{"id":78,"date":"2026-09-10T09:19:03","date_gmt":"2026-09-10T09:19:03","guid":{"rendered":"https:\/\/blog.lcsh.top\/?p=78"},"modified":"2026-09-10T09:19:03","modified_gmt":"2026-09-10T09:19:03","slug":"%e5%b1%8f%e8%94%bd%e4%b8%ad%e5%9b%bd%e5%a4%a7%e9%99%86ipv6%e5%9c%b0%e5%9d%80%e6%ae%b5%e5%92%8c%e8%87%aa%e5%8a%a8%e8%8e%b7%e5%8f%96cloudflare-ip%e6%ae%b5","status":"publish","type":"post","link":"https:\/\/blog.lcsh.top\/?p=78","title":{"rendered":"\u5c4f\u853d\u4e2d\u56fd\u5927\u9646IPv6\u5730\u5740\u6bb5\u548c\u81ea\u52a8\u83b7\u53d6Cloudflare IP\u6bb5"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\u670d\u52a1\u5668\u4f7f\u7528\u4e86HE Tunnel\u6765\u83b7\u5f97IPv6\u5730\u5740\uff0c\u4f46\u662fHE\u7684\u96a7\u9053\u8fde\u63a5\u4e2d\u56fd\u5927\u9646IPv6\u8d28\u91cf\u5c5e\u5b9e\u662f\u6709\u70b9\u5dee\uff0c\u6240\u4ee5\u6709\u5fc5\u8981\u641e\u4e00\u4e2a\u811a\u672c\u6279\u91cf\u5c4f\u853d\u4e2d\u56fd\u5927\u9646IPv6\u5730\u5740\u6bb5\uff0c\u9632\u6b62Headscale\u3001Derper\u548cMinecraft\u8fde\u63a5\u81ea\u52a8\u9009\u62e9\u66f4\u6162\u7684IPv6\u7f51\u7edc\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n# \u81ea\u52a8\u62c9\u53d6\u5e76\u5c01\u7981\u4e2d\u56fd\u5927\u9646\u6240\u6709 IPv6 \u7f51\u6bb5 (\u6539\u8fdb\u7248)\nset -euo pipefail\n\nSET_NAME=\"cn_ipv6_block\"\nURL=\"https:\/\/www.ipdeny.com\/ipv6\/ipaddresses\/blocks\/cn.zone\"\nTMP_FILE=\"\/tmp\/cn_ipv6_zone.txt\"\n\n# 1. \u68c0\u67e5\u5e76\u5b89\u88c5\u5fc5\u8981\u5de5\u5177 (\u8865\u5168 iptables \u4f9d\u8d56)\nif ! command -v ipset &amp;> \/dev\/null || ! command -v curl &amp;> \/dev\/null || ! command -v ip6tables &amp;> \/dev\/null; then\n    echo \"&#91;+] \u6b63\u5728\u5b89\u88c5 ipset, curl \u548c iptables...\"\n    if command -v apt-get &amp;> \/dev\/null; then\n        apt-get update &amp;&amp; apt-get install -y ipset curl iptables\n    elif command -v yum &amp;> \/dev\/null; then\n        yum install -y ipset curl iptables\n    fi\nfi\n\n# 2. \u4e0b\u8f7d\u6700\u65b0\u7684\u4e2d\u56fd IPv6 \u5730\u5740\u5e93 (-L \u8ddf\u968f\u91cd\u5b9a\u5411)\necho \"&#91;+] \u6b63\u5728\u4e0b\u8f7d\u6700\u65b0\u7684\u4e2d\u56fd\u5927\u9646 IPv6 \u5730\u5740\u6bb5\u5217\u8868...\"\nif ! curl -sLf -o \"$TMP_FILE\" \"$URL\"; then\n    echo \"&#91;!] \u9519\u8bef: \u4e0b\u8f7d IPv6 \u5730\u5740\u5e93\u5931\u8d25\uff0c\u8bf7\u68c0\u67e5\u7f51\u7edc\u3002\" >&amp;2\n    exit 1\nfi\n\nif &#91; ! -s \"$TMP_FILE\" ]; then\n    echo \"&#91;!] \u9519\u8bef: \u4e0b\u8f7d\u7684\u5730\u5740\u5e93\u6587\u4ef6\u4e3a\u7a7a\u3002\" >&amp;2\n    exit 1\nfi\n\n# 3. \u521b\u5efa\u4e34\u65f6 ipset \u96c6\u5408\u4ee5\u5b9e\u73b0\u65e0\u7f1d\u70ed\u66f4\u65b0\necho \"&#91;+] \u66f4\u65b0 ipset \u96c6\u5408...