.44 tcp dport { 80, 443 } accept
                tcp dport { 80, 443 } drop
        }
}

firewalld example

firewall-cmd --permanent --new-zone=ddg
firewall-cmd --permanent --zone=ddg --add-port=80/tcp
firewall-cmd --permanent --zone=ddg --add-port=443/tcp
firewall-cmd --permanent --zone=ddg --add-source=186.2.160.0/24
firewall-cmd --permanent --zone=ddg --add-source=77.220.207.0/24
firewall-cmd --permanent --zone=ddg --add-source=45.10.240.0/24
firewall-cmd --permanent --zone=ddg --add-source=45.10.241.0/24
firewall-cmd --permanent --zone=ddg --add-source=186.2.167.0/24
firewall-cmd --permanent --zone=ddg --add-source=186.2.168.0/24
firewall-cmd --permanent --zone=ddg --add-source=45.10.242.0/24
firewall-cmd --permanent --zone=ddg --add-source=186.2.164.0/24
firewall-cmd --permanent --zone=ddg --add-source=185.178.209.197/32
firewall-cmd --permanent --zone=ddg --add-source=190.115.30.44/32
firewall-cmd --reload

Make sure the default zone (usually public) does not allow the http and https services to everyone, otherwise the site will stay reachable directly:

firewall-cmd --permanent --zone=public --remove-service=http --remove-service=https
firewall-cmd --reload

To see real visitor IPs in your site logs instead of the scrubbing servers’ addresses, follow “Website Protection: Real Visitor IP Addresses”.