The UX for bulk redirects is very bad ngl. Took me way too long to setup a simple www. to root <:LUL

The UX for bulk redirects is very bad ngl. Took me way too long to setup a simple www. to root LUL

Normal redirect rules are easy to shuffle through in the UI but needs a function to preserve the path which is annoying.

UUnsmart The UX for bulk redirects is very bad ngl. Took me way too long to setup a simpl...

AA•1/2/24, 6:56 PM

were you able to do this with wildcards? or did you have to specify everything

AA•1/2/24, 6:56 PM

www.$1 to $1 301 if these rules are 'account level' and not domain level, and you're limited on them.. this seems to be the best way

UnsmartOP•1/2/24, 6:57 PM

I just put

www.domain.com

www.domain.com

domain.com

domain.com

no wildcards needed it preserves the path with a checkbox instead

AA•1/2/24, 6:57 PM

oh i see

AA•1/2/24, 6:58 PM

so a bulk rule with all your domains basically

UUnsmart The UX for bulk redirects is very bad ngl. Took me way too long to setup a simpl...

Chaika•1/2/24, 7:11 PM

it's a bit better now lol

Chaika•1/2/24, 7:11 PM

guides you to create the rule when you make a list

dave•1/2/24, 11:04 PM

How does WARP decide on what geolocation to use for the outgoing IP?

Ddave How does WARP decide on what geolocation to use for the outgoing IP?

Peps•1/2/24, 11:16 PM

I believe this blog piece explains it a bit
https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/#:~:text=track%20you%20directly.-,How%20it%20works,-Traditionally%2C%20consumer%20VPNs

The Cloudflare Blog

1.1.1.1 + WARP: More features, still private

We’re announcing two major improvements to our 1.1.1.1 + WARP apps: first, an improvement to the location accuracy of your browsing activity, and second, an expansion of locations available to WARP+ subscribers.

PPeps I believe this blog piece explains it a bit https://blog.cloudflare.com/geoexit-...

dave•1/2/24, 11:17 PM

ah, thanks!

Mika•1/3/24, 1:38 AM

Hi guys, this is a question regarding recovering account in Cloudflare. Can someone help me? Lost my recovery codes. Thank you

MMika Hi guys, this is a question regarding recovering account in Cloudflare. Can some...

Cyb3r-Jak3•1/3/24, 1:40 AM

Follow https://dash.cloudflare.com/login-help. Any recovery needs to go through support

HelixEvo•1/3/24, 2:52 PM

Is there documents that specify the difference now between WAF Custom rules, Zone Lockdown and the IP Access rules? They all seem a bit similar apart from the Zone Lockdown?
Assuming WAF rules are just a more layer 7 set of rules and IP Access rules are more for pure layer 3/4?

HHelixEvo Is there documents that specify the difference now between WAF Custom rules, Zon...

Chaika•1/3/24, 2:58 PM

WAF Custom Rules are just way more flexible and have a lot more fields/options. You can use Custom Rule as an IP Access Rule, Cloudflare recommends so:
https://developers.cloudflare.com/waf/tools/ip-access-rules/

Cloudflare recommends that you create WAF custom rules instead of IP Access rules to perform IP-based or geography-based blocking (geoblocking):

For IP-based blocking, use an IP list in the custom rule expression.
For geoblocking, use fields such as AS Num, Country, and Continent in the custom rule expression

IP Access rules · Cloudflare Web Application Firewall (WAF) docs

Use IP Access rules to allowlist, block, and challenge traffic based on the visitor’s IP address, country, or Autonomous System Number (ASN).

Chaika•1/3/24, 2:59 PM

Zone Lockdown/ IP Access Rules just came first

Chaika•1/3/24, 2:59 PM

IP Access Rules also work for CF Spectrum if you use that

Chaika•1/3/24, 3:02 PM

CF also offers a template for doing Zone Lockdown in a Custom Rule, but really you should be using CF Access instead. It's free, and you can use Github/Google or other providers, much better then IP Allowlisting in 2024

HelixEvo•1/3/24, 3:02 PM

Soo in a nutshell. Use WAF custom. Unless spectrum in the equation

CChaika CF also offers a template for doing Zone Lockdown in a Custom Rule, but really y...

