Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Discuss
  3. Cloudflare Proxy - How to hide the IP of the mail subdomain and make it work

Cloudflare Proxy - How to hide the IP of the mail subdomain and make it work

Scheduled Pinned Locked Moved Discuss
mailcloudflare
16 Posts 3 Posters 4.2k Views 4 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • girishG Offline
    girishG Offline
    girish
    Staff
    wrote on last edited by
    #3

    The MX entry will still expose the mail server, no?

    BrutalBirdieB 1 Reply Last reply
    1
    • girishG girish moved this topic from Help Wanted or Offered on
    • girishG girish

      The MX entry will still expose the mail server, no?

      BrutalBirdieB Offline
      BrutalBirdieB Offline
      BrutalBirdie
      Partner
      wrote on last edited by
      #4

      @girish

      4238f7c5-7d12-44c4-8256-695b9e020161-image.png

      this is what my Cloudflare DNS Dashboard now looks like.

      Yes the MX still reveals the real IP.
      This is more like a small inconvenience for DNS scanners / script kiddies.

      Like my work? Consider donating a drink. Cheers!

      1 Reply Last reply
      0
      • BrutalBirdieB BrutalBirdie

        I don't want my IP broadcasted by the mail/my subdomain


        Why can't I hide my IP from the mail domain, either my.domain.tld or a custom one in my case mail.domain.tld, behind the Cloudflare proxy service?

        https://docs.cloudron.io/domains/#cloudflare-dns

        Email and HTTP Proxy
        If you use Cloudflare for your primary domain and enable Cloudron email for any domain, Cloudflare proxying must be disabled for the my subdomain. This is because Cloudflare will only proxy HTTP and not email protocol.

        fyi: this also applies for Teamspeak, OpenVPN and more apps that do not fall in the supported port ranges.
        The supported port ranges are documented below, so keep reading 😉


        There is a way, but this is more security via obscurity. So do not depend on this in any way.

        To put it in simple terms:
        This will not hide your IP address completely even though mail.domain.tld is set to Proxied! As soon a someone connects to your server, the origin IP will be revealed. But this setting prevents your server of being detected by DNS scanners, because they would see Cloudflare IPs.

        They have a product named Cloudflare Spectrum which aims to solve this problem. But only for Enterprise customers. So if you are one? Maybe check this out first?
        I did not get the opportunity to try it out and paying for enterprise hmmmm naah.

        First of all lets read some docs from Cloudflare - Supported port ranges:
        https://support.cloudflare.com/hc/en-us/articles/200169156-Identifying-network-ports-compatible-with-Cloudflare-s-proxy

        TL;DR

        By default, Cloudflare proxies traffic destined for the HTTP/HTTPS ports listed below.
        
        HTTP ports supported by Cloudflare:
        
            80
            8080
            8880
            2052
            2082
            2086
            2095
        
        HTTPS ports supported by Cloudflare:
        
            443
            2053
            2083
            2087
            2096
            8443
        
        Caching is disabled for the following ports:
        
            2052
            2053
            2082
            2083
            2086
            2087
            2095
            2096
            8880
            8443
        

        So what can we do?
        The answer is srv records.

        Sorry to my blind users but a few screenshots up ahead for context, but I followup with a text based short guide.

        Add 3 srv records for the ports listed in Connection details for other email clients
        https://my.domain.tld/#/email/domain.tld.
        Ports listed as of writing this: 993 & 587 & 4190

        62acd468-750b-4cd8-ab3a-178d1be12c79-image.png

        e1887109-7108-47b9-a49e-2b05160f5d67-image.png

        1c631aa6-e615-42c0-98a4-cd35302d18c3-image.png

        ecdfc77a-cff4-469e-a381-a690c724cdcb-image.png

        • Type: SRV
        • Name: mail (since I choose the custom mail subdomain. Aka the domain name for which this record is valid - default my)
        • Service: _mail 🤷 (the symbolic name of the desired service. Go wild)
        • Protocol: TCP (since the mail traffic is TCP)
        • TTL: auto
        • Priority: 0
        • Weight: 0
        • Port: 993 & 587 & 4190 (each, one SRV record)
        • Target: Your mail domain, in my case its mail.domain.tld (the canonical hostname of the machine providing the service)

