EdgeShield IP ranges

Allow these IPs on ports 80 and 443 at your origin server, and block everyone else. That way only EdgeShield can reach your origin — attackers who discover its real IP are dropped at your firewall.

Edge IPs

All EdgeShield traffic to your origin comes from these addresses. This is the complete list.

185.246.131.29Bulgaria
185.226.172.126Germany
185.237.185.35Lithuania
45.154.206.48Spain
94.156.250.29United Kingdom
185.186.76.45Switzerland
92.118.205.9Poland
185.126.236.29Austria
37.143.129.81Finland

Plain text list: /ipv4.txt · Last updated 2026-09-22

Lock down your origin (recommended)

On Ubuntu/Debian with ufw. This allows only EdgeShield on 80/443 and denies the rest. Run it on your origin server, not on EdgeShield.

Do this over a stable SSH session. These rules only touch ports 80 and 443, so they won't lock you out of SSH — but review before you enable ufw if it isn't already on.
ufw
# Allow EdgeShield edge IPs on HTTP/HTTPS
for ip in \
  185.246.131.29 185.226.172.126 185.237.185.35 \
  45.154.206.48 94.156.250.29 185.186.76.45 \
  92.118.205.9 185.126.236.29 37.143.129.81; do
  ufw allow from $ip to any port 80  proto tcp
  ufw allow from $ip to any port 443 proto tcp
done

# Block everyone else from 80/443 (EdgeShield is the only way in)
ufw deny 80/tcp
ufw deny 443/tcp

ufw reload

Prefer raw iptables?

iptables
for ip in \
  185.246.131.29 185.226.172.126 185.237.185.35 \
  45.154.206.48 94.156.250.29 185.186.76.45 \
  92.118.205.9 185.126.236.29 37.143.129.81; do
  iptables -A INPUT -p tcp -s $ip -m multiport --dports 80,443 -j ACCEPT
done
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP

What to check after

  1. Your site still loads through EdgeShield (via your domain).
  2. Hitting your origin's real IP directly on 80/443 now times out — good, that means attackers can't bypass EdgeShield.
  3. If your origin also needs to serve health checks or other services, don't block those ports — this only covers 80/443.

Back to EdgeShield