Why I built warden: fail2ban can't see attackers behind a Cloudflare tunnel

说明与用途

Warden 解决了在 Cloudflare 隧道后面无法通过本地防火墙阻止攻击者的问题，因为真实 IP 仅存在于 HTTP 头中。它收集并评分日志，通过 Discord 提交 Cloudflare WAF 规则供人工批准，并提供无代理漏洞扫描。

问题

Fail2ban and other local firewalls cannot block attackers when services are behind a Cloudflare tunnel because the real client IP is only present in HTTP headers, not at the network layer.

结果

Warden enabled accurate detection of attackers behind Cloudflare tunnels, prevented accidental self‑bans, and consolidated security tooling into a single, lightweight, agentless system.

工作流

• 1. Collect logs from CrowdSec, reverse proxy, SSO, and Cloudflare tunnel.
• 2. Parse and score events to identify potential attackers.
• 3. Record proposed bans without applying them automatically.
• 4. Post proposals to Discord for review.
• 5. Upon approval, add a Cloudflare WAF rule that expires after 30 days; record rejections for 90 days.
• 6. Continuously update device inventory and DNS baselines to refine scoring.

证据

Behind the tunnel, the source address at the network layer is cloudflared or the Cloudflare edge. The attacker's real address only exists in the HTTP layer, in a header the proxy passes along.

来源

Warden ships detect-only. It records what it would ban and changes nothing. When I want something blocked at the edge, it proposes it in Discord and I tap ✅ or ❌.

来源

Everything it does is agentless. Vulnerability scanning copies the package list off each box and checks it against OSV.dev...

来源