I use Google Cloud Platform to serve the site I manage.

I have one load balancer there, which controls the movement to several virtual machines.

When I came across the problem of DDOS attacks on this site, I started using Google Armor to block the intruders' IP addresses, but over time, when the problem escalated, my team decided to use the Cloudflare service and now all domain traffic from the Internet to service is lead by Cloudflare as a middleman.

However, further DDOS incidents show that the attack is carried out in two ways: using the domain (or domain IP referring to Cloudflare), but also directly on the load balancer's IP from Google Claud.

The attackers could have known this load balancer's IP, before joining Cloudflare, because that IP has not changed.

I would like all traffic to be directed by Cloudflare and, if possible, that nobody from the outside knows the load balancer's IP or virtual servers located in the Google Cloud.

I have two questions:

  1. If I change the load balancer's IP address now, can someone from the outside (attacker) get to this IP in some way?

  2. I could use Google Armor (or another firewall) to allow Google Claud to accept traffic only from Cloudflare, but is there such a permanent (immutable) list of IP addresses that are only used by Cloudflare to communicate with my site (or all sites) to which I could restrict traffic?

Maybe someone else has some other ideas as to the situation and he would like to share them. I am happy to hear them.

2 Answers 2


Once you change the public IP address of your site, configure the DNS to point to Cloudflare and forward your request from there, the attacker will always go through the Cloudflare and won't hit your server directly.

Cloudflare publishes its public IP list that you can restrict on your perimeter. The list is available at https://www.cloudflare.com/ips/

  • This will help, but won't necessarily stop determined attacks. The main booter/stresser sites now advertise the fact that they can take down cloudflare sites. They are able to bypass cloudflare captchas, they use real browsers, and they are now starting to use cloudflare's WARP VPN (so only allowing cloudflare ips to your real server will not stop the attacks if they know your real server ip).
    – CpnCrunch
    Dec 8, 2023 at 0:10

I would have a look at Argo Tunnel, a feature of CloudFlare.

By letting their daemon run on your server, it will ensure that only Cloudflare servers can contact yours.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .