Cloudflare in front of a VPS: DNS, proxy and SSL done right

Cloudflare is very often used in front of a website hosted on a VPS: fast free DNS, a certificate, caching and web traffic filtering. But a rough configuration causes redirect loops, skews your logs and breaks game servers. This guide walks through the settings that matter.

1. Orange cloud or grey cloud

In Cloudflare's DNS tab, every A, AAAA or CNAME record has a toggle:

• Grey cloud, "DNS only": Cloudflare simply answers with your VPS address. Visitors connect directly to the server.
• Orange cloud, "Proxied": Cloudflare answers with its own addresses. Visitors connect to Cloudflare, which relays requests to your VPS. The server address is hidden, and Cloudflare's cache and web application firewall apply.

2. When to enable the proxy

Cloudflare's standard proxy only relays web traffic, HTTP and HTTPS, on a specific list of ports including 80, 443, 8080 and 8443. Nothing else gets through.

A play.mysite.com record with the orange cloud does not work: players cannot connect, because Cloudflare does not accept their game traffic. To protect a game server you need network-level Anti-DDoS protection, not the web proxy.

3. The right SSL mode: Full (strict)

In SSL/TLS → Overview, Cloudflare offers several modes. Only one is both secure and free of pitfalls:

• Flexible: encrypted between the visitor and Cloudflare, unencrypted between Cloudflare and your server. If your server itself redirects to HTTPS, you get an infinite redirect loop. Avoid it.
• Full: encrypted end to end, but Cloudflare accepts any certificate on the server, even an expired one.
• Full (strict): encrypted end to end with a valid certificate on the server. This is the mode to choose.

For the server certificate you have two options: a Let's Encrypt certificate obtained with Certbot, which also works behind the proxy (see Nginx and HTTPS), or a Cloudflare origin certificate, free and valid for up to 15 years, trusted only by Cloudflare, generated in SSL/TLS → Origin Server.

4. Get the real visitor address back

Behind the proxy, your server sees every request coming from Cloudflare addresses. Your logs, your statistics, Fail2ban and rate limiting become useless. Cloudflare passes the real address in the CF-Connecting-IP header: tell Nginx to trust it, only when the request comes from Cloudflare. Create /etc/nginx/conf.d/cloudflare.conf:

# IPv4 and IPv6 ranges published by Cloudflare at cloudflare.com/ips
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
# ... one line per published range ...
set_real_ip_from 2400:cb00::/32;
real_ip_header CF-Connecting-IP;

Copy the full, up-to-date list from Cloudflare's official IP ranges page; it rarely changes, but it does change. Then reload Nginx with nginx -t && systemctl reload nginx. If you use Fail2ban behind Cloudflare, note that a ban in the server firewall does not block a visitor coming through the proxy: see advanced Fail2ban.

5. Protect the origin address

The proxy only protects your server as long as its address stays unknown. It often leaks through:

• a grey-cloud subdomain on the same server, such as ftp, mail or panel;
• the headers of emails sent directly by the server;
• DNS history: if the domain pointed to this server before the proxy was enabled, the old address is archived by public services.

To go all the way, only allow Cloudflare's address ranges on ports 80 and 443 in the server firewall. Any attempt to bypass the proxy is then refused. See configuring UFW.

6. Cache and rules

By default, Cloudflare caches static files (images, CSS, JavaScript) but not HTML. Two practical consequences:

• After changing CSS or JavaScript, rename the file or add a version parameter, for example style.css?v=2, or purge the cache in the dashboard.
• Never cache admin, account or cart pages. If you create cache rules for HTML, exclude them explicitly.

7. Cloudflare and the VPS Anti-DDoS protection

The two complement each other. Cloudflare protects the web traffic that goes through its proxy. The Anti-DDoS protection on our VPS filters all traffic reaching the server address, including game traffic, SSH and attacks aimed directly at the origin address. For a website, the two add up; for a game server, the network protection does the work. See limiting the impact of a DDoS attack.

Frequently asked questions