[RHEL] 클라우드플레어 방화벽 설정

RHEL(Red Hat Enterprise Linux)에서 클라우드 플레어 서버의 아이피 대역만 방화벽에서 허용하도록 설정하는 방법은 아래와 같다.

방화벽 설정

HTTPS(Hypertext Transfer Protocol Secure) 통신이 443번 포트로 클라우드 플레어와 이루어지도록 방화벽을 설정하는 명령어는 아래와 같다. 

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="103.21.244.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="103.22.200.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="103.31.4.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="104.16.0.0/13" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="104.24.0.0/14" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="108.162.192.0/18" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="131.0.72.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="141.101.64.0/18" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="162.158.0.0/15" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.64.0.0/13" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="173.245.48.0/20" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="188.114.96.0/20" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="190.93.240.0/20" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="197.234.240.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="198.41.128.0/17" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2400:cb00::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2606:4700::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2803:f800::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2405:b500::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2405:8100::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2a06:98c0::/29" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2c0f:f248::/32" port protocol="tcp" port="443" accept"
firewall-cmd --reload

방화벽 설정 명령어가 실행된 화면

설정 확인

아래의 명령어를 입력하여 방화벽 설정이 잘 적용되었는지 확인한다.

firewall-cmd --list-all

방화벽 설정을 확인한 화면

참고문서

1. "[CentOS 7/8] 클라우드 플레어만 서비스 받을 수 있도록 접근 제한", 공학코드, 2021년 4월 18일. @원문보기
2. "[IIS 10.0] 클라우드 플레어 서버만 접근할 수 있도록 접근 제한", 공학코드, 2021년 3월 30일. @원문보기