HelixEvo•1/3/24, 3:05 PM

What do you mean you can use Google etc? Access I guess you just allow once the user is logged into access and have the link to the url on the dashboard

Chaika•1/3/24, 3:06 PM

With Access, you can deploy a Access Application in front of an origin proxied. When you try to visit it, you go through auth. Default is email one time token, but you can use Google/Github/oauth as well, and get their identity (ex, they signed in with a specific gmail address) and then setup a policy to allow specific addresses

Chaika•1/3/24, 3:06 PM

a lot better then just IP Whitelisting and hoping

HelixEvo•1/3/24, 3:08 PM

I guess a good secure way would be to cloudflared the connection from origin, then put that in access for auth users. Save exposing the origin ingress entirely?

Chaika•1/3/24, 3:10 PM

Yes absolutely, and even more with Public Hostnames under additional settings you can enable the Access integration and select the specific app.

One key part of Access is ensuring they actually passed through Access to send the request to your application and didn't just circumvent it. Each request which succesfully passes through CF Access gets a signed JWT. https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/
By enabling that feature in cloudflared/Public Hostname, the connector which lives on your origin verifies the request actually passed that access app/your zt team

Chaika•1/3/24, 3:11 PM

The security being your tunnel can be only used in your account, and that public hostname/origin could only be reached by requests which passed through Access, a nice combo. Just have to not open ports/have a firewall with default block/not allowing your web server to be reachable externally and you're set

CChaika Yes absolutely, and even more with Public Hostnames under additional settings yo...

HelixEvo•1/3/24, 3:15 PM

Thanks. That looks like something which can be used as extra security via the application code

AA•1/3/24, 7:21 PM

hmm I ran into some bugs linking cloudflare to github, I've fixed it except cloudflare doesnt have the correct github installation id... anyone know how to change or fix that?

AA•1/3/24, 7:22 PM

i suspect its something internal that cant be fixed without support

Hyper•1/3/24, 8:05 PM

Hello. I just read the blog post about Cloudflare Calls and my team and I are interested in using it to build a real-time video and audio application at scale. Any ideas on how to get access to the beta?

Pprender i saw access you can also pin to applications that arent proxied right? such as ...

Chaika•1/3/24, 9:33 PM

I think you're talking about bookmarks? It just adds them to the app launcher, and doesn't do anything else?

Chaika•1/3/24, 9:33 PM

https://developers.cloudflare.com/cloudflare-one/applications/bookmarks/

Add bookmarks · Cloudflare Zero Trust docs

With Cloudflare Zero Trust, you can show applications on the App Launcher even if those applications are not secured behind Access. This way, users …

Chaika•1/3/24, 9:35 PM

oh I've never played around with that before but it looks like its just through various integrations with them

Chaika•1/3/24, 9:35 PM

https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/saas-apps/salesforce-saas/

Salesforce - Access for SaaS · Cloudflare Zero Trust docs

This guide covers how to:

Chaika•1/3/24, 9:35 PM

i.e for Sales force it looks like you configure it to use saml single-on with ZT so people login to Salesforce through Zero Trust

Chaika•1/3/24, 9:35 PM

Chaika•1/3/24, 9:36 PM

those are specific integrations with specific vendors

Chaika•1/3/24, 9:36 PM

I mean with self-hosted, you can use it with any origin you have (that origin should also be validating the jwt its sent -- https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/)

Chaika•1/3/24, 9:36 PM

but the external stuff is just integrations afaik

Chaika•1/3/24, 9:39 PM

Only the Go one is really maintained afaik

Pprender ah and the others just rely on cloudflare partnered with that external integrati...

Chaika•1/3/24, 9:41 PM

As for securing apps, if it supports saml can use saas app, if you can put it behind Cloudflare as an origin (and have it verify jwts), self-hosted

Pprender ok thanks for the info, quick thing: PUT method not allowed for the api_token au...

Chaika•1/3/24, 10:21 PM

Sounds like you have both Authorization (for API Tokens) and X-Auth-Email/X-Auth-Key (for Global API Keys) headers, use one or the other

Chaika•1/3/24, 10:22 PM

What's the exact request you're trying (remove any sensitive info)?

The UX for bulk redirects is very bad ngl. Took me way too long to setup a simple www. to root <:LUL

Similar Threads

Similar Threads

Similar Threads