How to Route Cloudflare Workers Through a Static IP VPS (And Bypass API Whitelists)

Lobzy technologies ltd — Sat, 14 Nov 2026 16:28:37 +0000

If you’ve ever tried to integrate financial APIs, banking ledgers, or strict payment gateways directly inside a serverless Cloudflare Worker, you’ve likely hit a brick wall: Dynamic IP Whitelists.

Cloudflare uses a rotating pool of edge IPs. Traditional banking and fintech APIs that require a static IP whitelist will instantly reject your outgoing requests with a 403 Forbidden error.

The traditional "fix" Cloudflare offers? Upgrade to Cloudflare Enterprise at $2,000+/month. That is completely out of reach for indie hackers and growing engineering teams.

The Solution: The Zero-Trust VPS Proxy Architecture

Instead of paying enterprise fees, you can route your Cloudflare Worker requests through a dedicated $5/month VPS running a secure reverse proxy.

The Data Flow:

The Trigger: Your Cloudflare Worker needs to make a secure API call.
The Encrypted Tunnel: The Worker sends an authenticated payload to your dedicated VPS static IP via HTTPS.
The Static Gateway: Your VPS (running a lightweight proxy) catches the payload, attaches your whitelisted static IP headers, and forwards it to the destination API.
The Response: The API sees a clean, consistent static IP and returns the data successfully.

Implementation Breakdown

1. The Caddy + HTTPS Reverse Proxy Config (`Caddyfile`)


text
your-proxy-domain.com {
    reverse_proxy localhost:3000 {
        header_up X-Forwarded-For {remote_host}
    }
}

2. The Node.js Core Handler (server.js)
const express = require('express');
const axios = require('axios');
const app = express();

app.use(express.json());

app.post('/proxy-request', async (req, res) => {
    const authHeader = req.headers['authorization'];
    if (authHeader !== `Bearer ${process.env.SECRET_TOKEN}`) {
        return res.status(401).json({ error: 'Unauthorized gateway access' });
    }

    try {
        const apiResponse = await axios({
            method: req.body.method,
            url: req.body.targetUrl,
            data: req.body.payload,
            headers: req.body.headers || {}
        });
        return res.status(200).json(apiResponse.data);
    } catch (err) {
        return res.status(500).json({ error: err.message });
    }
});

app.listen(3000, () => console.log('Static IP Proxy active on port 3000'));

3. Systemd Auto-Restart Daemon (/etc/systemd/system/vps-proxy.service)
[Unit]
Description=Cloudflare Static IP VPS Proxy
After=network.target

[Service]
ExecStart=/usr/bin/node /opt/proxy/server.js
Restart=always
User=root
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

Get the Complete Production Blueprint
If you want to skip hours of trial-and-error, security hardening, and edge-case debugging, I have packaged this entire architecture into a comprehensive, production-ready 16-page technical blueprint.
It includes complete copy-pasteable scripts, security hardening guides, and step-by-step zero-trust configurations.

[👉 Get the Full 16-Page Blueprint on Gumroad ($100)](https://lobzytech.gumroad.com/l/cloudflare-static-ip)

DEV Community: Lobzy technologies ltd

How to Route Cloudflare Workers Through a Static IP VPS (And Bypass API Whitelists)

The Solution: The Zero-Trust VPS Proxy Architecture

Implementation Breakdown

1. The Caddy + HTTPS Reverse Proxy Config (Caddyfile)

1. The Caddy + HTTPS Reverse Proxy Config (`Caddyfile`)