WAF - Create a rule that blocks multiple full URLs unless one specific IP tries to access them.

Hey there!

I started hosting a simple uploading server and I need to block a few URLs on Cloudflare's side.
I put the webserver behind cloudflared and gave it the subdomain "upload". There are multiple paths (/, /paste, /upload and /API) which I need to block unless my IP tries to access them. I have a static IP, this rule won't have to be updated. I want every other path to be accessible by anyone.

I tried:
If incoming requests match.. IP source address - doesn't equal - (my IP) - and - URI full - does equal - https.//upload.dvidpi.ovh/ - or - URI full - does equal - etc... etc.. until I listed out all the paths. - then.. - block

It does work, although only for the root (/) everything else is accessible from a different IP.

Is this possible? Thanks.

Erisa•12/28/23, 12:57 PM

When you do "OR" it starts a new logic chain, so you have to add the IP again. You can see here its not linked to the other logic

Erisa•12/28/23, 12:57 PM

So you have to do this nightmare of flow

EErisa So you have to do this nightmare of flow

DavidOP•12/28/23, 12:58 PM

Alright, if that's what will work, I will do it haha
Many thanks!

DDavid Alright, if that's what will work, I will do it haha Many thanks!

Erisa•12/28/23, 12:58 PM

If the URIs are all on the same hostname i recommend chaining hostname and path because you can use "is in" for path which simplifies a lot

EErisa If the URIs are all on the same hostname i recommend chaining hostname and path ...

DavidOP•12/28/23, 12:58 PM

Ah I see, I'll try this one out.
Thanks!

DavidOP•12/28/23, 1:01 PM

One more thing, how long does it take for WAF rules to propagate? I replicated the setup you sent and it still doesn't seem to work.

Erisa•12/28/23, 1:05 PM

A minute or two at its worst

DavidOP•12/28/23, 1:06 PM

It looks like it doesn't work then. I'll clear my cache and see

DavidOP•12/28/23, 1:07 PM

I cleared my cache and I can still access the address even through different IPs

DavidOP•12/28/23, 1:08 PM

Here's how the rule looks like

Erisa•12/28/23, 1:09 PM

are there any skip rules above it?

Erisa•12/28/23, 1:09 PM

just from looking at that rule it seems to be right

DavidOP•12/28/23, 1:09 PM

There's only a rule to block xmlrpc.php on my wordpress installation above that one

Erisa•12/28/23, 1:10 PM

Also I get blocked by.. something

DavidOP•12/28/23, 1:10 PM

Yes, try accessing /paste on that URL

DavidOP•12/28/23, 1:10 PM

It lets you in, right?

Erisa•12/28/23, 1:10 PM

no, same error on paste

Erisa•12/28/23, 1:10 PM

but if I make up some random path e.g. https://upload.dvidpi.ovh/asdfg then it works

EErisa but if I make up some random path e.g. https://upload.dvidpi.ovh/asdfg then it w...

DavidOP•12/28/23, 1:11 PM

Yes, that should be accessible.
It looks like it's an issue on my side then.
Many thanks again!

Erisa•12/28/23, 1:11 PM

One thing I have noticed though is that /paste/paste blocks but /paste//paste/ works

Erisa•12/28/23, 1:11 PM

so maybe should add that too

EErisa so maybe should add that too

DavidOP•12/28/23, 1:11 PM

Should I add both or will /paste/ work for both?

Erisa•12/28/23, 1:12 PM

You should add both, theyre treated as separate URIs

EErisa You should add both, theyre treated as separate URIs

DavidOP•12/28/23, 1:12 PM

Will do! Thanks again.

Erisa•12/28/23, 1:12 PM

same for /upload/

Erisa•12/28/23, 1:12 PM

No problem

DDavid Will do! Thanks again.

digitalpoint•12/28/23, 6:52 PM

FWIW, it looks like you are trying to use WAF rules to do what Zero Trust Access was designed to do (allowing specific humans to certain areas). It will work, but might be worth looking at Zero Trust Access to make it easier to manage additional users/IP changes in the future (also doesn't use one of your limited number of firewall rules).

WAF - Create a rule that blocks multiple full URLs unless one specific IP tries to access them.

Similar Threads

Similar Threads

Similar Threads