If your online store sits behind Cloudflare, its security systems (WAF, managed rules, Bot Fight Mode or CAPTCHA-like challenges) may block legitimate traffic from your payment gateway. The classic symptom: the customer pays successfully, but the order stays "pending payment" because the server-to-server notification (webhook or callback) from RedSys, PayPal or Stripe never reaches your website.
This guide explains how to create an allowlist (whitelist) in Cloudflare for the autonomous systems (ASNs) and IPs of the main payment gateways, so Cloudflare never blocks or challenges them.
This guide applies to any website served through Cloudflare (Free or paid plan), whether it is hosted on a GINERNET shared hosting plan or on a VPS.
Why Cloudflare blocks payments
Payment gateways confirm transactions through server-to-server requests to your website: RedSys' "online notification", PayPal's IPN/webhooks or Stripe's webhooks. These requests are made by a server, not a browser, so they cannot solve a JavaScript challenge or a CAPTCHA. If Cloudflare presents them with a Managed Challenge (Cloudflare's equivalent of a reCAPTCHA), a Browser Integrity Check, or blocks them due to IP reputation, the notification is lost and the payment is never confirmed in your store — even though the bank did charge the customer.
What an ASN is and why to use it for allowlisting
An autonomous system (AS) is the set of IP networks managed by a single organisation on the internet, identified by a unique number: the ASN. Allowing a gateway's official ASN is more robust than maintaining lists of individual IPs: if the gateway adds or changes IPs within its own network, your rule keeps working without any changes.
ASNs of the main payment gateways
| Gateway | ASN | Notes |
|---|---|---|
| RedSys (the virtual POS used by most Spanish banks, and Bizum) | AS31627 | Own ranges: 195.76.9.0/24 and 193.16.243.0/24 |
| PayPal | AS17012 | PayPal also publishes its official IP ranges |
| Adyen | AS200596 | Adyen also recommends resolving out.adyen.com via DNS |
| Stripe | — (not applicable) | Sends webhooks from AWS: use its official IP list |
| Klarna | — (not applicable) | Sends callbacks from AWS: use its official IP list |
Stripe and Klarna send their webhooks from Amazon Web Services infrastructure (AS16509). Never allowlist Amazon's ASN: you would be waving through millions of third-party servers, including malicious bots. For these gateways, always use their official IP lists.
Recommended method: WAF custom rule with the Skip action
Cloudflare recommends using custom rules with the Skip action for allowlists. It is available on all plans, including Free.
- Log in to the Cloudflare dashboard and select your domain.
- Go to Security → WAF → Custom rules (in the new dashboard: Security → Security rules).
- Click Create rule and give it a descriptive name, for example
Payment gateways allowlist. - Click Edit expression and paste this expression (adjust it to the gateways you actually use):
(ip.src.asnum eq 31627)
or (ip.src.asnum eq 17012)
or (ip.src.asnum eq 200596)
or (ip.src in {3.18.12.63 3.130.192.231 13.235.14.237 13.235.122.149 18.211.135.69 35.154.171.200 52.15.183.38 54.88.130.119 54.88.130.237 54.187.174.169 54.187.205.235 54.187.216.72 35.157.207.129 3.69.109.8 3.120.168.93})The first three lines allow the RedSys, PayPal and Adyen ASNs; the last one contains Stripe's webhook IPs. If you use Klarna, also add its production IPs: 52.17.117.56 52.17.176.198 52.0.45.33 52.0.46.187 13.211.30.100 3.104.49.49 13.54.229.130.
- Under Choose action, select Skip.
- Tick every protection you want to bypass. For a full allowlist, tick:
- All remaining custom rules
- All rate limiting rules
- All Super Bot Fight Mode rules
- All managed rules (the WAF managed rulesets)
- Under WAF components to skip: Zone Lockdown, User Agent Blocking, Browser Integrity Check, Hotlink Protection and Security Level (the latter disables security-level challenges).
- Save the rule with Deploy and drag it to the first position in the list, so it is evaluated before any blocking rule.
Bot Fight Mode on the Free plan cannot be bypassed with Skip rules. If Bot Fight Mode is enabled and keeps blocking your webhooks, disable it under Security → Bots or upgrade to a Pro plan with Super Bot Fight Mode, which does honour this rule.
Alternative: IP Access Rules
Under Security → WAF → Tools → IP Access Rules you can create an Allow rule directly for an ASN (for example AS31627). It is quicker but less complete: IP Access Rules do not bypass the WAF managed rules, so a managed-rules false positive would still block the notification. That is why Cloudflare recommends the custom rule with Skip instead.
Verify it works
- Go to Security → Events (or Security → Analytics) in the Cloudflare dashboard.
- Filter by ASN (for example
31627) or by the gateway's source IP. - Make a test payment: the events should now show the Skip action instead of Block or Managed Challenge.
In parallel, check your gateway's panel: RedSys shows the delivery result of its online notification, and Stripe and PayPal log the response code of every webhook (it must be 200, not 403).
Keep signature verification enabled
Allowlisting in Cloudflare does not mean disabling your payment module's security: RedSys' HMAC signature, Stripe's webhook signature verification (Stripe-Signature) and PayPal's IPN validation must stay enabled. The allowlist stops Cloudflare from blocking the communication; the signature guarantees the notification is authentic.
If your website is hosted with GINERNET and you need help with this setup, open a support ticket from your client area and we will give you a hand.