        Now a nslookup will show Cloudflare Proxied IPs:

        nslookup mail.domtain.tld 1.1.1.1                                                               23:18:18
        Server:         1.1.1.1
        Address:        1.1.1.1#53
        
        Non-authoritative answer:
        Name:   mail.domtain.tld
        Address: 104.21.57.26
        Name:   mail.domtain.tld
        Address: 172.67.158.189
        Name:   mail.domtain.tld
        Address: 2606:4700:3036::6815:391a
        Name:   mail.domtain.tld
        Address: 2606:4700:3036::ac43:9ebd
        

        And here a little proof screenshot of me sending and receiving mails with this setup.

        1dfc3a5e-f4a8-4b3d-8422-2e8082ae930e-image.png

        Cheers,
        ~ BrutalBirdie 🍻

        BrutalBirdieB Offline
        BrutalBirdieB Offline
        BrutalBirdie
        Partner
        wrote on last edited by BrutalBirdie
        #5

        @robi I may need to revert my post, because as of today I can no longer get / send my mails.

        Damn. 😞

        SOGo and Thunderbird did not work anymore.
        I will have to dig a little deeper.

        Like my work? Consider donating a drink. Cheers!

        BrutalBirdieB robiR 2 Replies Last reply
        1
        • BrutalBirdieB BrutalBirdie

          @robi I may need to revert my post, because as of today I can no longer get / send my mails.

          Damn. 😞

          SOGo and Thunderbird did not work anymore.
          I will have to dig a little deeper.

          BrutalBirdieB Offline
          BrutalBirdieB Offline
          BrutalBirdie
          Partner
          wrote on last edited by
          #6

          After reading this forum post I assumed this would work as well
          https://community.cloudflare.com/t/teamspeak-setup/58035

          hmmm

          Like my work? Consider donating a drink. Cheers!

          1 Reply Last reply
          0
          • BrutalBirdieB BrutalBirdie

            @robi I may need to revert my post, because as of today I can no longer get / send my mails.

            Damn. 😞

            SOGo and Thunderbird did not work anymore.
            I will have to dig a little deeper.

            robiR Offline
            robiR Offline
            robi
            wrote on last edited by
            #7

            @brutalbirdie It may be good to ping someone at CF or find some docs that SRV records are supposed to do that and is a supported config.

            It may have worked for a while due to DNS propagation.

            Conscious tech

            BrutalBirdieB 1 Reply Last reply
            1
            • robiR robi

              @brutalbirdie It may be good to ping someone at CF or find some docs that SRV records are supposed to do that and is a supported config.

              It may have worked for a while due to DNS propagation.

              BrutalBirdieB Offline
              BrutalBirdieB Offline
              BrutalBirdie
              Partner
              wrote on last edited by BrutalBirdie
              #8

              @robi maybe my _mail Service entry is wrong? 🤔

              https://tools.ietf.org/id/draft-daboo-srv-email-05.html#rfc.section.3.2

              also for sieve?

              https://datatracker.ietf.org/doc/html/rfc5804#section-1.8

              Like my work? Consider donating a drink. Cheers!

              robiR 1 Reply Last reply
              0
              • BrutalBirdieB BrutalBirdie

                @robi maybe my _mail Service entry is wrong? 🤔

                https://tools.ietf.org/id/draft-daboo-srv-email-05.html#rfc.section.3.2

                also for sieve?

                https://datatracker.ietf.org/doc/html/rfc5804#section-1.8

                robiR Offline
                robiR Offline
                robi
                wrote on last edited by
                #9

                @brutalbirdie hmm, perhaps the names of the SRV records are important. If you add those, see if it starts flowing again. 😉

                Conscious tech

                BrutalBirdieB 1 Reply Last reply
                0
                • robiR robi

                  @brutalbirdie hmm, perhaps the names of the SRV records are important. If you add those, see if it starts flowing again. 😉

                  BrutalBirdieB Offline
                  BrutalBirdieB Offline
                  BrutalBirdie
                  Partner
                  wrote on last edited by
                  #10

                  @robi I want to try it.

