This section describes the high-level architecture of the Egress connection used by Fluid Attacks to access your resources to be tested, as well as its minimum requirements and limitations. This connection relies on dedicated Cloudflare egress IPs.

High-level architecture

In this connection option, Fluid Attacks utilizes public egress IP addresses to access your resources. These IP addresses are static, i.e., they do not change, ensuring consistent and reliable access.

To allow Fluid Attacks to access the necessary resources within your network, you need to whitelist the egress IP addresses on your firewall. This enables secure communication between Fluid Attacks and your designated resources over the Internet.

Below is a diagram that shows at a high level how the Egress scheme works.

Egress connection architecture diagram

Minimum requirements

1. Public IP requirement: Your resources must have a public IP address or be accessible via an externally routed network to allow Fluid Attacks to establish a connection. If they are behind a NAT or private network, additional configuration may be required. One possible solution is using Port Address Translation (PAT) or NAT overload, which allows multiple devices in a private network to share a single public IP address by translating not only IP addresses but also port numbers.
2. Firewall configuration: Whitelist the specified Fluid Attacks egress IP addresses in your firewall rules to permit incoming connections. Ensure that only the required ports and protocols are opened to maintain security.
3. Connection form: Complete and submit the required connection form with accurate configuration details. Once submitted, the connection is established within eight business hours.
   

Egress IP addresses

1. Main IP: 104.30.132.78
   
2. Backup IP: 104.30.134.27
   

1. Main IP: 2a09:bac0:1000:252::/64
   
2. Backup IP: 2a09:bac0:1001:1cb::/64
   

Limiting access

While Fluid Attacks requires access to your resources via the provided egress IP addresses, it is crucial to maintain a secure environment. Implement the principle of least privilege by configuring your firewall rules to expose only the essential resources required for security testing. This minimizes potential security risks by limiting access to sensitive information and systems.

Service limitations

When using self-signed SSL certificates for your sites, HTTPS traffic going through them is not inspected, reducing the log detail that can be collected. 
This is because the Cloudflare network, on which the connection relies, requires certificates issued by trusted Certificate Authorities (CAs) for full validation and logging. Therefore, it is recommended to use SSL certificates signed by a valid CA so navigation logs are fully detailed.

Authentication

The authentication mechanisms available for this connection are as follows: