Self-Healing Cloudflare CIDRs in DigitalOcean Firewalls

Description and use

Automatically update DigitalOcean firewall rules with live Cloudflare CIDRs to prevent silent traffic drops.

Problem

Hardcoded Cloudflare CIDR lists in DigitalOcean firewall rules become stale when Cloudflare updates its edge IP ranges, causing legitimate traffic to be blocked silently.

Outcome

The firewall now automatically reflects Cloudflare’s current IP ranges, eliminating silent traffic drops and ensuring reliable access to the monitoring droplet.

Workflow

• 1. Retrieve droplet ID via doctl and build SSH rule from operator IPs stored in a GitHub variable.
• 2. Fetch live Cloudflare IPv4 and IPv6 CIDR lists using curl with a 10s timeout.
• 3. Validate that the fetched lists are not empty and contain a reasonable number of ranges (≥10 v4, ≥5 v6).
• 4. Convert each CIDR into the format required by doctl (e.g., address:1.2.3.4/32).
• 5. Assemble inbound rules for TCP port 22 (SSH) and TCP port 443 (HTTPS) with the fetched Cloudflare ranges.
• 6. Perform an atomic firewall update with doctl compute firewall update, replacing all inbound rules in one call.
• 7. Repeat this step on every bootstrap or redeploy to keep the firewall in sync with Cloudflare’s current IPs.

Evidence

Cloudflare publishes the canonical list of edge IPs at two URLs, and they change.

Source

The firewall converges on whatever CF published just now.

Source