I would like to protect my OCI install with Cloudflare, to be available to my country only. Cloudflare DNS record can be proxied and I've whitelisted only Cloudlfare IP for the 443 I got different error, about SSL MIsmatch. any reason that it might happen ? Also, does blocking the *.nm.x.com is enough or I should also find way to control 53 ?

you do not need to run 53 except for specific circumstances so can just block that port entirely if you want. For the ssl mismach i dont know what's happening there. Is this on CaddY?