How to Host a Website on NAT VPS Using Cloudflare and Nginx on Ubuntu

System Administration

By r00t4bl3

Jul 6, 2019

6411

Hosting your website on a web hosting service running cPanel is fun. But how if you need more resource like running cron or mail server? Rent a dedicated server or co-location seems to be the answer some years ago. Now, as the virtualization technology getting more advanced, we could pay about the price of a nice meal to get a VPS.

If you want to go cheaper, there's a solution called NAT VPS. It's just like a common VPS but usually without having dedicated IPv4 (A single public IPv4 is available, but shared with other users). Although we're sharing IPv4, each VPS has some dedicated IPv6. The price is just unbelievable, starts from $2 per year!

But how could we host a website without IPv4? Thanks to Cloudflare, we can host a website by using IPv6 from our NAT VPS provider.

Cloud what?

Cloudflare is a service that sits between your visitor and your VPS, acting as a reverse proxy for your website. Cloudflare provides a Content Delivery Network (CDN), as well as DDoS mitigation and distributed domain name server services.

Prerequisites

NAT VPS with Nginx installed
Cloudflare account
A domain name

Generate Origin CA TLS Certificate from Cloudflare

First step is generate origin CA TLS certificate from Cloudflare. To do this, log in to your Cloudflare dashboard. Go to Crypto > Origin Certificates > Create Certificate.

Cloudflare Dashboard 01 — Choose "Crypto" menu on top.

Cloudflare Dashboard 02 — Scroll down to "Origin Certificates" panel and then click "Create" button.

Cloudflare Dashboard 03 — Choose "Let Cloudflare generate a private key and CSR and then "CSR" as private key type. Click "Next" button.

Cloudflare Dashboard 04 — Copy your Origin Certificate and save it as cert.pem on your VPS.

Cloudflare Dashboard 05 — Copy your private key and save it as key.pem on your VPS.

Cloudflare Dashboard 06 — Make sure "Authenticated Origin Pulls" option is "On".

Now it's time to put both files cert.pem and key.pem to correct place. The certificate cert.pem goes to /etc/ssl/certs/cert.pem and the key key.pem goes to /etc/ssl/private/key.pem.

We're almost finished. The Origin CA certificate will help Cloudflare verify that it is talking to the correct origin server. But how can your origin Nginx server verify that it is actually talking to Cloudflare? That's what TLS Client Authentication for.

In a client authenticated TLS handshake, both sides provide a certificate to be verified. The origin server is configured to only accept requests that use a valid client certificate from Cloudflare. Requests which have not passed through Cloudflare will be dropped as they will not have Cloudflare's certificate. This means that attackers cannot circumvent Cloudflare's security measures and directly connect to your Nginx server.

Cloudflare presents certificates signed by a CA with the following certificate below:

Copy text above and put it to /etc/ssl/certs/cloudflare.crt.

Update Nginx Configuration

Open your virtual host configuration on /etc/nginx/sites-available/. It should be something like this:

server {
    listen 80;
    server_name r00t4bl3.com www.r00t4bl3.com;
    return 301 https://$server_name$request_uri;
}

server {

    listen 443 ssl http2;
    ssl        on;
    ssl_certificate         /etc/ssl/certs/cert.pem;
    ssl_certificate_key     /etc/ssl/private/key.pem;
    ssl_client_certificate  /etc/ssl/certs/cloudflare.crt;
    ssl_verify_client on;

    server_name r00t4bl3.com www.r00t4bl3.com;

    root /var/www/r00t4bl3.com/html;
    index index.html index.htm index.nginx-debian.html;


    location / {
            try_files $uri $uri/ =404;
    }
}

Save the file and then restart nginx:

$ sudo systemctl restart nginx

Testing

Now it's time to open your web browser and test your website to verify that it was set up properly. If everything is correct, you should see your home page displayed.

Conclusion

I hope that you now know how to host a website on NAT VPS using Cloudflare and Nginx on Ubuntu. If you run into any issues or have any feedback feel free to drop a comment below.