导航|地址|刷新
Cloudflare IP addresses

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/fundamentals/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






Cloudflare Fundamentals

/




Overview


Concepts


How Cloudflare DNS works

Traffic flow through Cloudflare

Accounts, zones, and profiles

Cloudflare IP addresses





Get started


Accounts


Create account


Account security


Add abuse contact

Allow Cloudflare access

Leaked Password Notifications

Manage active sessions

Review audit logs - v1

Audit Logs - v2


SCIM provisioning


Overview

Authentik

Microsoft Entra

Okta

Troubleshooting





Secure compromised account

Set up SSO ↗

Zone holds





Find account and zone IDs

Change Super Administrator






OrganizationsBeta


Overview

Organizations for Enterprise

Organizations for MSSP and Distributors

Policy sharing

Limitations and troubleshooting






Members and permissions


Members and permissions

Manage

Policies

Roles

Role scopes

User GroupsNew

Set up dashboard SSO






User profiles


Overview

Verify email address

Log in to Cloudflare

Profile settings

Account recovery

Delete your Cloudflare account

Email address and password

Multi-Factor Email Authentication

Two-factor authentication






Domains


Overview

Add multiple sites via automation

Change your domain version

Manage subdomains

Move a domain between Cloudflare accounts

Onboard a domain

Pause Cloudflare

Redirect one domain to another

Remove a domain

Star domains






Performance


Improve SEO

Maintenance mode

Minimize downtime

Optimize site speed ↗

Prepare for surges or spikes in web traffic ↗

Test speed






Security


Prevent DDoS attacks ↗

Protect your origin server

Recovering from a hacked site

Scan for PCI compliance

Secure your website ↗

Under a DDoS attack?






Cloudflare's API



Get started


Create API token

Get Global API key (legacy)

Get Origin CA keysDeprecated

Token formats

Account API tokens






How to


Make API calls

Create tokens via API

Control API Access

Restrict tokens

Roll tokens

API token template URLs






Reference


REST API ↗API

GraphQL API ↗

Wrangler API ↗

API token permissions

API deprecations

API token templates

Rate limits

SDKs





Troubleshooting






OAuth Applications on Cloudflare


Overview

Create your OAuth client

Integrate your OAuth client with Cloudflare

Authorizing an application






Reference



Migration guides


SCIM migration






Policies


Cloudflare Cookies

Compliance documentation

Content Security Policies (CSPs)

Delivering Videos with Cloudflare

Licenses

Project Cybersafe Schools






Abuse


Overview

Review abuse policies

Complaint types

Providing specific URLs

Customer abuse report obligations

View and submit reports

Blocked Content





SDK ecosystem support policy

Troubleshooting

/cdn-cgi/ endpoint

Account and domain management best practices

Cloudflare and Google Analytics

Cloudflare crawlers

Cloudflare HTTP headers

Cloudflare Ray ID

Cloudy AI agentBeta

Connection limits

Cryptographic Attestation of Personhood

Error responses

Glossary

Markdown for AgentsBeta

Network Layers

Network ports

Partners

Redirects

Scans and penetration testing policy

TCP connections

Under Attack mode






RSS Feeds


Available RSS Feeds

Consuming RSS Feeds






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Cloudflare Fundamentals llms.txt ↗

Cloudflare Fundamentals llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/Cloudflare Fundamentals

/Concepts

/Cloudflare IP addresses



Cloudflare IP addresses


Last updated Apr 21, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewAllow Cloudflare IP addressesConfigure origin server Allowlist Cloudflare IP addresses Block other IP addresses (recommended)Review external tools Further protection Customize Cloudflare IP addresses IP range updatesAWS VPC routing conflict with Cloudflare IP ranges




When you add a domain to Cloudflare and proxy its DNS records, visitors who look up your domain receive a Cloudflare IP address instead of your origin server's real IP address. This hides your origin server's IP address and allows Cloudflare to optimize, cache, and protect all requests before forwarding them to you.

Cloudflare has several IP address ranges ↗ which are shared by all proxied hostnames. Together, these IP addresses form the backbone of Cloudflare's Anycast is a network addressing and routing method in which incoming requests can be routed to a variety of different locations. Anycast typically routes incoming traffic to the nearest data center with the capacity to process the request efficiently.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>anycast network — a routing method where the same IP address is announced from data centers worldwide, so each visitor's request is routed to a nearby data center.


Note


Cloudflare uses other IP ranges for various products and services, but these addresses will not make connections to your origin.




Allow Cloudflare IP addresses


All traffic to proxied DNS records passes through Cloudflare before reaching your origin server. This means that your origin server will stop receiving traffic from individual visitor IP addresses and instead receive traffic from Cloudflare IP addresses ↗, which are shared by all proxied hostnames.

