Cloudflare WAF Setup Guide: Hardening Rulesets, Rate Limiting & Origin mTLS

Securing the Origin: The Edge-to-Server Pipeline

Deploying Cloudflare is only effective if origin servers are completely shielded from direct public IP access. If an attacker bypasses the Cloudflare proxy and connects directly to your server IP, your WAF rules and DDoS defenses are bypassed.

1. Enforcing Cloudflare Authenticated Origin Pulls (mTLS)

Configure Nginx on SlikWeb to require client TLS certificate authentication signed by Cloudflare CA:

# /etc/nginx/conf.d/ssl_origin_pull.conf
ssl_client_certificate /etc/ssl/certs/cloudflare.crt;
ssl_verify_client on;

2. Restricting Ingress Firewall to Official Cloudflare IP Ranges

Using ufw or nftables, restrict port 80 and 443 strictly to Cloudflare IPv4 and IPv6 published blocks, while allowing SSH only through your team VPN or Cloudflare Zero Trust Tunnel.

Discover how our team handles Cloudflare Management & Security Hardening.