Cloudflare AOP 隐藏自己网站的公网ip同时开放端口给公网供用户访问

docker ps
docker port <容器名称>

services:
  web:
    image: example/web:latest
    ports:
      - "127.0.0.1:3000:3000"

ss -lntp

curl -I http://127.0.0.1:3000/

mkdir -p ~/aop-certs
cd ~/aop-certs
umask 077

openssl genrsa -out aop-ca.key 4096

openssl req -x509 -new -sha256 \
  -key aop-ca.key \
  -days 3650 \
  -out aop-ca.pem \
  -subj "/CN=Example AOP CA"

openssl genrsa -out cf-aop-client.key 2048

openssl req -new \
  -key cf-aop-client.key \
  -out cf-aop-client.csr \
  -subj "/CN=Cloudflare AOP Client"

cat > client-ext.cnf <<'EOF'
basicConstraints=CA:FALSE
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=clientAuth
EOF

openssl x509 -req \
  -in cf-aop-client.csr \
  -CA aop-ca.pem \
  -CAkey aop-ca.key \
  -CAcreateserial \
  -out cf-aop-client.pem \
  -days 365 \
  -sha256 \
  -extfile client-ext.cnf

openssl verify -CAfile aop-ca.pem cf-aop-client.pem

cf-aop-client.pem: OK

openssl x509 -in cf-aop-client.pem \
  -noout -subject -issuer -dates -ext extendedKeyUsage

/etc/nginx/aop/aop-ca.pem

sudo install -d -m 755 /etc/nginx/aop
sudo install -m 644 aop-ca.pem /etc/nginx/aop/aop-ca.pem

sudo openssl x509 \
  -in /etc/nginx/aop/aop-ca.pem \
  -noout -subject -issuer -dates

sudo nano /etc/nginx/sites-available/example-aop

log_format aop_log
    '$time_iso8601 '
    'host="$host" '
    'status=$status '
    'verify=$ssl_client_verify '
    'subject="$ssl_client_s_dn" '
    'remote=$remote_addr';

server {
    listen 8443 ssl;
    server_name www.example.com;

    # 源站服务器证书，不是 AOP 客户端证书
    ssl_certificate     /etc/nginx/ssl/origin-fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/origin-private.key;

    # AOP 客户端证书验证的信任 CA
    ssl_client_certificate /etc/nginx/aop/aop-ca.pem;
    ssl_verify_depth 2;

    # 第一阶段：只记录验证情况，不立即强制拒绝
    ssl_verify_client optional;

    access_log /var/log/nginx/aop_access.log aop_log;

    location / {
        proxy_pass http://127.0.0.1:3000;

        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

sudo nginx -t

sudo systemctl reload nginx

sudo ss -lntp | grep ':8443'

curl -k -I \
  --resolve www.example.com:8443:127.0.0.1 \
  https://www.example.com:8443/

curl -I https://www.example.com/

sudo tail -f /var/log/nginx/aop_access.log

curl -I https://www.example.com/

sudo tail -n 100 /var/log/nginx/error.log

ssl_verify_client optional;

ssl_verify_client on;

sudo nginx -t &&
sudo systemctl reload nginx

sudo ufw status verbose
sudo ufw status numbered
sudo grep '^IPV6=' /etc/default/ufw

sudo apt-get update
sudo apt-get install -y curl python3 ufw

sudo install -d -m 700 /root/ufw-backups
sudo cp -a /etc/ufw/before.rules \
  /root/ufw-backups/before.rules.initial
sudo cp -a /etc/ufw/before6.rules \
  /root/ufw-backups/before6.rules.initial
sudo cp -a /etc/default/ufw \
  /root/ufw-backups/ufw-default.initial

sudo nano /usr/local/sbin/update-cloudflare-ufw.sh

#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

# Cloudflare-only ingress for TCP/8443.
# Default mode: validate and preview only.
# Apply changes with: --apply

V4_URL="https://www.cloudflare.com/ips-v4"
V6_URL="https://www.cloudflare.com/ips-v6"
PORT=8443

RULES4="/etc/ufw/before.rules"
RULES6="/etc/ufw/before6.rules"
STATE="/var/lib/cloudflare-ufw"
LOG="/var/log/update-cloudflare-ufw.log"
LOCK="/run/lock/update-cloudflare-ufw.lock"

