5

I saw CloudFlare's services where you need to change the DNS of your domain name to their provided DNS address.

The traffic coming as "mywebsite.com" goes through CloudFlare. What if I have a dedicated IP and the attacker targets the IP address. Is CloudFlare useless in this case?

Improve this question
1
  • 2
    Short answer is that you need to do your best to keep your server's real IP hidden in order for Cloudflare to be effective. Last time I checked Cloudflare will give you a warning if you have any DNS records pointing to your real IP with protection disabled. Accepting traffic only from Cloudflare IP's would not be effective against a pure bandwidth-flooding attack, but such an attack would only be possible of the attacker knows your real IP.
    – tlng05
    Jan 24, 2016 at 15:04

1 Answer 1

Reset to default
5

found the answer here

Use CloudFlare IP addresses to your advantage

Take action to prevent attacks to your site during peak season by configuring your firewall to only accept traffic from CloudFlare IP addresses during the holidays. If you only accept CloudFlare IPs, you can prevent attackers from getting to your original IP address and knocking your site offline.

Improve this answer
3
  • 2
    If your firewall is inspecting the traffic enough to know what IP address it's coming from the damage is already done. DOS is about forcing you to spend resources on illegitimate traffic, the fact that it got to your firewall, or your router even, would deem the attack successful. If you meant to suggest that your edge router would only accept traffic from CloudFlare would at least be slightly better, but it's still consuming your valuable bandwidth. Best case would be to have an inline solution for this scenario.
    – GingerBeard
    Jan 24, 2016 at 9:49
  • can you please elaborate "inline solution" ?
    – brainHax
    Jan 24, 2016 at 10:02
  • 1
    Rather than using a cloud service an inline dos protection appliance would sit in between your edge router and your ISP. The reason why this is different from a Firewall solution, or your router, is that this is only looking at headers so that it can more efficiently block IP's and anomalous traffic. Obviously its effectiveness is still limited to your bandwidth, but it is more better equipped to handle DOS attacks than a router or firewall. Arbors Pravail is what I'm most familiar with, but I'm certain you can find something to your liking out on the vast interwebs.
    – GingerBeard
    Jan 24, 2016 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .