yea surpised me when my regular domain/paths weren't working and overmatching 😛
yea surpised me when my regular domain/paths weren't working and overmatching 
AI'll leave my page rules for the www bit for now. no need to change it.. tho it would be amazing to have a simple way to make all www become apex
Cyea, all that runs on the connector/cloudflared in Go, Cloudflare's part is just having the dns record proxied cname and sending traffic down the tunnel, can use dns wildcards for that but no regex running on CF's edge
Cpage rules aren't going away yet thankfully, still some stuff like redirecting subdomain + path which is really hard in redirect rules but easy in Page Rules, the matching/replacement wildcards is super powerful
C(well, hard to do without business match function)
Ayea thats what i'm using. it seems like the perfect design www.site.com becomes site.com/$1
UThe UX for bulk redirects is very bad ngl. Took me way too long to setup a simple www. to root 
Normal redirect rules are easy to shuffle through in the UI but needs a function to preserve the path which is annoying.
Normal redirect rules are easy to shuffle through in the UI but needs a function to preserve the path which is annoying.
Awere you able to do this with wildcards? or did you have to specify everything
Awww.$1 to $1 301 if these rules are 'account level' and not domain level, and you're limited on them.. this seems to be the best way
UI just put
www.domain.com to domain.com no wildcards needed it preserves the path with a checkbox insteadAoh i see
Aso a bulk rule with all your domains basically
Cit's a bit better now lol
Cguides you to create the rule when you make a list
DHow does WARP decide on what geolocation to use for the outgoing IP?
PI believe this blog piece explains it a bit
https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/#:~:text=track%20you%20directly.-,How%20it%20works,-Traditionally%2C%20consumer%20VPNs
https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/#:~:text=track%20you%20directly.-,How%20it%20works,-Traditionally%2C%20consumer%20VPNs
The Cloudflare Blog
We’re announcing two major improvements to our 1.1.1.1 + WARP apps: first, an improvement to the location accuracy of your browsing activity, and second, an expansion of locations available to WARP+ subscribers.
Dah, thanks!
MHi guys, this is a question regarding recovering account in Cloudflare. Can someone help me? Lost my recovery codes. Thank you
C
HIs there documents that specify the difference now between WAF Custom rules, Zone Lockdown and the IP Access rules? They all seem a bit similar apart from the Zone Lockdown?
Assuming WAF rules are just a more layer 7 set of rules and IP Access rules are more for pure layer 3/4?
Assuming WAF rules are just a more layer 7 set of rules and IP Access rules are more for pure layer 3/4?
CWAF Custom Rules are just way more flexible and have a lot more fields/options. You can use Custom Rule as an IP Access Rule, Cloudflare recommends so:
https://developers.cloudflare.com/waf/tools/ip-access-rules/
https://developers.cloudflare.com/waf/tools/ip-access-rules/
Cloudflare recommends that you create WAF custom rules instead of IP Access rules to perform IP-based or geography-based blocking (geoblocking):
For IP-based blocking, use an IP list in the custom rule expression.
For geoblocking, use fields such as AS Num, Country, and Continent in the custom rule expression
Use IP Access rules to allowlist, block, and challenge traffic based on the visitor’s IP address, country, or Autonomous System Number (ASN).
CZone Lockdown/ IP Access Rules just came first
CIP Access Rules also work for CF Spectrum if you use that
CCF also offers a template for doing Zone Lockdown in a Custom Rule, but really you should be using CF Access instead. It's free, and you can use Github/Google or other providers, much better then IP Allowlisting in 2024
HSoo in a nutshell. Use WAF custom. Unless spectrum in the equation
HWhat do you mean you can use Google etc? Access I guess you just allow once the user is logged into access and have the link to the url on the dashboard
CWith Access, you can deploy a Access Application in front of an origin proxied. When you try to visit it, you go through auth. Default is email one time token, but you can use Google/Github/oauth as well, and get their identity (ex, they signed in with a specific gmail address) and then setup a policy to allow specific addresses
Ca lot better then just IP Whitelisting and hoping
HI guess a good secure way would be to cloudflared the connection from origin, then put that in access for auth users. Save exposing the origin ingress entirely?
CYes absolutely, and even more with Public Hostnames under additional settings you can enable the Access integration and select the specific app.
One key part of Access is ensuring they actually passed through Access to send the request to your application and didn't just circumvent it. Each request which succesfully passes through CF Access gets a signed JWT. https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/
By enabling that feature in cloudflared/Public Hostname, the connector which lives on your origin verifies the request actually passed that access app/your zt team
One key part of Access is ensuring they actually passed through Access to send the request to your application and didn't just circumvent it. Each request which succesfully passes through CF Access gets a signed JWT. https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/
By enabling that feature in cloudflared/Public Hostname, the connector which lives on your origin verifies the request actually passed that access app/your zt team
CThe security being your tunnel can be only used in your account, and that public hostname/origin could only be reached by requests which passed through Access, a nice combo. Just have to not open ports/have a firewall with default block/not allowing your web server to be reachable externally and you're set
HThanks. That looks like something which can be used as extra security via the application code
Ahmm I ran into some bugs linking cloudflare to github, I've fixed it except cloudflare doesnt have the correct github installation id... anyone know how to change or fix that?
Ai suspect its something internal that cant be fixed without support
HHello. I just read the blog post about Cloudflare Calls and my team and I are interested in using it to build a real-time video and audio application at scale. Any ideas on how to get access to the beta?
CI think you're talking about bookmarks? It just adds them to the app launcher, and doesn't do anything else?
CWith Cloudflare Zero Trust, you can show applications on the App Launcher even if those applications are not secured behind Access. This way, users …
Coh I've never played around with that before but it looks like its just through various integrations with them
CCi.e for Sales force it looks like you configure it to use saml single-on with ZT so people login to Salesforce through Zero Trust
Cno
Cthose are specific integrations with specific vendors
CI mean with self-hosted, you can use it with any origin you have (that origin should also be validating the jwt its sent -- https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/)
Cbut the external stuff is just integrations afaik
