SOLVED: Cannot FTP, PING, or NSLOOKUP After Using Cloudflare

We recently had a client who could not FTP to their webserver using Filezilla (which returned COULD NOT CONNECT TO SERVER). Our initial investigation found that NSLOOKUP was returning the wrong IP address.

As you can see in the screenshot below, we reproduced the issue with our site, www.URTech.ca. Our public IP is 74.124.219.234, but the name resolves to some IPv6 address and two different IPv4 addresses. What is going on?

After more investigation we found their internal IT staff had migrated their DNS to Cloudflare. Cloudflare is a Content Delivery Network aka CDN (and many other wonderful things).

As you can see in the are marked in blue in the screenshot, Cloudflare DNS is set to proxy the server. That means Cloudflare actually hosts much of the traffic sent to the website. They deliver the website content from cached webpages stored in dozens of places around the globe, so that visitors who are not in the same region as the source web server still get quick performance. This is a critical part of Search Engine Optimization (SEO).

What Does a Cloudflare “Proxied” Do:

1. Cloudflare provides IPv6 support automatically. Because Cloudflare’s network is fully IPv6 enabled, when you proxy your domain through them, they will automatically serve IPv6 (AAAA) records for your domain, even if your origin server only has an IPv4 address. They translate the IPv6 traffic back to IPv4 when it reaches your origin server. This is called “IPv6 compatibility” or “IPv6 Gateway”
2. Cloudflare acts as a reverse proxy. Your visitors’ traffic does not go directly to your server’s IP address (74.124.219.234). Instead, it goes to Cloudflare’s network
3. Cloudflare advertises its own IP addresses. When someone performs a DNS lookup for your domain, Cloudflare’s DNS servers (like 1.1.1.1) return Cloudflare’s IP addresses for your domain, not your origin server’s IP. This is how they can filter malicious traffic, cache content, provide DDoS protection, and so on

This explained the problem and the client simply needed to use the IP address of their website (instead of the host name) in Filezilla.

Asked / Answered!