To your origin server's firewall, this can look like a limited number of sources sending a high volume of traffic — which may trigger automatic blocking or Rate limiting is a technique used in computer systems to control the rate at which requests are processed. It can be used as a security measure to prevent attacks, or to limit resource usage in your origin servers.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>rate limiting. Because all visitor traffic appears to come from Cloudflare IP addresses, blocking these IPs — even accidentally — will prevent visitor traffic from reaching your application.

The guidance above applies to domains that use Cloudflare's HTTP proxy. Magic Transit works differently — instead of proxying web requests, it protects entire IP networks at the network layer. Cloudflare announces your IP address ranges (prefixes) via BGP so that all traffic destined for your network passes through Cloudflare for inspection and DDoS filtering before being forwarded to your infrastructure.


Configure origin server



Allowlist Cloudflare IP addresses


To avoid blocking Cloudflare IP addresses unintentionally, you also want to allow Cloudflare IP addresses at your origin web server.

You can explicitly allow these IP addresses with a .htaccess file ↗ or by using iptables ↗.

The following example demonstrates how you could use an iptables rule to allow a Cloudflare IP address range. Replace $ip below with one of the Cloudflare IP address ranges ↗. You will need to run this command once for each IP range listed on that page.
# For IPv4 addressesiptables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT# For IPv6 addressesip6tables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT
For more specific guidance, contact your hosting provider or website administrator.


Block other IP addresses (recommended)


If someone discovers your origin server's IP address — for example, through historical DNS records or mail server configuration — they could send traffic directly to your server, bypassing Cloudflare's security protections entirely. To prevent this, block all traffic that does not come from Cloudflare IP addresses or the IP addresses of your trusted partners, vendors, or applications.

For example, you might update your iptables ↗ with the following commands:
# For IPv4 addressesiptables -A INPUT -p tcp -m multiport --dports http,https -j DROP# For IPv6 addressesip6tables -A INPUT -p tcp -m multiport --dports http,https -j DROP
For more specific guidance, contact your hosting provider or website administrator.


Review external tools


To avoid blocking Cloudflare IP addresses unintentionally, review your external tools to check that:

Any security plugins — such as those for WordPress — allow Cloudflare IP addresses.

The ModSecurity ↗ plugin is up to date.


Further protection


For further recommendations on securing your origin server, refer to our guide on protecting your origin server.


Customize Cloudflare IP addresses


Enterprise customers who do not want to use Cloudflare IP addresses — which are shared by all proxied hostnames — have two potential alternatives:

Bring Your Own IP (BYOIP): Cloudflare announces your IPs (an IP address range you lease/own) in all of our locations ↗.

Static IP addresses: Cloudflare sets static IP addresses for your domain. For more details, contact your account team.

Business and Enterprise customers can also reduce the number of Cloudflare IPs that their domain shares with other Cloudflare customer domains by uploading a Custom SSL certificate.


IP range updates


Cloudflare's IP ranges do not change frequently. When they do change, they are added to our list of IP ranges ↗ before being put into production. You can also use the Cloudflare API to programmatically keep your configuration updated.


AWS VPC routing conflict with Cloudflare IP ranges


Cloudflare uses 172.64.0.0/13 (172.64.0.0–172.71.255.255) as public egress IP space. This range is not RFC 1918 private space. RFC 1918 covers 172.16.0.0/12 (172.16.0.0–172.31.255.255), which does not overlap with 172.64.0.0/13.

AWS VPC route tables sometimes include a route covering 172.16.0.0/12 (or a broader supernet such as 172.16.0.0/8) for Transit Gateway or VPN connectivity. If this route points to an internal target rather than an Internet Gateway, it can capture Cloudflare's 172.64.x.x traffic before it reaches the Internet Gateway, causing connection errors (521, 522) from Cloudflare data centers that use this range.

To resolve:

Check your AWS VPC route table for any route covering a 172.x.x.x range that routes to an internal target (Transit Gateway, VPN Gateway, NAT Gateway, or VPC peering connection).

Add a more-specific route with destination 172.64.0.0/13 targeting your Internet Gateway. More-specific routes take precedence in AWS routing.

Alternatively, narrow the broad route to exactly 172.16.0.0/12 (the RFC 1918 range), which does not include 172.64.0.0/13.

This issue does not appear in security group audits because security groups are evaluated at the instance level, not the routing layer.


PreviousAccounts, zones, and profilesNextGet started


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Allow Cloudflare IP addresses

Configure origin server

Allowlist Cloudflare IP addresses

Block other IP addresses (recommended)

Review external tools

Further protection

Customize Cloudflare IP addresses

IP range updates

AWS VPC routing conflict with Cloudflare IP ranges


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址