Как подключить Cloudflare CDN
Cloudflare — most popular free CDN + DDoS protection + SSL. Setup за 15 min: 1) Register, 2) Add site, import DNS, 3) Switch nameservers на Cloudflare в registrar, 4) Wait propagation (1-24h), 5) Enable Proxy (orange cloud) для A/AAAA records. SSL automatic (Full или Full Strict). Free tier: unlimited bandwidth, 100k req/s, 3 Page Rules.
Ниже: пошаговая инструкция, рабочие примеры, типичные ошибки, FAQ.
Пошаговая настройка
- Register free account: cloudflare.com
- Add site: cloudflare.com → Add Site → enter domain
- Cloudflare scans existing DNS — review imported records
- Update nameservers: в registrar (reg.ru, GoDaddy, etc.) → change NS к assigned CF nameservers (e.g. craig.ns.cloudflare.com, isla.ns.cloudflare.com)
- Wait propagation — Enterno DNS Checker покажет когда done
- Proxy (orange cloud): включите для A/AAAA с http traffic. Off (grey) для MX (mail)
- SSL/TLS mode: Full (strict) если origin valid cert; Full если self-signed; Flexible (НЕ safe) если no origin SSL
- Always Use HTTPS: toggle on — auto 301 HTTP → HTTPS
- Cache: default fine. Для static-heavy: Page Rule "Cache Everything"
Рабочие примеры
| Сценарий | Конфиг |
|---|---|
| Page Rule: cache static assets | URL: example.com/*.(css|js|png|jpg|woff2)
Settings:
Cache Level: Cache Everything
Edge Cache TTL: 1 month
Browser Cache TTL: 1 year |
| Page Rule: bypass cache для admin | URL: example.com/admin/*
Settings:
Cache Level: Bypass
Disable Performance |
| nginx real IP (за Cloudflare) | # Без этого = CF IP
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
# ... (full list: https://www.cloudflare.com/ips-v4)
real_ip_header CF-Connecting-IP; |
| Firewall Rule: block country | # Cloudflare Dashboard → Security → WAF → Create rule
Field: Country
Operator: equals
Value: CN, KP
Action: Block |
| Tunnel (no open ports на origin) | # Cloudflared tunnel — zero-trust connect
# No need to expose 80/443 на origin firewall
cloudflared tunnel create my-tunnel
cloudflared tunnel route dns my-tunnel example.com
cloudflared tunnel run my-tunnel |
Типичные ошибки
- Flexible SSL mode — UNSAFE (HTTP между CF и origin). Use Full (Strict) с valid cert
- Orange cloud для mail MX — break mail. Keep MX grey (DNS only)
- Cache misses: если origin выставляет Cache-Control: private, CF не cache. Check response headers
- Real IP: без set_real_ip_from, backend видит all requests from CF IPs
- Rate limit free tier: 3 Page Rules, 1 Cache Rule. Для enterprise needs — Pro $20/мес
Больше по теме
Часто задаваемые вопросы
Cloudflare действительно free?
Yes, unlimited bandwidth, 100k req/s, DDoS protection, SSL. Paid добавляет: больше rules, WAF advanced, analytics depth, prioritization.
Origin всё ещё доступен напрямую?
Yes если IP известен. Hide через Cloudflare Tunnel (cloudflared) — no public IP needed. Или firewall whitelist CF IPs only.
Работает в РФ?
Cloudflare доступен, но могут быть routing issues с Tier-2 ISP. Для primary RU audience — Yandex Cloud CDN может быть faster.
Как очистить cache?
Dashboard → Caching → Purge Cache → all files или specific URLs. API tool: <code>curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" -H "Authorization: Bearer TOKEN" -d '{"purge_everything":true}'</code>