Combine Cloudflare and VeryCloud Netrix Anti-DDoS

Put Cloudflare in front of your VeryCloud VPS without breaking the native Netrix protection. This guide explains why and how to combine both protection layers, properly configure allowed IPs and get the best of both worlds.

Introduction

Many VeryCloud customers ask: "Should I put Cloudflare in front of a VPS that already has Netrix Anti-DDoS?". Short answer: yes, for HTTP/HTTPS web, but with some precautions.

Why combine both

Together: Netrix eats massive network-level attacks, Cloudflare filters anything that passes at the application level (bots, brute-force, scrapers).

Prerequisites

• A VeryCloud VPS (Netrix protection is included in all plans)
• A domain name
• A website running on the VPS (Nginx, Apache, IIS)
• A free Cloudflare account

Step 1: Understand the topology

Without Cloudflare:

Client → [Internet] → Netrix (VeryCloud) → VPS

With Cloudflare in front:

Client → [Internet] → Cloudflare → [Internet] → Netrix → VPS

Cloudflare becomes the front proxy. Your visitors see the Cloudflare IP, not your VPS IP. Netrix keeps protecting non-HTTP ports (SSH, FTP, Game).

Step 2: Configure Cloudflare

Add your domain

1. Create an account on https://cloudflare.com (free)
2. Add a Site → enter your-domain.com
3. Choose the Free plan (widely sufficient to start)
4. Cloudflare automatically scans your DNS

Change nameservers

Cloudflare gives you 2 NS (e.g. lina.ns.cloudflare.com, mark.ns.cloudflare.com).

At your registrar (OVH, Gandi, Cloudflare Registrar, etc.):

• Find the DNS Servers or Nameservers option
• Replace current NS with Cloudflare's
• Save

Wait 1-24h for propagation.

Step 3: Enable Cloudflare proxy (orange cloud)

In DNS → Records at Cloudflare:

Type    Name       Value           Proxy
A       @          82.26.157.10    Proxied (orange)  ← HTTPS/HTTP
A       www        82.26.157.10    Proxied (orange)
A       ssh        82.26.157.10    DNS only (gray)   ← SSH non-proxiable
A       mail       82.26.157.10    DNS only (gray)   ← Mail non-proxiable
A       fivem      82.26.157.10    DNS only (gray)   ← Gaming non-proxiable

Golden rule:

• Web (80/443) → Proxied (orange)
• SSH, FTP, Mail, Gaming, RDP → DNS only (gray)

Cloudflare does not proxy non-HTTP protocols on Free plan (except Spectrum, paid).

Step 4: Configure SSL

SSL/TLS → Overview → Mode:

• Flexible: Client→Cloudflare in HTTPS, Cloudflare→VPS in HTTP. Avoid (false security feeling).
• Full: End-to-end HTTPS, but accepts self-signed VPS certificate.
• Full (Strict): End-to-end HTTPS with valid VPS certificate. Recommended.

Install a valid certificate on the VPS

Method 1: Let's Encrypt via Certbot (if DNS is temporarily DNS only)

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com -d www.your-domain.com

Method 2: Cloudflare Origin Certificate (recommended, valid 15 years)

On Cloudflare: SSL/TLS → Origin Server → Create Certificate

• Hostnames: *.your-domain.com, your-domain.com
• Validity: 15 years

Download the .pem and private key, copy them to the VPS:

sudo nano /etc/ssl/cloudflare/cert.pem  # paste certificate
sudo nano /etc/ssl/cloudflare/key.pem   # paste private key

Configure Nginx:

server {
    listen 443 ssl http2;
    server_name your-domain.com;

    ssl_certificate /etc/ssl/cloudflare/cert.pem;
    ssl_certificate_key /etc/ssl/cloudflare/key.pem;

    # Rest of your config
}

Once in place, switch to Full (Strict) on Cloudflare.

Step 5: Restrict direct VPS access to Cloudflare IPs

This is the CRITICAL step. Without it, an attacker who discovers your VPS real IP completely bypasses Cloudflare and attacks directly.

Get the up-to-date Cloudflare IP ranges:

# IPv4
curl -s https://www.cloudflare.com/ips-v4

# IPv6
curl -s https://www.cloudflare.com/ips-v6

With UFW

# Block everything on 80 and 443
sudo ufw deny 80/tcp
sudo ufw deny 443/tcp

# Allow only Cloudflare IPs
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    sudo ufw allow from $ip to any port 80,443 proto tcp
done

for ip in $(curl -s https://www.cloudflare.com/ips-v6); do
    sudo ufw allow from $ip to any port 80,443 proto tcp
done

Direct iptables

for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -s $ip -j ACCEPT
done
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP

