We have a use case where we wanted to allow only traffic from Cloudflare to the AWS application load balancer, which is the origin for the sub-domains which we have set up in Cloudflare. Anything which is not coming from Cloudflare should be blocked.

The complexity is that we have few services which are associated with this ALB but they are not routed from Cloudflare.

We have thought different scenarios listed below. But they have their pros and cons. We wanted to know what would be the ideal way to achieve this in this scenario.

  1. Argo Tunnel - A VPN Tunnel between Cloudflare and the origin web server. A daemon should be running on the origin web server to support this. It will not work with ALB.

  2. Origin Pull - A Client-authenticated TLS handshake method.

  3. Cloudflare IP - We will use WAF before ALB to whitelist only cloudflare IP.

  • 1
    Hello Mohit. I think you're mixing two things here - the rule for traffic only from cloudflare to ALB and the rule, and the exception for your applications which are not sending traffic from cloudflare that still need to be associated with the load balancer. I think it would help if you could take another look at wording the question with the actual problem you are facing, instead of an ancillary one which arises from your need. – Bruce Becker Dec 5 '18 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.