How does WARP decide on what geolocation to use for the outgoing IP?
How does WARP decide on what geolocation to use for the outgoing IP?
PI believe this blog piece explains it a bit
https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/#:~:text=track%20you%20directly.-,How%20it%20works,-Traditionally%2C%20consumer%20VPNs
https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/#:~:text=track%20you%20directly.-,How%20it%20works,-Traditionally%2C%20consumer%20VPNs
The Cloudflare Blog
We’re announcing two major improvements to our 1.1.1.1 + WARP apps: first, an improvement to the location accuracy of your browsing activity, and second, an expansion of locations available to WARP+ subscribers.
Dah, thanks!
MHi guys, this is a question regarding recovering account in Cloudflare. Can someone help me? Lost my recovery codes. Thank you
C
HIs there documents that specify the difference now between WAF Custom rules, Zone Lockdown and the IP Access rules? They all seem a bit similar apart from the Zone Lockdown?
Assuming WAF rules are just a more layer 7 set of rules and IP Access rules are more for pure layer 3/4?
Assuming WAF rules are just a more layer 7 set of rules and IP Access rules are more for pure layer 3/4?
CWAF Custom Rules are just way more flexible and have a lot more fields/options. You can use Custom Rule as an IP Access Rule, Cloudflare recommends so:
https://developers.cloudflare.com/waf/tools/ip-access-rules/
https://developers.cloudflare.com/waf/tools/ip-access-rules/
Cloudflare recommends that you create WAF custom rules instead of IP Access rules to perform IP-based or geography-based blocking (geoblocking):
For IP-based blocking, use an IP list in the custom rule expression.
For geoblocking, use fields such as AS Num, Country, and Continent in the custom rule expression
Use IP Access rules to allowlist, block, and challenge traffic based on the visitor’s IP address, country, or Autonomous System Number (ASN).
CZone Lockdown/ IP Access Rules just came first
CIP Access Rules also work for CF Spectrum if you use that
CCF also offers a template for doing Zone Lockdown in a Custom Rule, but really you should be using CF Access instead. It's free, and you can use Github/Google or other providers, much better then IP Allowlisting in 2024
HSoo in a nutshell. Use WAF custom. Unless spectrum in the equation
HWhat do you mean you can use Google etc? Access I guess you just allow once the user is logged into access and have the link to the url on the dashboard
CWith Access, you can deploy a Access Application in front of an origin proxied. When you try to visit it, you go through auth. Default is email one time token, but you can use Google/Github/oauth as well, and get their identity (ex, they signed in with a specific gmail address) and then setup a policy to allow specific addresses
Ca lot better then just IP Whitelisting and hoping
HI guess a good secure way would be to cloudflared the connection from origin, then put that in access for auth users. Save exposing the origin ingress entirely?
CYes absolutely, and even more with Public Hostnames under additional settings you can enable the Access integration and select the specific app.
One key part of Access is ensuring they actually passed through Access to send the request to your application and didn't just circumvent it. Each request which succesfully passes through CF Access gets a signed JWT. https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/
By enabling that feature in cloudflared/Public Hostname, the connector which lives on your origin verifies the request actually passed that access app/your zt team
One key part of Access is ensuring they actually passed through Access to send the request to your application and didn't just circumvent it. Each request which succesfully passes through CF Access gets a signed JWT. https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/
By enabling that feature in cloudflared/Public Hostname, the connector which lives on your origin verifies the request actually passed that access app/your zt team
CThe security being your tunnel can be only used in your account, and that public hostname/origin could only be reached by requests which passed through Access, a nice combo. Just have to not open ports/have a firewall with default block/not allowing your web server to be reachable externally and you're set
HThanks. That looks like something which can be used as extra security via the application code
Ahmm I ran into some bugs linking cloudflare to github, I've fixed it except cloudflare doesnt have the correct github installation id... anyone know how to change or fix that?
Ai suspect its something internal that cant be fixed without support
HHello. I just read the blog post about Cloudflare Calls and my team and I are interested in using it to build a real-time video and audio application at scale. Any ideas on how to get access to the beta?
CI think you're talking about bookmarks? It just adds them to the app launcher, and doesn't do anything else?
CWith Cloudflare Zero Trust, you can show applications on the App Launcher even if those applications are not secured behind Access. This way, users …
Coh I've never played around with that before but it looks like its just through various integrations with them
CCi.e for Sales force it looks like you configure it to use saml single-on with ZT so people login to Salesforce through Zero Trust
Cno
Cthose are specific integrations with specific vendors
CI mean with self-hosted, you can use it with any origin you have (that origin should also be validating the jwt its sent -- https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/)
Cbut the external stuff is just integrations afaik
COnly the Go one is really maintained afaik
CAs for securing apps, if it supports saml can use saas app, if you can put it behind Cloudflare as an origin (and have it verify jwts), self-hosted
CSounds like you have both Authorization (for API Tokens) and X-Auth-Email/X-Auth-Key (for Global API Keys) headers, use one or the other
CWhat's the exact request you're trying (remove any sensitive info)?
CIs that a valid endpoint? I'll test in a sec
The API Docs detail values/{key_name} or /bulk for a list of them
https://developers.cloudflare.com/api/operations/workers-kv-namespace-write-key-value-pair-with-metadata
The API Docs detail values/{key_name} or /bulk for a list of them
https://developers.cloudflare.com/api/operations/workers-kv-namespace-write-key-value-pair-with-metadata
Interact with Cloudflare's products and services via the Cloudflare API
Cyou didn't specify what broke so I'll just give you what ChatGPT 4 gives me which I know does work
FCan I use Cache endpoints response for server hosted with Zero Trust Tunnel in the the Free Plan?
CWorkers fronted by Access don't have cache API, but if you make the requests from your worker to a different domain with zero trust then it can use the cache api
MHello All, i'm having an issue with my application like this: When i'm opening my app via the loptop, the human verification step is acting normal, but when i'm trying to open with mobile devices, then human verification security is taking very long time to be checked. anyone any clue on that what could be issue?
