Hiding Your Origin IP Behind a CDN: Stop Direct Attacks, Scanning, and Web Threats

When your server's IP is exposed on the public internet, anyone can bypass your defenses and hit it directly: launch DDoS floods, scan ports, and probe for holes. One of the biggest wins of putting a CDN in front of your site is that attackers can no longer see your real IP — their traffic lands on the CDN's scrubbing nodes instead.

Why Hide the Origin

• Block direct-to-origin attacks. A DDoS flood aimed straight at your origin will saturate a single VPS's bandwidth in seconds. A CDN spreads and filters that traffic across a distributed network.
• Stop scanning and probing. An exposed IP gets continuously scanned by Shodan and botnets for open ports like 22, 3306, or 6379. One weak password or unpatched service is all it takes.
• Shrink your attack surface. Behind a CDN, the public sees only the CDN's IP ranges. Your origin goes from "reachable by everyone" to "reachable only by the CDN."

Only the CDN's IP Should Be Visible

Once you route your domain through the CDN (usually by delegating DNS to it, or pointing your A/CNAME records at it), an external dig should return only CDN node addresses:

dig +short www.example.com
# This should return a CDN IP, never your VPS's real address

The key precondition: enable the "proxy / hide origin" option so the CDN actually proxies traffic, rather than merely resolving DNS.

Lock the Origin to CDN Pull IPs

Hiding the IP isn't enough — if an attacker guesses your real address and can still connect directly, the protection is worthless. So configure the origin firewall to accept traffic only from the CDN's origin-pull IP ranges. Every CDN publishes this list; add the ranges to an allowlist:

# Deny inbound by default; allow only the CDN pull ranges (example)
sudo ufw default deny incoming
sudo ufw allow from 203.0.113.0/24 to any port 443 proto tcp
sudo ufw allow from 198.51.100.0/24 to any port 443 proto tcp
sudo ufw allow OpenSSH        # restrict the management port by source too
sudo ufw enable

Now, even if your real IP leaks, a direct hit on 443 is dropped at the firewall. Caveat: CDN pull ranges change over time — sync the official list periodically, or you may accidentally block legitimate origin pulls.

Don't Let History Leak Your Real IP

The most common way to blow your cover is old traces that still point at the real address:

• Historical DNS records. Stale A records and subdomains (mail., ftp., direct.) may still resolve to the origin and are trivially found via services like SecurityTrails. Clean them up or move them behind the CDN.
• Email leaks. If the server sends its own mail, the Received headers carry its real IP. Switch to a third-party email API or a separate sending host.
• Other outbound traffic. Error reporters, webhooks, and SSRF probes can all call back from the real IP. The cleanest fix is to rotate to a fresh IP before enabling the CDN, retiring the old one entirely.

Web Protection at the CDN Edge

With the IP hidden, push your security policy out to the edge:

• WAF — block SQL injection, XSS, path traversal, and other known attack signatures.
• Rate limiting — throttle login, checkout, and other endpoints per IP/path to defeat credential stuffing and scrapers.
• CAPTCHA / bot challenges — trigger a challenge on anomalous traffic to filter out automated scripts.
• Geo and ASN blocking — cut off high-risk sources as needed.

When to Rotate Your IP

• The origin ran exposed for a long time before you added the CDN — the real IP is almost certainly on record.
• You found historical DNS or email leaks and can't confirm they're clean.
• You're already under a direct attack aimed at the real IP.

After rotating, always clean up every old record and set up the firewall allowlist first, then cut traffic over — otherwise the new IP gets exposed again just as fast.

Summary

Hiding your origin is a layered play: the CDN proxy ensures the outside world sees only CDN IPs, a firewall allowlist ensures your origin accepts only CDN origin-pull traffic, cleaning up historical DNS and email leaks closes the side channels, and the CDN's WAF, rate limiting, and CAPTCHAs stop attacks at the edge. Miss any one layer and the rest is wasted effort — and don't skip that one easily-overlooked but critical step of rotating to a clean IP.