Self-Healing Cloudflare CIDRs in DigitalOcean Firewalls

说明与用途

使用实时 Cloudflare CIDR 自动更新 DigitalOcean 防火墙规则，防止流量被静默拦截。

问题

Hardcoded Cloudflare CIDR lists in DigitalOcean firewall rules become stale when Cloudflare updates its edge IP ranges, causing legitimate traffic to be blocked silently.

结果

The firewall now automatically reflects Cloudflare’s current IP ranges, eliminating silent traffic drops and ensuring reliable access to the monitoring droplet.

工作流

• 1. Retrieve droplet ID via doctl and build SSH rule from operator IPs stored in a GitHub variable.
• 2. Fetch live Cloudflare IPv4 and IPv6 CIDR lists using curl with a 10s timeout.
• 3. Validate that the fetched lists are not empty and contain a reasonable number of ranges (≥10 v4, ≥5 v6).
• 4. Convert each CIDR into the format required by doctl (e.g., address:1.2.3.4/32).
• 5. Assemble inbound rules for TCP port 22 (SSH) and TCP port 443 (HTTPS) with the fetched Cloudflare ranges.
• 6. Perform an atomic firewall update with doctl compute firewall update, replacing all inbound rules in one call.
• 7. Repeat this step on every bootstrap or redeploy to keep the firewall in sync with Cloudflare’s current IPs.

证据

Cloudflare publishes the canonical list of edge IPs at two URLs, and they change.

来源

The firewall converges on whatever CF published just now.

来源