>CloudFlare hates Tor
The free tier of CF blocks Tor in most circumstances yes, but methinks you may be shocked by how many sites are paying extortion money to CF.
>iptables trumps plugins
Yes! Agree 100%! Iptables is awesome. That firewall setup I linked above uses iptables. See line 4378. Blocks CF ip addresses in AS13335, 14789, 132892, 133877, 139242, 202623, 203898, 209242, 394536, 395747.
Its not the best bash script I've read, in fact its not even a proper bash script but its gotta be one of the most useful things I've ever read. If you dislike oligarchy as much as I do then you'll appreciate the Amazon and Akamai ip address lists too. :)