MODE="${1:---check}"
if [[ "$MODE" != "--check" && "$MODE" != "--apply" ]]; then
  echo "Usage: $0 [--check|--apply]" >&2
  exit 2
fi

exec 9>"$LOCK"
flock -n 9 || {
  echo "Another update is running." >&2
  exit 1
}

mkdir -p "$STATE"
chmod 700 "$STATE"
touch "$LOG"
chmod 600 "$LOG"

log() {
  printf '[%s] %s\n' "$(date -Is)" "$*" | tee -a "$LOG"
}

TMP="$(mktemp -d)"
BACKUP=""
cleanup() { rm -rf "$TMP"; }
trap cleanup EXIT

rollback() {
  if [[ -n "$BACKUP" && -d "$BACKUP" ]]; then
    log "ERROR: restoring the previous UFW files"
    cp -a "$BACKUP/before.rules" "$RULES4"
    cp -a "$BACKUP/before6.rules" "$RULES6"
    if ! ufw reload; then
      log "CRITICAL: automatic reload after rollback failed"
      log "Check UFW manually before closing your management session"
    fi
  fi
}

on_error() {
  local rc=$?
  trap - ERR
  if [[ "$MODE" == "--apply" ]]; then
    rollback || true
  fi
  log "ERROR: update failed (exit=$rc); existing configuration should be retained or restored"
  exit "$rc"
}
trap on_error ERR

log "Downloading official Cloudflare IP lists"

curl --fail --silent --show-error --location \
  --connect-timeout 10 --max-time 30 \
  "$V4_URL" -o "$TMP/ips-v4"

curl --fail --silent --show-error --location \
  --connect-timeout 10 --max-time 30 \
  "$V6_URL" -o "$TMP/ips-v6"

# Validate both files before touching firewall configuration.
python3 - "$TMP/ips-v4" "$TMP/ips-v6" <<'PY'
import ipaddress, pathlib, sys

limits = [(4, 10, 40), (6, 5, 40)]
for filename, (version, minimum, maximum) in zip(sys.argv[1:], limits):
    raw = pathlib.Path(filename).read_text().splitlines()
    entries = [x.strip() for x in raw if x.strip()]
    if not minimum <= len(entries) <= maximum:
        raise SystemExit(
            f"Refusing update: IPv{version} count {len(entries)} "
            f"outside expected range {minimum}..{maximum}"
        )
    networks = []
    for line in entries:
        try:
            net = ipaddress.ip_network(line, strict=True)
        except ValueError as e:
            raise SystemExit(f"Invalid CIDR {line!r}: {e}")
        if net.version != version:
            raise SystemExit(f"Wrong address family: {line}")
        networks.append(str(net))
    if len(set(networks)) != len(networks):
        raise SystemExit(f"Duplicate IPv{version} ranges")
    pathlib.Path(filename).write_text("\n".join(networks) + "\n")
    print(f"IPv{version}: {len(networks)} valid CIDR ranges")
PY

# Require UFW's IPv6 support: otherwise IPv6 filtering is not guaranteed.
grep -Eq '^IPV6=yes$' /etc/default/ufw || {
  echo "UFW IPv6 support is not enabled; refusing to apply." >&2
  exit 1
}

# Refuse to take over files containing an ambiguous/duplicate managed block.
for f in "$RULES4" "$RULES6"; do
  [[ -f "$f" ]]
  [[ "$(grep -c '^# BEGIN CLOUDFLARE-8443-MANAGED$' "$f" || true)" -eq 0 ]]
  [[ "$(grep -c '^# END CLOUDFLARE-8443-MANAGED$' "$f" || true)" -eq 0 ]]
done

# Make sure there is no existing broad UFW allow for TCP/8443.
# This conservative check requires manual review if such a rule exists.
if ufw status 2>/dev/null | grep -Eiq \
  '8443(/tcp)?[[:space:]]+ALLOW|ALLOW.*8443(/tcp)?'; then
  echo "An existing UFW ALLOW rule mentioning 8443 was found." >&2
  echo "Review 'sudo ufw status numbered' and remove conflicting rules manually." >&2
  exit 1
fi

# Show what will be installed. No firewall files are changed in --check mode.
echo
echo "IPv4 ranges:"
cat "$TMP/ips-v4"
echo
echo "IPv6 ranges:"
cat "$TMP/ips-v6"
echo
echo "Target: TCP/$PORT; non-Cloudflare sources will be dropped."
echo "Mode: $MODE"

if [[ "$MODE" == "--check" ]]; then
  log "Validation successful; no firewall changes made"
  exit 0
fi

