How to Route Cloudflare Workers Through a Static IP VPS (And Bypass API Whitelists)
If you’ve ever tried to integrate financial APIs, banking ledgers, or strict payment gateways directly inside a serverless Cloudflare Worker, you’ve likely hit a brick wall: Dynamic IP Whitelists. Cloudflare uses a rota
If you’ve ever tried to integrate financial APIs, banking ledgers, or strict payment gateways directly inside a serverless Cloudflare Worker, you’ve likely hit a brick wall: Dynamic IP Whitelists.
Cloudflare uses a rotating pool of edge IPs. Traditional banking and fintech APIs that require a static IP whitelist will instantly reject your outgoing requests with a 403 Forbidden error.
The traditional "fix" Cloudflare offers? Upgrade to Cloudflare Enterprise at $2,000+/month. That is completely out of reach for indie hackers and growing engineering teams.
The Solution: The Zero-Trust VPS Proxy Architecture
Instead of paying enterprise fees, you can route your Cloudflare Worker requests through a dedicated $5/month VPS running a secure reverse proxy.
The Data Flow:
- The Trigger: Your Cloudflare Worker needs to make a secure API call.
- The Encrypted Tunnel: The Worker sends an authenticated payload to your dedicated VPS static IP via HTTPS.
- The Static Gateway: Your VPS (running a lightweight proxy) catches the payload, attaches your whitelisted static IP headers, and forwards it to the destination API.
- The Response: The API sees a clean, consistent static IP and returns the data successfully.
Implementation Breakdown
1. The Caddy + HTTPS Reverse Proxy Config (Caddyfile)
text
your-proxy-domain.com {
reverse_proxy localhost:3000 {
header_up X-Forwarded-For {remote_host}
}
}
2. The Node.js Core Handler (server.js)
const express = require('express');
const axios = require('axios');
const app = express();
app.use(express.json());
app.post('/proxy-request', async (req, res) => {
const authHeader = req.headers['authorization'];
if (authHeader !== `Bearer ${process.env.SECRET_TOKEN}`) {
return res.status(401).json({ error: 'Unauthorized gateway access' });
}
try {
const apiResponse = await axios({
method: req.body.method,
url: req.body.targetUrl,
data: req.body.payload,
headers: req.body.headers || {}
});
return res.status(200).json(apiResponse.data);
} catch (err) {
return res.status(500).json({ error: err.message });
}
});
app.listen(3000, () => console.log('Static IP Proxy active on port 3000'));
3. Systemd Auto-Restart Daemon (/etc/systemd/system/vps-proxy.service)
[Unit]
Description=Cloudflare Static IP VPS Proxy
After=network.target
[Service]
ExecStart=/usr/bin/node /opt/proxy/server.js
Restart=always
User=root
Environment=NODE_ENV=production
[Install]
WantedBy=multi-user.target
Get the Complete Production Blueprint
If you want to skip hours of trial-and-error, security hardening, and edge-case debugging, I have packaged this entire architecture into a comprehensive, production-ready 16-page technical blueprint.
It includes complete copy-pasteable scripts, security hardening guides, and step-by-step zero-trust configurations.
[👉 Get the Full 16-Page Blueprint on Gumroad ($100)](https://lobzytech.gumroad.com/l/cloudflare-static-ip)
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.