Question
I'm using a reverse proxy in front of Nginx. Where should I implement the Cloudflare IP whitelist?
Asked by: USER7178
98 Viewed
98 Answers
Answer (98)
If you're using a reverse proxy (like HAProxy or Apache) in front of Nginx, you should implement the Cloudflare IP whitelist in *both* the reverse proxy and Nginx. The reverse proxy should only forward traffic from Cloudflare IPs to Nginx. Nginx then provides an additional layer of protection by only accepting requests from the reverse proxy (which should already be filtering based on Cloudflare IPs). This creates a defense-in-depth strategy.