Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Weird SSH Probes from Cloudflare IPs

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Ask HN: Weird SSH Probes from Cloudflare IPs

#11

Post by nousermane »

speedgoose wrote: post #5

By the way, unless you run a honey pot, you should probably only allow a few IP ranges for SSH in your firewall.

Yep. And paranoid folk, like myself, may consider adding a set of iptables rules to deny-list IPs originating this sort of junk traffic, wholesale:

  ipset create n hash:net

  -A INPUT -m set --match-set n src -j DROP
  -A INPUT -p tcp -m multiport -j n \
    --dports 22,23,25,445,1433,3389,8080
  -A n -j SET --add-set n src
  -A n -j DROP

Re: Ask HN: Weird SSH Probes from Cloudflare IPs

#12

Post by viraptor »

johnklos wrote: post #10
onlyspaceghost wrote: post #8

Earlier quoted context omitted.

That IP list does not contain warp ip addresses. It contains IPs that are used in cloudflare networks such as Proxying with the orange cloud or tunnels The point of that list is if you are behind a cloudflare proxy in some form and only want to allow traffic from cloudflare

That's nice, but that page doesn't say that at all nor suggest anything remotely close. The URL itself implies that it's not specific to any service. They say, quite confusingly and unaccurately, "This page is intended to be the definitive source of Cloudflare’s current IP ranges." That page really should say what it's for.

The page was created before warp and workers existed, so the description was valid at the time. They did fail to update it. If we say "cloudflare bad" 3 times, maybe jgc will appear and get someone to fix it.

Re: Ask HN: Weird SSH Probes from Cloudflare IPs

#16

Post by eastdakota »

johnklos wrote: post #9
skonteam wrote: post #6

Earlier quoted context omitted.

Yeah, you are right probably someone behind the WARP vpn, i didn't know they allowed SSH trafic through that. What is surprising is that the IPs i am seeing do not match any of the ranges Cloudflare is publishing on that link (typically as sub range of 8.0.0.0/8).

VPNs aren't supposed to block traffic, so there'd be no good reason to block ssh unless you suspect your clients are malicious. As to why Cloudflare's 8.37.43.0/24, 8.39.18.0/24, 8.40.140.0/24 and 8.42.172.0/24 networks aren't on that page which purports to be the "definitive source of Cloudflare’s current IP ranges", all I can say is that Cloudflare has a long history of caring much more about the appearance of tran…

That page is for the IPs that customers should whitelist as the source of traffic from our proxy services. These IPs are for Cloudflare WARP (our VPN-like app) and should not be whitelisted by customers in the same way. That's why they're not on that page.

Re: Ask HN: Weird SSH Probes from Cloudflare IPs

#18

Post by ehPReth »

speedgoose wrote: post #5

By the way, unless you run a honey pot, you should probably only allow a few IP ranges for SSH in your firewall.

Question to you and the broader HN...

Is there a way to allowlist whole ASNs? I know you can't do it directly with like iptables/ebtables/etc but is there a daemon for that that'll watch for changes to them? I'd like to allowlist my cellular provider and my home ISP for example but they have a lot of ranges and sometimes introduce new prefixes

Re: Ask HN: Weird SSH Probes from Cloudflare IPs

#19

Post by speedgoose »

ehPReth wrote: post #18
speedgoose wrote: post #5

By the way, unless you run a honey pot, you should probably only allow a few IP ranges for SSH in your firewall.

Question to you and the broader HN... Is there a way to allowlist whole ASNs? I know you can't do it directly with like iptables/ebtables/etc but is there a daemon for that that'll watch for changes to them? I'd like to allowlist my cellular provider and my home ISP for example but they have a lot of ranges and sometimes introduce new prefixes

I think it would be more convenient to use a VPN like tailscale, or a bastion like teleport.

Re: Ask HN: Weird SSH Probes from Cloudflare IPs

#20

Post by RunningDroid »

cpach wrote: post #17
speedgoose wrote: post #5

By the way, unless you run a honey pot, you should probably only allow a few IP ranges for SSH in your firewall.

Even better: Put the SSH port behind WireGuard/Tailscale.

That's basically what I do, nftables is configured to drop most* incoming traffic unless it's coming from wg0.

*: with the exception of wireguard's ports, transmission's non-admin ports, etc

Post reply on HN