Persist:

sudo apt install -y iptables-persistent
sudo netfilter-persistent save

Auto-update script

Cloudflare sometimes adds new ranges. Automate:

sudo nano /usr/local/bin/update-cloudflare-ufw.sh

#!/bin/bash
# Clean old Cloudflare rules
ufw status numbered | grep -i "cloudflare" | awk '{print $1}' | tr -d ']' | sort -rn | xargs -I {} ufw --force delete {}

# Re-add
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    ufw allow from $ip to any port 80,443 proto tcp comment "Cloudflare IPv4"
done

for ip in $(curl -s https://www.cloudflare.com/ips-v6); do
    ufw allow from $ip to any port 80,443 proto tcp comment "Cloudflare IPv6"
done

sudo chmod +x /usr/local/bin/update-cloudflare-ufw.sh
sudo crontab -e

0 5 * * * /usr/local/bin/update-cloudflare-ufw.sh

Step 6: Recover real visitor IPs on the VPS

Without configuration, Nginx sees all requests coming from Cloudflare IPs. To recover the real visitor IP, add to your Nginx config:

# /etc/nginx/conf.d/cloudflare-real-ip.conf

# IPv4 Cloudflare
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

# IPv6 Cloudflare
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;

real_ip_header CF-Connecting-IP;

Reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

From now on, your Nginx logs show the real visitor IP, not the Cloudflare one.

Step 7: Configure Netrix for non-HTTP protocols

Netrix keeps protecting SSH, FTP, Game, Mail. No action needed: it's active by default.

In the VeryCloud customer area, you can:

• Configure default open ports
• Enable/disable protection for certain ports
• See blocked attack statistics

Step 8: Enable Cloudflare WAF (optional)

Security → WAF → Managed rules:

• Enable Cloudflare Managed Ruleset (free on Free plan, partial)
• Choose Medium or High sensitivity based on your tolerance

For custom rules, Custom rules let you block/challenge specific patterns (e.g. block all countries except France).

Step 9: Enable cache (perf)

Caching → Configuration → Browser Cache TTL: 4 hours

Caching → Tiered Cache: Enabled (free)

Speed → Optimization → Auto Minify: check CSS, JS, HTML

Effect: your site loads 30-50% faster, and traffic to your VPS is reduced.

Step 10: Test the configuration

Verify Cloudflare is proxying

curl -I https://your-domain.com

Expected headers:

Server: cloudflare
CF-RAY: xxxxxxxxxxxx-CDG

Verify VPS no longer accepts direct HTTP

From a non-Cloudflare IP (your PC):

curl -I http://VPS_IP/
# Should timeout or return connection refused

Verify other protocols still work

SSH (via Netrix):

ssh user@VPS_IP  # Should work

Troubleshooting

525 or 526 error on Cloudflare

SSL between Cloudflare and your VPS fails.

• 525: no certificate on VPS → install Let's Encrypt or Origin Certificate
• 526: invalid certificate → temporarily switch Cloudflare to Full instead of Full (Strict), or install a valid cert

522 / 524 error

Cloudflare can't reach the VPS.

• 522: connection refused → check UFW and that Nginx listens on 443
• 524: timeout → your app takes too long to respond, optimize

Saturated gaming traffic

If you wrongly proxy a FiveM or Minecraft subdomain through Cloudflare, it won't work (except with Spectrum, paid).

Solution: switch this subdomain to DNS only (gray cloud).

Cloudflare IPs blocked by Netrix

Rare case, but can happen after an update. Open a VeryCloud support ticket to verify Cloudflare ranges are properly whitelisted at Netrix.

Useful commands

# Verify a request goes through Cloudflare
curl -I https://your-domain.com | grep -i cf-ray

# View real IPs in Nginx logs
sudo tail -f /var/log/nginx/access.log

# Test a UFW block
sudo ufw status numbered

# Force Cloudflare cache purge (API)
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
    -H "Authorization: Bearer YOUR_API_TOKEN" \
    -H "Content-Type: application/json" \
    --data '{"purge_everything":true}'

# Up-to-date Cloudflare IPs list
curl -s https://www.cloudflare.com/ips-v4
curl -s https://www.cloudflare.com/ips-v6

Conclusion

You now have a dual protection layer on your VeryCloud VPS:

• Cloudflare mitigates anything HTTP/HTTPS (bots, scrapers, L7 DDoS)
• Netrix mitigates anything volumetric L3/L4 (UDP flood, SYN flood, gaming attacks)

This is the configuration used by most professional websites. For pure gaming servers (without web), Netrix is largely sufficient and Cloudflare adds nothing.

Resources

• Cloudflare IPs: https://www.cloudflare.com/ips/
• Cloudflare documentation: https://developers.cloudflare.com
• VeryCloud Netrix Anti-DDoS: https://verycloud.fr/as198825
• VeryCloud guide — Domain DNS: https://verycloud.fr/docs/article/config-dns-domaine