Make bypassing Cloudflare harder while preserving management access
You should be able to demonstrate the result described in the lesson and explain why each step was necessary.
Step-by-step
Separate public and management traffic
The website needs 80/443; management can remain private or VPN-only.
Restrict web traffic when practical
Allow origin web ports from Cloudflare address ranges if your architecture and update process can maintain those ranges safely.
Do not expose the database
Keep 3306 and similar database ports private.
Protect CloudPanel
Whitelist 8443 or place management behind a VPN or additional authentication.
Test before locking down
Keep an existing administrative session open and verify new firewall rules from another terminal before disconnecting.
You should be able to demonstrate the result described in the lesson and explain why each step was necessary.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.