Skip to content

Commit 6cd54f2

Browse files
Overall text review and add info on checking IPs via dash
1 parent 176466e commit 6cd54f2

File tree

3 files changed

+21
-13
lines changed

3 files changed

+21
-13
lines changed

src/content/docs/smart-shield/configuration/dedicated-egress-ips/about.mdx

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ flowchart LR
2121

2222
## Egress IPs
2323

24-
Zooming in to what happens as a request routes through Cloudflare, you can consider two parts of the process: ingress and egress.
24+
Zooming into what happens as a request routes through Cloudflare, you can consider two parts of the process: ingress and egress.
2525

2626
```mermaid
2727
flowchart LR
@@ -34,9 +34,19 @@ Ingress refers to the data center where the client request lands on, based on In
3434

3535
Traditionally, Cloudflare maintains a very large pool of egress IPs that are used by all Cloudflare customers and are [publicly documented](https://www.cloudflare.com/ips/). With Dedicated CDN Egress IPs, Cloudflare connects to your origin using IPs that are reserved for you.
3636

37-
:::note
37+
### BYOIP or Cloudflare-leased
38+
3839
Each dedicated CDN egress IP pool can consist of either IPs from a [BYOIP prefix](/byoip/) or Cloudflare-leased IPs. A single dedicated CDN egress IP pool cannot contain both BYOIPs and leased IPs.
39-
:::
40+
41+
<Render
42+
file="check-leased-ips"
43+
product="byoip"
44+
params={{
45+
product: "dedicated IPs for CDN egress"
46+
}}
47+
/>
48+
49+
If you are using BYOIP, refer to [**IP addresses** > **BYOIP prefixes**](https://dash.cloudflare.com/?to=/:account/ip-addresses/ip-prefixes) instead.
4050

4151
## IPs allocation
4252

@@ -56,7 +66,7 @@ Refer to [connection forwarding](#connection-forwarding) to understand how reque
5666

5767
<Render file="concurrent-connections-explainer" product="aegis" />
5868

59-
Dedicated CDN Egress IPs also benefit from [connection reuse and connection coalescing](/smart-shield/concepts/connection-reuse/).
69+
Dedicated CDN Egress IPs also benefit from [connection reuse and coalescing](/smart-shield/concepts/connection-reuse/).
6070

6171
GraphQL Analytics API allows you to get visibility over [IPs utilization](/smart-shield/configuration/dedicated-egress-ips/ips-utilization/).
6272

src/content/docs/smart-shield/configuration/dedicated-egress-ips/index.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ If you are interested in using Smart Shield Advanced with Dedicated CDN Egress I
1717

1818
## Benefits
1919

20-
With dedicated egress IPs, you can:
20+
With Dedicated CDN Egress IPs, you can:
2121

22-
* Lock down your network firewall to only allow traffic from the your dedicated CDN egress IPs.
23-
* Use [Cloudflare Access](/smart-shield/configuration/dedicated-egress-ips/other-products/#access-and-cni) to secure your applications without installing software or customizing code on your server.
22+
* Lock down your network firewall to only allow traffic from your dedicated IPs.
23+
* Use [Cloudflare Access and CNI](/smart-shield/configuration/dedicated-egress-ips/other-products/#access-and-cni) to secure your applications without installing software or customizing code on your server.
2424
* Ensure only authorized [Workers](/smart-shield/configuration/dedicated-egress-ips/other-products/#workers) can access your origin services.
2525

2626
## Scope

src/content/docs/smart-shield/configuration/dedicated-egress-ips/other-products.mdx

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,10 @@ Use Dedicated CDN Egress IPs in combination with different Cloudflare products.
1212

1313
You can use Dedicated CDN Egress IPs combined with [Cloudflare Network Interconnect (CNI)](/network-interconnect/) to secure your applications with [Cloudflare Access](/cloudflare-one/access-controls/policies/) without installing software or customizing code on your server.
1414

15-
While Access allows you to enforce policies at the hostname level, other solutions are usually necessary to protect against origin IP bypass — when an attacker knows your origin server IP and uses it to directly interact with the target application.
16-
17-
With Dedicated CDN Egress IPs, you only allow a small number of IPs (that are not publicly listed) through your network firewall. And with Cloudflare Network Interconnect, you can use a completely private path between Cloudflare and your application server, without exposure to the public Internet.
15+
While Access allows you to enforce policies at the hostname level, other solutions are usually necessary to protect against origin IP bypass [^1]. With Dedicated CDN Egress IPs, you only allow a small number of IPs (that are not publicly listed) through your network firewall and, with Cloudflare Network Interconnect, you can use a completely private path between Cloudflare and your application server, without exposure to the public Internet. For details and background, refer to the [Cloudflare blog](https://blog.cloudflare.com/access-aegis-cni).
1816

1917
Dedicated CDN Egress IPs are included within [BGP advertisement over CNI](/network-interconnect/).
2018

21-
For details and background, refer to the [Cloudflare blog](https://blog.cloudflare.com/access-aegis-cni).
22-
2319
## Data Localization Suite
2420

2521
[Data Localization Suite (DLS)](/data-localization/) is an enterprise add-on that enables you to choose the location where Cloudflare encrypts, decrypts, and stores data.
@@ -58,4 +54,6 @@ Workers subrequests — requests from one Worker to another — are expected to
5854

5955
### `connect`
6056

61-
For [`connect()` requests](/workers/runtime-apis/tcp-sockets/) - which create outbound TCP connections from Workers - Dedicated CDN Egress IPs are **not** used.
57+
For [`connect()` requests](/workers/runtime-apis/tcp-sockets/) - which create outbound TCP connections from Workers - Dedicated CDN Egress IPs are **not** used.
58+
59+
[^1]: When an attacker knows your origin server IP and uses it to directly interact with the target application.

0 commit comments

Comments
 (0)