Last active
March 3, 2024 20:02
-
-
Save cicku/f9f2531ee2a4d7d73803b235e7834a6d to your computer and use it in GitHub Desktop.
Cloudflare IP list with nftables
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://www.cloudflare.com/ips-v4/ | |
| define cfv4 = {173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://www.cloudflare.com/ips-v6 | |
| define cfv6 = {2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Must have China Network enabled, IP changes are regular from JD Cloud, this file is for demonstration only! | |
| # https://api.cloudflare.com/client/v4/ips | |
| define jdv4 = {14.204.96.192/27,14.204.96.224/27,27.36.126.192/27,27.36.126.224/27,27.128.218.192/27,27.128.218.224/27,36.136.95.0/27,36.136.95.32/27,36.147.52.128/27,36.147.52.160/27,36.154.11.224/27,42.81.59.0/26,42.81.59.64/26,42.236.121.128/27,42.236.121.160/27,58.243.179.64/27,58.243.179.96/27,60.13.99.0/26,60.13.99.64/26,61.159.93.0/27,61.159.93.32/27,61.159.93.128/27,61.159.93.160/27,101.69.205.192/27,101.69.205.224/27,103.44.252.0/27,103.44.252.32/27,103.114.102.192/27,103.114.102.224/27,111.62.54.128/27,111.62.54.160/27,111.170.27.64/27,111.170.27.96/27,112.21.164.64/27,112.29.217.64/27,112.29.217.96/27,112.49.47.64/27,112.49.47.96/27,113.56.217.64/27,113.56.217.96/27,113.240.104.128/26,113.240.104.192/26,114.67.161.0/28,114.67.161.32/27,114.67.161.64/28,114.67.161.80/28,114.67.192.192/28,114.67.192.208/28,116.163.41.0/26,116.163.41.64/26,116.177.241.192/27,116.177.241.224/27,116.198.49.128/28,116.198.49.144/28,116.198.165.0/28,116.198.165.16/28,119.0.67.0/27,119.0.67.32/27,119.188.204.0/27,119.188.204.32/27,120.206.188.192/27,120.206.188.224/27,120.220.55.64/27,120.220.55.96/27,120.241.124.64/27,120.241.124.96/27,121.17.125.0/27,121.17.125.32/27,122.226.163.192/27,122.226.163.224/27,124.166.232.0/27,124.166.232.32/27,124.225.84.0/27,124.225.84.32/27,150.138.153.128/26,150.138.153.192/26,171.15.37.128/27,171.15.37.160/27,182.201.240.192/27,182.201.240.224/27,182.242.62.128/27,182.242.62.160/27,183.131.87.192/27,183.131.87.224/27,183.248.220.128/27,183.248.220.160/27,198.41.130.0/28,198.41.130.16/28,218.207.1.0/27,218.207.1.32/27,221.10.20.0/27,221.10.20.32/27} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Must have China Network enabled, IP changes are regular from JD Cloud, this file is for demonstration only! | |
| # https://api.cloudflare.com/client/v4/ips | |
| define jdv6 = {,2400:cb00:164:0:1000::/68,2402:db40:51b5:10::/64,2403:1ec0:1400:ff01::/64,2403:1ec0:1400:ff05::/64,2403:1ec0:1400:ff10::/64,2403:1ec0:1610:ff05::/64,2408:8266:aa01:1:1000::/68,2408:8719:64:50:1000::/68,2408:871a:8810:205:1000::/68,2408:8720:806:102:1000::/68,2408:8726:3000:fff4:1000::/68,2408:8744:1000:9:1000::/68,2408:8752:600:6:1000::/68,2408:8756:4cff:d002:1000::/68,2408:8760:107:2:1000::/68,2408:876c:2c0:112:1000::/68,2409:8720:4001:2:1000::/68,2409:8728:5eff:100d:1000::/68,2409:8760:1e81:52:1000::/68,2409:8c04:1104:8:1000::/68,2409:8c34:d00:6:1000::/68,2409:8c38:c50:604:1000::/68,2409:8c3c:1400:5:1000::/68,2409:8c54:4010:27:1000::/68,2409:8c5c:b00:206:1000::/68,240e:b1:9801:20d:1000::/68,240e:c2:1800:14e:1000::/68,240e:f7:4d0f:601:1000::/68,240e:f7:7c00:821:1000::/68,240e:90d:1101:203:1000::/68,240e:914:6:d:1000::/68,240e:928:101:300:1000::/68,240e:935:a00:1706:1000::/68,240e:935:a00:1707:1000::/68,240e:938:a05:22:1000::/68,240e:93c:20a:2:1000::/68,240e:944:8:5:1000::/68,240e:94c:4000:1602:1000::/68,240e:95d:c02:7:1000::/68,240e:97c:4014:102:1000::/68} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/nft -f | |
| # Copyright 2024 Christopher Meng | |
| # | |
| # This is an example nftables config file for only allowing Cloudflare IPs | |
| include "/etc/nftables/*.nft" | |
| table inet filter | |
| delete table inet filter | |
| table inet filter { | |
| set cfv4 { | |
| type ipv4_addr | |
| flags interval | |
| elements = $cfv4 | |
| } | |
| set cfv6 { | |
| type ipv6_addr | |
| flags interval | |
| elements = $cfv6 | |
| } | |
| set jdv4 { | |
| type ipv4_addr | |
| flags interval | |
| elements = $jdv4 | |
| } | |
| set jdv6 { | |
| type ipv6_addr | |
| flags interval | |
| elements = $jdv6 | |
| } | |
| chain input { | |
| type filter hook input priority filter | |
| policy drop | |
| tcp dport http ip saddr {@cfv4, @jdv4} accept | |
| tcp dport http ip6 saddr {@cfv6, @jdv6} accept | |
| tcp dport https ip saddr {@cfv4, @jdv4} accept | |
| tcp dport https ip6 saddr {@cfv6, @jdv6} accept | |
| counter | |
| } | |
| chain forward { | |
| type filter hook forward priority filter | |
| policy drop | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment