How does whitelisting Cloudflare IPs in Nginx differ from using Cloudflare's 'IP Access Rules'?

Cloudflare's 'IP Access Rules' are configured within the Cloudflare dashboard and operate *before* traffic reaches your origin server. They allow you to block or allow traffic based on IP address, country, or ASN. Whitelisting in Nginx is a second layer of defense, operating *on* your origin server. Using both provides a more robust security posture. Cloudflare's rules handle the majority of traffic, while Nginx whitelisting ensures that any traffic bypassing Cloudflare is blocked at the server level.