                  Like my work? Consider donating a drink. Cheers!

                  robiR 1 Reply Last reply
                  0
                  • BrutalBirdieB BrutalBirdie

                    @robi I want to try it.

                    robiR Offline
                    robiR Offline
                    robi
                    wrote on last edited by
                    #11

                    @brutalbirdie
                    _imap._tcp
                    _smtp._tcp
                    _sieve._tcp

                    Not sure about sieve..

                    Conscious tech

                    BrutalBirdieB 1 Reply Last reply
                    0
                    • robiR robi

                      @brutalbirdie
                      _imap._tcp
                      _smtp._tcp
                      _sieve._tcp

                      Not sure about sieve..

                      BrutalBirdieB Offline
                      BrutalBirdieB Offline
                      BrutalBirdie
                      Partner
                      wrote on last edited by BrutalBirdie
                      #12

                      @robi Yea I just updated that and will report back.

                      also _imaps and not _imap

                      ec77f76c-62d1-450b-97f0-c806e8faec6d-image.png

                      time to do some reading...

                      https://datatracker.ietf.org/doc/html/rfc6186

                      Like my work? Consider donating a drink. Cheers!

                      BrutalBirdieB 1 Reply Last reply
                      0
                      • BrutalBirdieB BrutalBirdie

                        @robi Yea I just updated that and will report back.

                        also _imaps and not _imap

                        ec77f76c-62d1-450b-97f0-c806e8faec6d-image.png

                        time to do some reading...

                        https://datatracker.ietf.org/doc/html/rfc6186

                        BrutalBirdieB Offline
                        BrutalBirdieB Offline
                        BrutalBirdie
                        Partner
                        wrote on last edited by
                        #13

                        @brutalbirdie does not look like its working hmmm

                        Like my work? Consider donating a drink. Cheers!

                        1 Reply Last reply
                        0
                        • robiR Offline
                          robiR Offline
                          robi
                          wrote on last edited by
                          #14

                          Sent out an SOS here: https://twitter.com/vRobM/status/1442197044303577089?s=20

                          Conscious tech

                          BrutalBirdieB 1 Reply Last reply
                          2
                          • robiR robi

                            Sent out an SOS here: https://twitter.com/vRobM/status/1442197044303577089?s=20

                            BrutalBirdieB Offline
                            BrutalBirdieB Offline
                            BrutalBirdie
                            Partner
                            wrote on last edited by
                            #15

                            @robi Very Nice!

                            Like my work? Consider donating a drink. Cheers!

                            1 Reply Last reply
                            0
                            • robiR Offline
                              robiR Offline
                              robi
                              wrote on last edited by robi
                              #16

                              I didn't know Argo tunnels were free. So one can hide the mail service and put it thru an Argo tunnel on a subdomain to the world.

                              https://docs.ibracorp.io/all-guides-in-order/documentation/cloudflare-tunnel

                              Similarly one can have another domain and IP handle the incoming, which is tunneled to you via Tailscale.

                              https://docs.ibracorp.io/all-guides-in-order/documentation/tailscale

                              Conscious tech

                              1 Reply Last reply
                              0
                              Reply
                              • Reply as topic
                              Log in to reply
                              • Oldest to Newest
                              • Newest to Oldest
                              • Most Votes


                              • Login

                              • Don't have an account? Register

                              • Login or register to search.
                              • First post
                                Last post
                              0
                              • Categories
                              • Recent
                              • Tags
                              • Popular
                              • Bookmarks
                              • Search