cfips.sh

This is a simple bash script that will generate an ngx_http_geo_module compatible geo block to identify whether traffic is coming from cloudflare or not.

Usage

./cfips.sh > /etc/nginx/conf.d/cloudflare.conf
systemctl reload nginx

And then, in your NGINX site block:

# ...
location / {
    # short-circuit if not from a cloudflare IP
    if ($cloudflare_ip != 1) {
        return 403;
    }
}

Options

    -s <number_of_seconds>: sleep for 1-<number_of_seconds> (inclusive) before executing. useful for cron 
    -z <zone_name>: set the zone/variable name. default "cloudflare_ip"
    -h: show help screen

Credits

• This Serverfault answer: https://serverfault.com/a/826428

License

GPLv3