If your online store sits behind Cloudflare, its security systems (WAF, managed rules, Bot Fight Mode or CAPTCHA-like challenges) may block legitimate traffic from your payment gateway. The classic symptom: the customer pays successfully, but the order stays "pending payment" because the server-to-server notification (webhook or callback) from **RedSys**, **PayPal** or **Stripe** never reaches your website.

This guide explains how to create an **allowlist (whitelist) in Cloudflare** for the autonomous systems (ASNs) and IPs of the main payment gateways, so Cloudflare never blocks or challenges them.

:::info
This guide applies to any website served through Cloudflare (Free or paid plan), whether it is hosted on a GINERNET [shared hosting](https://ginernet.com/en/hosting/) plan or on a [VPS](https://ginernet.com/en/vps/).
:::

## Why Cloudflare blocks payments

Payment gateways confirm transactions through **server-to-server** requests to your website: RedSys' "online notification", PayPal's IPN/webhooks or Stripe's webhooks. These requests are made by a server, not a browser, so they **cannot solve a JavaScript challenge or a CAPTCHA**. If Cloudflare presents them with a Managed Challenge (Cloudflare's equivalent of a reCAPTCHA), a Browser Integrity Check, or blocks them due to IP reputation, the notification is lost and the payment is never confirmed in your store — even though the bank did charge the customer.

## What an ASN is and why to use it for allowlisting

An **autonomous system (AS)** is the set of IP networks managed by a single organisation on the internet, identified by a unique number: the **ASN**. Allowing a gateway's official ASN is more robust than maintaining lists of individual IPs: if the gateway adds or changes IPs within its own network, your rule keeps working without any changes.

## ASNs of the main payment gateways

| Gateway | ASN | Notes |
| --- | --- | --- |
| **RedSys** (the virtual POS used by most Spanish banks, and Bizum) | **AS31627** | Own ranges: `195.76.9.0/24` and `193.16.243.0/24` |
| **PayPal** | **AS17012** | PayPal also publishes its [official IP ranges](https://www.paypal.com/us/cshelp/article/ts1056) |
| **Adyen** | **AS200596** | Adyen also recommends resolving `out.adyen.com` via DNS |
| **Stripe** | — (not applicable) | Sends webhooks from AWS: use its [official IP list](https://docs.stripe.com/ips) |
| **Klarna** | — (not applicable) | Sends callbacks from AWS: use its [official IP list](https://docs.klarna.com/acquirer/klarna/get-started/integration-resilience/callbacks/) |

:::danger
Stripe and Klarna send their webhooks from Amazon Web Services infrastructure (AS16509). **Never allowlist Amazon's ASN**: you would be waving through millions of third-party servers, including malicious bots. For these gateways, always use their official IP lists.
:::

## Recommended method: WAF custom rule with the Skip action

Cloudflare recommends using custom rules with the **Skip** action for allowlists. It is available on all plans, including Free.

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your domain.
2. Go to **Security → WAF → Custom rules** (in the new dashboard: **Security → Security rules**).
3. Click **Create rule** and give it a descriptive name, for example `Payment gateways allowlist`.
4. Click **Edit expression** and paste this expression (adjust it to the gateways you actually use):

```
(ip.src.asnum eq 31627)
or (ip.src.asnum eq 17012)
or (ip.src.asnum eq 200596)
or (ip.src in {3.18.12.63 3.130.192.231 13.235.14.237 13.235.122.149 18.211.135.69 35.154.171.200 52.15.183.38 54.88.130.119 54.88.130.237 54.187.174.169 54.187.205.235 54.187.216.72 35.157.207.129 3.69.109.8 3.120.168.93})
```

   The first three lines allow the RedSys, PayPal and Adyen ASNs; the last one contains Stripe's webhook IPs. If you use Klarna, also add its production IPs: `52.17.117.56 52.17.176.198 52.0.45.33 52.0.46.187 13.211.30.100 3.104.49.49 13.54.229.130`.

5. Under **Choose action**, select **Skip**.
6. Tick every protection you want to bypass. For a full allowlist, tick:
   - **All remaining custom rules**
   - **All rate limiting rules**
   - **All Super Bot Fight Mode rules**
   - **All managed rules** (the WAF managed rulesets)
   - Under **WAF components to skip**: *Zone Lockdown*, *User Agent Blocking*, *Browser Integrity Check*, *Hotlink Protection* and *Security Level* (the latter disables security-level challenges).
7. Save the rule with **Deploy** and **drag it to the first position** in the list, so it is evaluated before any blocking rule.

:::warning
**Bot Fight Mode** on the Free plan cannot be bypassed with Skip rules. If Bot Fight Mode is enabled and keeps blocking your webhooks, disable it under **Security → Bots** or upgrade to a Pro plan with Super Bot Fight Mode, which does honour this rule.
:::

## Alternative: IP Access Rules

Under **Security → WAF → Tools → IP Access Rules** you can create an **Allow** rule directly for an ASN (for example `AS31627`). It is quicker but less complete: IP Access Rules **do not bypass the WAF managed rules**, so a managed-rules false positive would still block the notification. That is why Cloudflare recommends the custom rule with Skip instead.

## Verify it works

1. Go to **Security → Events** (or **Security → Analytics**) in the Cloudflare dashboard.
2. Filter by **ASN** (for example `31627`) or by the gateway's source IP.
3. Make a test payment: the events should now show the **Skip** action instead of *Block* or *Managed Challenge*.

In parallel, check your gateway's panel: RedSys shows the delivery result of its online notification, and Stripe and PayPal log the response code of every webhook (it must be `200`, not `403`).

## Keep signature verification enabled

Allowlisting in Cloudflare does not mean disabling your payment module's security: RedSys' HMAC signature, Stripe's webhook signature verification (`Stripe-Signature`) and PayPal's IPN validation must stay enabled. The allowlist stops Cloudflare from blocking the communication; the signature guarantees the notification is authentic.

:::tip
Stripe's and Klarna's IP lists may change over time. Review them periodically in their official documentation ([Stripe](https://docs.stripe.com/ips), [Klarna](https://docs.klarna.com/acquirer/klarna/get-started/integration-resilience/callbacks/)) or subscribe to their developer notices.
:::

If your website is hosted with GINERNET and you need help with this setup, open a support ticket from your client area and we will give you a hand.