#Cloudflare DDoS Protection

When running an ARK node, especially a Delegate Node, you should consider your server’s security as your main priority.

#DDoS Protection With Cloudflare

In this section, we’re going to put your node’s public API behind Cloudflare with SSL for DDoS protection, using Nginx as a reverse proxy.

#Install Nginx

1sudo apt-get install -y nginx

#Cloudflare / SSL Setup

Login to your Cloudflare dashboard and add a DNS record for your node, for example node.yoursite.com, pointing to your server’s IP. Make sure the record is Proxied (orange cloud).

Then go to SSL/TLS and set the encryption mode to Full (strict), so the connection between Cloudflare and your server is encrypted and verified as well.

Go to SSL/TLS > Origin Server and click the Create Certificate button. Keep this window open after Cloudflare generates the certificate and private key.

Open a terminal on your ARK node server. We need to create a new folder and copy the certificate and key to our server:

1sudo mkdir -p /etc/nginx/ssl
2sudo nano /etc/nginx/ssl/ark.crt
3sudo nano /etc/nginx/ssl/ark.key
4sudo chmod 600 /etc/nginx/ssl/ark.key

Copy the Origin Certificate to the file ark.crt and the Private Key to ark.key.

#Edit Nginx Config

1sudo nano /etc/nginx/sites-available/ark-api

Paste in the following config, making sure you edit the server_name. You may need to change ssl_certificate and ssl_certificate_key if you name your files something different.

file: /etc/nginx/sites-available/ark-api

 1# HTTPS
 2server {
 3    listen 443 ssl;
 4    listen [::]:443 ssl;
 5    server_name node.yoursite.com;
 6 
 7    ssl_certificate /etc/nginx/ssl/ark.crt;
 8    ssl_certificate_key /etc/nginx/ssl/ark.key;
 9    ssl_protocols TLSv1.2 TLSv1.3;
10    ssl_prefer_server_ciphers off;
11 
12    location / {
13        proxy_pass http://127.0.0.1:4003/;
14        proxy_http_version 1.1;
15        proxy_set_header Host $host;
16        proxy_set_header X-Real-IP $remote_addr;
17        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
18        proxy_set_header X-Forwarded-Proto $scheme;
19        proxy_redirect off;
20    }
21}

Press CTRL+X to exit the file, Y to save the file, and ENTER to write to the file and return to the command line.

#Enable the Site and Start Nginx

1sudo ln -s /etc/nginx/sites-available/ark-api /etc/nginx/sites-enabled/ark-api
2sudo nginx -t
3sudo systemctl enable nginx
4sudo systemctl reload nginx

If nginx -t reports an error, fix it before reloading. If everything started fine, you should be able to access your ARK node API at https://node.yoursite.com/api, behind SSL and with Cloudflare’s DDoS protection.

#Only Allow Cloudflare

Your API is still reachable directly on port 4003, which bypasses Cloudflare. Close that port, and only allow HTTPS from Cloudflare’s IP ranges :

1sudo ufw delete allow 4003/tcp
2for ip in $(curl -fsSL https://www.cloudflare.com/ips-v4) $(curl -fsSL https://www.cloudflare.com/ips-v6); do
3    sudo ufw allow from "$ip" to any port 443 proto tcp
4done

Cloudflare occasionally changes these ranges, so check them now and then.

#Conclusion

Your node is now very secure. With this setup, you can open your SSH port remotely using a secret knocking technique, sign in using cryptographic keys, and your public API is shielded by Cloudflare.