\"\nif ipset list \"${SET_NAME}_tmp\" &amp;>\/dev\/null; then\n    ipset flush \"${SET_NAME}_tmp\"\nelse\n    ipset create \"${SET_NAME}_tmp\" hash:net family inet6 hashsize 4096 maxelem 65536\nfi\n\n# 4. \u586b\u5145\u4e34\u65f6\u96c6\u5408\uff08\u5141\u8bb8\u5355\u6761\u683c\u5f0f\u6821\u9a8c\u5931\u8d25\uff0c\u907f\u514d\u811a\u672c\u5f02\u5e38\u4e2d\u65ad\uff09\nwhile read -r cidr; do\n    # \u5ffd\u7565\u7a7a\u884c\u548c\u6ce8\u91ca\n    &#91;&#91; -z \"$cidr\" || \"$cidr\" =~ ^# ]] &amp;&amp; continue\n    ipset add \"${SET_NAME}_tmp\" \"$cidr\" 2>\/dev\/null || true\ndone &lt; \"$TMP_FILE\"\n\n# 5. \u539f\u5b50\u66ff\u6362 (Swap) \u4e3b\u96c6\u5408\u5e76\u9500\u6bc1\u4e34\u65f6\u96c6\u5408\nif ! ipset list \"$SET_NAME\" &amp;>\/dev\/null; then\n    ipset create \"$SET_NAME\" hash:net family inet6 hashsize 4096 maxelem 65536\nfi\nipset swap \"${SET_NAME}_tmp\" \"$SET_NAME\"\nipset destroy \"${SET_NAME}_tmp\"\n\n# \u6e05\u7406\u4e34\u65f6\u6587\u4ef6\nrm -f \"$TMP_FILE\"\n\n# 6. \u6302\u8f7d ip6tables \u62e6\u622a\u89c4\u5219\uff08\u9632\u6b62\u91cd\u590d\u6dfb\u52a0\uff09\nif ! ip6tables -C INPUT -m set --match-set \"$SET_NAME\" src -j DROP 2>\/dev\/null; then\n    echo \"&#91;+] \u6dfb\u52a0 ip6tables \u5c01\u7981\u89c4\u5219\u5230 INPUT \u94fe\u9996\u90e8...\"\n    ip6tables -I INPUT -m set --match-set \"$SET_NAME\" src -j DROP\nfi\n\necho \"&#91;\u2714] \u6210\u529f\uff01\u4e2d\u56fd\u5927\u9646 IPv6 \u5730\u5740\u5e93\uff08\u5171 $(ipset list $SET_NAME | grep -c '\/') \u6761\uff09\u5df2\u6210\u529f\u52a0\u8f7d\u5e76\u62e6\u622a\u3002\"\n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u53e6\u5916\uff0c\u535a\u5ba2\u57df\u540d\u4f7f\u7528\u4e86Cloudflare proxy\uff0c\u6240\u4ee5\u6e90\u7ad9\u5e94\u5f53\u62d2\u7eddCloudflare\u4e4b\u5916\u7684IP\u8fde\u63a5\u3002\u8fd9\u91cc\u4e5f\u4f7f\u7528\u811a\u672c\u83b7\u5f97Cloudflare\u7684IP\u6bb5\uff0c\u5e76\u5728Nginx\u4e2d\u914d\u7f6e\u4ec5\u5141\u8bb8\u8be5IP\u6bb5\u7684\u8fde\u63a5\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim \/usr\/local\/bin\/update_cloudflare_ips.sh\n#!\/bin\/bash\n\n# \u5b9a\u4e49\u751f\u6210\u89c4\u5219\u6587\u4ef6\u7684\u8def\u5f84\nCONF_FILE=\"\/etc\/nginx\/cloudflare_allow.conf\"\nTEMP_FILE=\"\/tmp\/cloudflare_allow.tmp\"\n\n# \u6e05\u7a7a\u4e34\u65f6\u6587\u4ef6\n> \"$TEMP_FILE\"\n\necho \"# Cloudflare IPv4\" >> \"$TEMP_FILE\"\ncurl -s https:\/\/www.cloudflare.com\/ips-v4 | awk '{print \"allow \" $0 \";\"}' >> \"$TEMP_FILE\"\n\necho -e \"\\n# Cloudflare IPv6\" >> \"$TEMP_FILE\"\ncurl -s https:\/\/www.cloudflare.com\/ips-v6 | awk '{print \"allow \" $0 \";\"}' >> \"$TEMP_FILE\"\n\n# \u68c0\u67e5\u62c9\u53d6\u5230\u7684 IP \u5217\u8868\u662f\u5426\u5408\u6cd5\uff08\u9632\u6b62\u7f51\u8def\u5f02\u5e38\u62c9\u5230\u7a7a\u6587\u4ef6\u5bfc\u81f4 