imperva-cloudflare-tools

Python tool that keeps Imperva and Cloudflare proxy IP ranges up to date on your web servers. Fetches current IP lists from both providers, updates allowlist files and trusted-proxy configs, reloads Apache or pushes updates to F5 BIG-IP, and sends email/Flock notifications when changes are detected.

---

Requirements

• Python 3.6+
• requests library (pip install requests)
• Apache with mod_remoteip enabled or F5 BIG-IP with iControl REST API access

---

Installation

git clone https://github.com/0kaba0hub/imperva_cloudflare_tools.git /usr/local/src/imperva_cloudflare
cd /usr/local/src/imperva_cloudflare
pip install requests
cp config.ini-example config.ini
chmod +x update_ips.py

---

Configuration

Edit config.ini. All sections are described below.

[Imperva_API] / [Cloudflare_API]

Key	Description	Default
url	Provider API endpoint	(set)
timeout	HTTP timeout in seconds	10

[Email]

Key	Description
enable_smtp	true / false
smtp_server	SMTP host
smtp_port	SMTP port
smtp_username / smtp_password	Credentials
email_from / email_to	Sender / recipient
email_subject	Subject line
email_template	Path to HTML template (default: email_template.html)

[Flock]

Key	Description
enable_flock	true / false
flock_webhook_url	Incoming webhook URL
flock_timeout	HTTP timeout in seconds

[Files]

Key	Description	Recommended path
ip_file	IPv4 trusted proxy list	/etc/apache2/remoteip/ip.txt
ipv6_file	IPv6 trusted proxy list	/etc/apache2/remoteip/ip6.txt

[Apache]

Key	Description	Default
apache_reload_command	Shell command to reload Apache	systemctl reload apache2

[Logging]

Key	Description
log_file	Path to log file
debug	true during setup, false in production

[F5]

Key	Description
f5_host	F5 BIG-IP hostname or IP
f5_username / f5_password	iControl REST credentials
f5_ip_list_name	IP address list object name on F5
f5_ssl_verify	true, false, or path to CA certificate
f5_timeout	HTTP timeout in seconds

---

Usage

update_ips.py [PROVIDER] [OPTION] [CONFIG_PATH]

PROVIDER:
  imperva     Use Imperva as the IP provider
  cloudflare  Use Cloudflare as the IP provider

OPTION:
  apache      Update IP files and reload Apache
  f5          Push updated IP ranges to F5 BIG-IP
  help        Show this help message

CONFIG_PATH: optional — path to a custom .ini file (default: config.ini next to the script)

Examples:

# Update Cloudflare IPs for Apache
/usr/local/src/imperva_cloudflare/update_ips.py cloudflare apache

# Update Imperva IPs for F5 BIG-IP
/usr/local/src/imperva_cloudflare/update_ips.py imperva f5

# Use a custom config file
/usr/local/src/imperva_cloudflare/update_ips.py cloudflare apache /etc/myapp/custom.ini

---

Setup guide

1. Apache — enable mod_remoteip

Create /etc/apache2/remoteip/ and add to your Apache config:

<IfModule remoteip_module>
    RemoteIPHeader X-Forwarded-For
    RemoteIPInternalProxy 10.0.0.0/24
    RemoteIPTrustedProxyList /etc/apache2/remoteip/ip.txt
</IfModule>

Configure access logging to use the real client IP:

LogFormat "%v:%p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
CustomLog /var/log/apache2/access.log vhost_combined

2. F5 BIG-IP — enable real IP forwarding

Add the HTTP-ADD-HEADER-XForwardFor iRule to the HTTP(S) virtual server, then run the initial sync:

/usr/local/src/imperva_cloudflare/update_ips.py cloudflare f5

3. Run a test and check logs

/usr/local/src/imperva_cloudflare/update_ips.py cloudflare apache
tail -f /path/to/script.log

Expected output (debug enabled):

2024-12-24 13:10:01,645 - INFO  - Selected provider: Cloudflare
2024-12-24 13:10:01,645 - DEBUG - Start cloudflare_process_ip_ranges()
2024-12-24 13:10:01,731 - DEBUG - Old IPv4 ranges: [...]
2024-12-24 13:10:01,732 - DEBUG - New IPv4 ranges: [...]
2024-12-24 13:10:01,732 - INFO  - No changes detected. No action needed.

4. Disable debug logging

Set debug = false in the [Logging] section of config.ini.

5. Create a cron job

# /etc/cron.d/imperva-cloudflare
5-55/5 * * * *  root /usr/local/src/imperva_cloudflare/update_ips.py cloudflare apache

---

Notifications

When an error occurs (API failure, Apache reload failure, write error), the script sends notifications to whichever channels are enabled in config.ini:

• Email — HTML alert via SMTP (enable_smtp = true)
• Flock — message to a webhook channel (enable_flock = true)
• Both or neither can be enabled independently

---

License

GPL-3.0