How to only allow Cloudflare traffic

On your cPanel VPS, Cloudflare may be enabled on all accounts, and you wish to allow Cloudflare traffic only on ports 80/443. The easiest method will be using CSF to close both ports 80 and 443 then opening it only for Cloudflare.

Install Config Server Firewall (CSF)

dnf install cpanel-csf

Log in to your server’s WHM and go to “ConfigServer Security & Firewall”

Disable Testing Mode

You will need to go to Firewall Configuration and disable testing mode

Close ports 80 and 443

After this, you need to adjust your TCP and UDP to close ports 80 and 443.

TCP Incoming Configuration

20,21,22,25,53,110,143,465,587,853,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,8443

UDP Incoming Configuration

20,21,53,853

Go to the bottom and click Change, then Restart csf+lfd

Allow Cloudflare IPs

Now you need to allow Cloudflare IPs. Go to the IP Allow section and add the following at the bottom:

# Cloudflare IPs
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22
2400:cb00::/32
2606:4700::/32
2803:f800::/32
2405:b500::/32
2405:8100::/32
2a06:98c0::/29
2c0f:f248::/32

Please refer to Cloudflare documentation for the latest IPs.

Go to the bottom and click Change, then Restart csf+lfd

Your server should now only allow traffic from Cloudflare on ports 80 and 443.