Skip to main content

Internal Firewall

The Internal Firewall Add-On provides an additional layer of protection for your FusionInvoice installation by integrating with Cloudflare.

This module can:

  • Automatically detect repeated suspicious requests
  • Temporarily ban abusive IP addresses
  • Permanently ban IPs
  • Whitelist trusted IPs
  • Instantly ban visitors accessing specific URLs

⚠️ This add-on does not replace a proper server-level firewall. It is designed as an additional protection layer.

Requirements

Before enabling the Internal Firewall:

  • Your domain must be configured and proxied through Cloudflare.
  • You must have your Cloudflare Zone ID.
  • You must create a Cloudflare API Token with firewall rule permissions.

Without Cloudflare properly configured, this add-on will not function.

Before you Begin

The Add-on must be installed and enabled before you can use it. 

Step 1: Obtain Cloudflare Credentials

Find Your Zone ID

  1. Log into your Cloudflare dashboard.
  2. Select your domain.
  3. Locate the Zone ID in the right-hand sidebar.
  4. Copy the Zone ID.

Create an API Token

  1. Go to Cloudflare → My Profile → API Tokens.
  2. Click Create Token.
  3. Use a template or create a custom token with permissions to manage firewall rules.
  4. Restrict the token to your specific zone.
  5. Copy the generated API token.

⚠️ Store your API token securely. It grants access to firewall management.

Step 2: Configure Internal Firewall

Navigate to:
Settings → Internal Firewall

Main Configuration Fields

  • Internal Firewall: Enable or Disable the system.
  • Cloudflare API Token: Paste your API token.
  • Cloudflare Zone ID: Paste your Zone ID.
  • Number of Strikes Before Banning: How many violations are allowed before a ban.
  • Strikes Timeframe: The time window for counting strikes (e.g., 1 minute).
  • Ban Time Length: How long the temporary ban remains active.

Save Configuration

  1. Enter all required fields.
  2. Click Verify and Save.

The system will verify your Cloudflare credentials before saving.

How Automatic Strike-Based Banning Works

When a visitor repeatedly triggers suspicious behavior:

  1. The system records a strike.
  2. If strikes exceed the configured threshold within the timeframe,
  3. The IP address is banned via Cloudflare.
  4. The ban remains active for the configured duration.

This helps protect against:

  • Brute force login attempts
  • Bot scanning
  • Repeated malicious URL access

Permanently Banned Tab

The Permanently Banned tab lists IP addresses that have been permanently blocked.

Columns include:

  • IP Address
  • Location
  • Bad URL (if applicable)
  • Ban Status
  • Banned Until
  • Notes

You may remove or manage banned IPs using the Options dropdown.

Whitelist Tab

The Whitelist tab allows you to exempt IP addresses from automatic banning.

To Add a Whitelisted IP

  1. Click + New.
  2. Enter the IP address.
  3. Add an optional note.
  4. Save.

Whitelisted IPs will never be automatically banned. This is useful for:

  • Office IP addresses
  • Developers
  • Trusted partners

Instant Bans Tab

The Instant Bans feature allows you to immediately ban any visitor who accesses a URL containing specific words.

How It Works

Enter comma-separated words in the Instant Bans field.

.env, wp-admin, spam, fraud

If a visitor attempts to access a URL containing any of those words, their IP address is automatically banned.

To Configure

  1. Enter words separated by commas.
  2. Click Save.

Use this feature to block:

  • Common bot attack paths
  • WordPress probes (wp-admin, wp-login)
  • Environment file scans (.env)
  • Known malicious patterns

Refreshing and Managing Records

Use the refresh button in each tab to update the list of IP addresses.

All bans are synchronized with Cloudflare.

Troubleshooting

Firewall Not Working

  • Verify domain is properly proxied through Cloudflare.
  • Confirm Zone ID is correct.
  • Confirm API token has proper permissions.
  • Click Verify and Save again.

IP Not Being Banned

  • Check strike threshold settings.
  • Confirm IP is not whitelisted.
  • Verify Instant Ban keywords are correct.

Accidentally Banned Yourself

  • Access Cloudflare directly.
  • Remove the firewall rule.
  • Add your IP to the whitelist in FusionInvoice.

Important Notes

  • This add-on requires active Cloudflare DNS proxy (orange cloud enabled).
  • Cloudflare API credentials are required for all firewall operations.
  • The Internal Firewall is an additional layer and should not replace server-level protections.
Back to top