Skip to content

How to Bypass Cloudflare WAF in Kubernetes (Flaresolverr)

When self-hosting automation tools like Prowlarr or Jackett to search public BitTorrent trackers (like 1337x or EZTV), you will inevitably encounter the dreaded Blocked by CloudFlare Protection error.

This happens because Cloudflare's Web Application Firewall (WAF) detects that your request is coming from an automated script (a bot) rather than a real human using a web browser. Cloudflare intercepts the request and throws up an invisible Javascript CAPTCHA challenge. Because Prowlarr cannot execute the Javascript to solve the CAPTCHA, it fails.

The Solution: Flaresolverr

Flaresolverr is a proxy server designed to bypass Cloudflare protection.

It works by spinning up a headless Google Chrome web browser. When Prowlarr wants to search an indexer, it sends the request to Flaresolverr instead. Flaresolverr opens the indexer in its headless browser, waits for the Cloudflare Javascript challenge to be solved, extracts the raw HTML cookies, and sends them back to Prowlarr.

Deploying Flaresolverr

First, deploy the microservice into your Kubernetes cluster within the same namespace as your media apps.

# flaresolverr.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: flaresolverr
  namespace: media
spec:
  replicas: 1
  selector:
    matchLabels:
      app: flaresolverr
  template:
    metadata:
      labels:
        app: flaresolverr
    spec:
      containers:
        - name: flaresolverr
          image: ghcr.io/flaresolverr/flaresolverr:latest
          ports:
            - containerPort: 8191
          env:
            - name: LOG_LEVEL
              value: info
---
apiVersion: v1
kind: Service
metadata:
  name: flaresolverr
  namespace: media
spec:
  selector:
    app: flaresolverr
  ports:
    - protocol: TCP
      port: 8191
      targetPort: 8191

Apply the manifest: 

kubectl apply -f flaresolverr.yaml

Configuring Prowlarr

Once the pod is running, link it to Prowlarr:

  1. Open Prowlarr and navigate to Settings > Indexers.
  2. Click the + button to add a new Indexer/Proxy.
  3. Scroll to the bottom and select Flaresolverr.
  4. Set the Host to the internal Kubernetes DNS name of the service: http://flaresolverr.media.svc.cluster.local:8191.
  5. Under Tags, type flare and press Enter. This tag is critical.
  6. Click Save.

By default, Flaresolverr is added in a "Disabled" state. Click the newly created Flaresolverr tile, check the Enable box, and hit Save.

Tagging the Indexer

Flaresolverr is resource-intensive because it spins up a real web browser. You do not want to proxy all your indexer traffic through it, only the indexers that are blocked by Cloudflare.

  1. Go to Indexers and click + to add your desired indexer (e.g., 1337x).
  2. Scroll to the bottom of the indexer's settings to the Tags field.
  3. Type the exact same tag you used above: flare and press Enter.
  4. Click Test and then Save.

Because the indexer and the proxy share the flare tag, Prowlarr will automatically route all requests for 1337x through the headless Chrome browser, successfully bypassing the WAF protection!