How does Cloudflare firewall work?

Question

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.

So from what I understand it goes like this

User -> Domain -> IP of firewall -> captcha -> IP of website -> loads content

I am new to this security, but I am experiencing a DDoS attack (18 million requests daily from thousands of random IPs) and the only solution is to make something like Cloudflare firewall where a user has to solve a captcha in order to reach the website.

I can't use Cloudflare because the new captcha is impossible to use, they have problems with redirects (it asks to solve a captcha every time it has a redirect) and there is no control over the settings.

Answer 1

No. Cloudflare is a reverse proxy. When a site uses Cloudflare, the client (browser) never connects to the origin server. They can even help you hide the origin server, so an attacker cannot attack it directly.

The client connects to a server in one of ~200 Points Of Presence they have around the world (server farms), the request is processed by the server there (rate limiting, TLS, WAF, page rules, cache, arbitrary JS code, etc.) and if needed, the Cloudflare server connects to the origin server, performs a request, gets a response, transforms the response, caches it locally and serves it to the waiting client. Cloudflare is Man-in-The-Middle-As-A-Service. You give them DNS control, they generate a TLS certificate for your domain and front the domain. It's possible that your origin server sees a tiny fraction of the number of requests served, and this lets a tiny origin server to handle a lot of legitimate traffic, stand up to DDoS attacks, etc.

There are a lot of things you can configure, but that is the general idea. Cloudflare can also do just authoritative DNS server, without being a proxy. They can let you keep your TLS key, for compliance reasons. They are good at explaining how their products work and publishing many details on their blog, so I suggest you read their developer docs (not the marketing material for non technical people).

You can also contact their customer support.