deny all \u628a Cloudflare \u4e5f\u5173\u4e86\uff09\nif grep -q \"allow 173.245.48.0\/20;\" \"$TEMP_FILE\"; then\n    mv \"$TEMP_FILE\" \"$CONF_FILE\"\n\n    # \u9a8c\u8bc1 Nginx \u8bed\u6cd5\u5e76\u91cd\u8f7d Nginx\n    nginx -t &amp;&amp; systemctl reload nginx\n    echo \"&#91;$(date)] Cloudflare IP \u5217\u8868\u5df2\u66f4\u65b0\u5e76\u5df2\u91cd\u8f7d Nginx\"\nelse\n    echo \"&#91;$(date)] \u9519\u8bef\uff1a\u672a\u80fd\u83b7\u53d6\u6709\u6548\u7684 Cloudflare IP\uff0c\u672c\u6b21\u672a\u66f4\u65b0\u3002\"\n    rm -f \"$TEMP_FILE\"\nfi\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0a\u662f\u66f4\u65b0\u811a\u672c\uff1b\u5728Nginx\u7684sites-available\u4e2d\uff0c\u5728\u9700\u8981\u7684\u7ad9\u70b9\u52a0\u5165\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server {\n...\n#\u4e3b\u8981\u662f\u8fd9\u4e24\u884c\ninclude \/etc\/nginx\/cloudflare_allow.conf;\ndeny all;\n\n#\u4ee5\u4e0b\u662flocation\u6bb5\nlocation \/ {\n...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare\u66f4\u65b0IP\u9891\u7387\u6781\u4f4e\uff0c\u6240\u4ee5\u7528Crontab\u8bbe\u7f6e\u4e00\u4e2a\u6bcf\u6708\u6267\u884c\u811a\u672c\u7684\u8ba1\u5212\u4efb\u52a1\u5c31\u53ef\u4ee5\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u670d\u52a1\u5668\u4f7f\u7528\u4e86HE Tunnel\u6765\u83b7\u5f97IPv6\u5730\u5740\uff0c\u4f46\u662fHE\u7684\u96a7\u9053\u8fde\u63a5\u4e2d\u56fd\u5927\u9646IPv6\u8d28\u91cf\u5c5e\u5b9e\u662f\u6709\u70b9\u5dee\uff0c\u6240\u4ee5\u6709\u5fc5\u8981\u641e\u4e00\u4e2a\u811a\u672c\u6279\u91cf\u5c4f\u853d\u4e2d\u56fd\u5927\u9646IPv6\u5730\u5740\u6bb5\uff0c\u9632\u6b62Headscale\u3001Derper\u548cMinecraft\u8fde\u63a5\u81ea\u52a8\u9009\u62e9\u66f4\u6162\u7684IPv6\u7f51\u7edc\u3002 \u53e6\u5916\uff0c\u535a\u5ba2\u57df\u540d\u4f7f\u7528\u4e86Cloudflare proxy\uff0c\u6240\u4ee5\u6e90\u7ad9\u5e94\u5f53\u62d2\u7eddCloudflare\u4e4b\u5916\u7684IP\u8fde\u63a5\u3002\u8fd9\u91cc\u4e5f\u4f7f\u7528\u811a\u672c\u83b7\u5f97Cloudflare\u7684IP\u6bb5\uff0c\u5e76 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":79,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-78","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category--tech-notes"],"_links":{"self":[{"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts\/78","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=78"}],"version-history":[{"count":1,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts\/78\/revisions"}],"predecessor-version":[{"id":80,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts\/78\/revisions\/80"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=\/wp\/v2\/media\/79"}],"wp:attachment":[{"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}