# Patch only the dedicated managed block in the filter table.
# Each family gets its own list and a final DROP for TCP/8443.
patch_rules() {
  local file="$1" list="$2" family="$3"
  python3 - "$file" "$list" "$family" "$PORT" <<'PY'
import pathlib, sys

path = pathlib.Path(sys.argv[1])
list_path = pathlib.Path(sys.argv[2])
family = int(sys.argv[3])
port = int(sys.argv[4])

text = path.read_text()
if "# BEGIN CLOUDFLARE-8443-MANAGED" in text or \
   "# END CLOUDFLARE-8443-MANAGED" in text:
    raise SystemExit(f"Managed block already exists in {path}; refusing to overwrite")

nets = list_path.read_text().splitlines()
lines = ["# BEGIN CLOUDFLARE-8443-MANAGED"]
for cidr in nets:
    opt = "-s" if family == 4 else "-s"
    lines.append(
        f"-A ufw-before-input -p tcp --dport {port} "
        f"{opt} {cidr} -j ACCEPT"
    )
lines.append(
    f"-A ufw-before-input -p tcp --dport {port} -j DROP"
)
lines.append("# END CLOUDFLARE-8443-MANAGED")

# Place rules in the filter table before its COMMIT line.
# Do not silently modify an unexpected file structure.
parts = text.splitlines()
start = next((i for i, line in enumerate(parts) if line.strip() == "*filter"), None)
if start is None:
    raise SystemExit(f"No *filter table in {path}")
end = next((i for i in range(start + 1, len(parts))
            if parts[i].strip() == "COMMIT"), None)
if end is None:
    raise SystemExit(f"No filter-table COMMIT in {path}")

parts[end:end] = lines
path.write_text("\n".join(parts) + "\n")
PY
}

BACKUP="$(mktemp -d /root/ufw-backups/cf-8443.XXXXXXXX)"
cp -a "$RULES4" "$BACKUP/before.rules"
cp -a "$RULES6" "$BACKUP/before6.rules"
chmod 700 "$BACKUP"

patch_rules "$RULES4" "$TMP/ips-v4" 4
patch_rules "$RULES6" "$TMP/ips-v6" 6

# Keep a record of exactly which official ranges were applied.
install -m 600 "$TMP/ips-v4" "$STATE/ips-v4"
install -m 600 "$TMP/ips-v6" "$STATE/ips-v6"

ufw reload

log "UFW reload succeeded; managed TCP/$PORT rules installed"
log "Backup directory: $BACKUP"
log "Review: sudo ufw status numbered"

for f in "$RULES4" "$RULES6"; do
  [[ -f "$f" ]]
  begin_count="$(grep -c '^# BEGIN CLOUDFLARE-8443-MANAGED$' "$f" || true)"
  end_count="$(grep -c '^# END CLOUDFLARE-8443-MANAGED$' "$f" || true)"

  if [[ "$begin_count" != "$end_count" ]] ||
     [[ "$begin_count" -gt 1 ]]; then
    echo "托管规则标记异常：$f" >&2
    exit 1
  fi
done

if "# BEGIN CLOUDFLARE-8443-MANAGED" in text or \   "# END CLOUDFLARE-8443-MANAGED" in text:    raise SystemExit(...)

begin = "# BEGIN CLOUDFLARE-8443-MANAGED"end = "# END CLOUDFLARE-8443-MANAGED"if text.count(begin) != text.count(end):    raise SystemExit("Unmatched managed block markers")if text.count(begin) > 1:    raise SystemExit("Duplicate managed blocks")if text.count(begin) == 1:    lines = text.splitlines()    first = lines.index(begin)    last = lines.index(end)    if last < first:        raise SystemExit("Invalid managed block order")    del lines[first:last + 1]    text = "\n".join(lines) + "\n"

sudo chmod 700 /usr/local/sbin/update-cloudflare-ufw.sh

sudo /usr/local/sbin/update-cloudflare-ufw.sh --check

sudo bash -n /usr/local/sbin/update-cloudflare-ufw.sh

sudo /usr/local/sbin/update-cloudflare-ufw.sh --check

sudo /usr/local/sbin/update-cloudflare-ufw.sh --apply

sudo ufw status verbose
sudo ufw status numbered

sudo grep -n -A25 -B2 \
  'CLOUDFLARE-8443-MANAGED' \
  /etc/ufw/before.rules

sudo grep -n -A25 -B2 \
  'CLOUDFLARE-8443-MANAGED' \
  /etc/ufw/before6.rules

sudo tail -n 50 /var/log/update-cloudflare-ufw.log

[Unit]
Description=Update Cloudflare IP ranges in UFW
Wants=network-online.target
After=network-online.target ufw.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/update-cloudflare-ufw.sh --apply
User=root
Group=root

[Unit]
Description=Daily Cloudflare UFW IP range update

[Timer]
OnCalendar=daily
RandomizedDelaySec=30m
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable --now update-cloudflare-ufw.timer

systemctl list-timers update-cloudflare-ufw.timer

sudo systemctl status update-cloudflare-ufw.service --no-pager
sudo journalctl -u update-cloudflare-ufw.service -n 100 --no-pager