ซ่อนเว็บเซอร์วิสไว้ข้างหลัง Cloudflare

# install ipset
apt -y install ipset iptables-persistent ipset-persistent curl

# get cloudflare IPs
mkdir -p /etc/zones/
curl -L -s https://www.cloudflare.com/ips-v4 -o /etc/zones/cf-ips-v4
curl -L -s https://www.cloudflare.com/ips-v6 -o /etc/zones/cf-ips-v6

# add cloudflare IPs to ipset
ipset -N cloudflare-ips-v4 hash:net
for i in $(cat /etc/zones/cf-ips-v4 ); do ipset -A cloudflare-ips-v4 $i; done
ipset -N cloudflare-ips-v6 hash:net family inet6
for i in $(cat /etc/zones/cf-ips-v6 ); do ipset -A cloudflare-ips-v6 $i; done

# allow only http/https from cloudflare ipv4
iptables -I INPUT -p tcp -m set --match-set cloudflare-ips-v4 src -m multiport --dports 80,443,8080,8443 -j ACCEPT
iptables -I INPUT -p udp -m set --match-set cloudflare-ips-v4 src -m multiport --dports 80,443,8080,8443 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8443 -j DROP
iptables -A INPUT -p udp -m multiport --dports 80,443,8080,8443 -j DROP

# allow only http/https from cloudflare ipv6
ip6tables -I INPUT -p tcp -m set --match-set cloudflare-ips-v6 src -m multiport --dports 80,443,8080,8443 -j ACCEPT
ip6tables -I INPUT -p udp -m set --match-set cloudflare-ips-v6 src -m multiport --dports 80,443,8080,8443 -j ACCEPT
ip6tables -A INPUT -p tcp -m multiport --dports 80,443,8080,8443 -j DROP
ip6tables -A INPUT -p udp -m multiport --dports 80,443,8080,8443 -j DROP

# save ipset configurations to /etc/iptables/ipsets
dpkg-reconfigure ipset-persistent

# save iptables and ip6tables configurations to /etc/iptables/rules.v{4|6}
dpkg-reconfigure iptables-persistent

curl -L -v -H "Host: your.domain" your.server.ip.address