I have closed all the ports on my server. I only allow access to port 80 and 443 for Cloudflare ip-addresses. I’ve added the ip-ranges of Cloudflare to iptables in Ubuntu 22.04 to achieve this.

Now I would like to make an automation that checks every night at 00:05 if the ip-ranges of Cloudflare have been changed. If so I would like to login with SSH delete all the ip-ranges in iptables and import the new ip-ranges of Cloudflare.
Therefore I’ve made the PHP script below, that is executed every night with a cronjob.

For this action I would like to create an SSH user named “iptables” which rights are limited to the following 3 actions. So the SSH user shouldn’t have any other rights out of security reasons. SSH is already restricted by ip-address.

• sudo iptables -F
• iptables -A INPUT -p tcp -m multiport –dports http,https -j DROP
• iptables -I INPUT -p tcp -m multiport –dports http,https -s $i -j ACCEPT; done

If this is not possible I would like to limit the rights of the user to only iptables.
How can I achieve this and is this possible?

$url = 'https://www.cloudflare.com/ips-v4';
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_NOBODY, true);
curl_setopt($curl, CURLOPT_HEADER, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_FILETIME, true);
$result = curl_exec($curl);
$date_modified = curl_getinfo($curl);
curl_close($curl);

$date_modified = date ("d-m-Y", $date_modified['filetime']);
$date_yesterday = date('d-m-Y',strtotime("-1 days"));

//IF MODIFIED DATE IS EQUAL TO YESTERDAYS DATE UPDATE IP4 IPTABLES
if ($date_modified == $date_yesterday ){
    
// LOGIN WITH SSH   
$connection = ssh2_connect($ssh_host, 22);

// LOGIN SUCCESFULL
if(ssh2_auth_password($connection, $ssh_user, $ssh_password)){
    
// DELETE ALL IP4 IPTABLES RULES WITH FLUSH
$stream = ssh2_exec($connection, 'sudo iptables -F');
    
// ACCEPT THE CURRENT IP4 RANGE FROM CLOUDFLARE FOR PORT 80 AND 443 
$stream = ssh2_exec($connection, 'for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done');
    
// DENY ALL OTHER IP4 ADDRESSES 
$stream = ssh2_exec($connection, 'iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP');
    
// LOGOUT FROM SSH
ssh2_exec($connection, 'exit');
ssh2_disconnect();

// FLUSH $connection
$connection = null;
unset($connection);
    
}

// LOGIN FAILED
else{
    $conn_error=1;
}

} ```