Hide your origin IP with a reverse proxy.

How it works

A reverse proxy or CDN receives visitor traffic and forwards it to your origin. Public DNS shows the proxy's IP, not yours. For this to work, the origin must accept web traffic only from the proxy.

1. Point DNS at the proxy

Set up your domain with the proxy or CDN provider and let it show its own addresses. Remove any old record that exposes the origin IP.

2. Lock the origin firewall

Only allow web ports from the proxy's published IP ranges. The commands below show the pattern; get the current ranges from your provider.

sudo ufw default deny incoming
sudo ufw allow OpenSSH
# repeat for each IP range your proxy publishes:
sudo ufw allow from PROXY_RANGE to any port 443 proto tcp
sudo ufw allow from PROXY_RANGE to any port 80 proto tcp
sudo ufw enable

3. Stop leaks

• Old DNS records and certificate transparency logs can show the origin IP. Use a new server IP if the old one was exposed.
• Mail servers on the same IP reveal it in headers.
• Outbound requests from your app, such as link previews, show your origin IP.
• A subdomain that points straight at the server defeats the setup.

4. Test

dig +short example.com
curl -I https://example.com
# direct request to your origin IP should now fail or time out:
curl -I --max-time 5 http://YOUR-ORIGIN-IP

Limits

The proxy provider sees your traffic and may keep logs. Choose it with the same care as a host. This hides the IP from casual lookups, it does not make the origin undiscoverable. Read VPS opsec mistakes.

Common questions