Is there documents that specify the difference now between WAF Custom rules, Zone Lockdown and the I

Is there documents that specify the difference now between WAF Custom rules, Zone Lockdown and the IP Access rules? They all seem a bit similar apart from the Zone Lockdown?
Assuming WAF rules are just a more layer 7 set of rules and IP Access rules are more for pure layer 3/4?

HHelixEvo Is there documents that specify the difference now between WAF Custom rules, Zon...

Chaika•1/3/24, 2:58 PM

WAF Custom Rules are just way more flexible and have a lot more fields/options. You can use Custom Rule as an IP Access Rule, Cloudflare recommends so:
https://developers.cloudflare.com/waf/tools/ip-access-rules/

Cloudflare recommends that you create WAF custom rules instead of IP Access rules to perform IP-based or geography-based blocking (geoblocking):

For IP-based blocking, use an IP list in the custom rule expression.
For geoblocking, use fields such as AS Num, Country, and Continent in the custom rule expression

IP Access rules · Cloudflare Web Application Firewall (WAF) docs

Use IP Access rules to allowlist, block, and challenge traffic based on the visitor’s IP address, country, or Autonomous System Number (ASN).

Chaika•1/3/24, 2:59 PM

Zone Lockdown/ IP Access Rules just came first

Chaika•1/3/24, 2:59 PM

IP Access Rules also work for CF Spectrum if you use that

Chaika•1/3/24, 3:02 PM

CF also offers a template for doing Zone Lockdown in a Custom Rule, but really you should be using CF Access instead. It's free, and you can use Github/Google or other providers, much better then IP Allowlisting in 2024

HelixEvoOP•1/3/24, 3:02 PM

Soo in a nutshell. Use WAF custom. Unless spectrum in the equation

CChaika CF also offers a template for doing Zone Lockdown in a Custom Rule, but really y...

HelixEvoOP•1/3/24, 3:05 PM

What do you mean you can use Google etc? Access I guess you just allow once the user is logged into access and have the link to the url on the dashboard

Chaika•1/3/24, 3:06 PM

With Access, you can deploy a Access Application in front of an origin proxied. When you try to visit it, you go through auth. Default is email one time token, but you can use Google/Github/oauth as well, and get their identity (ex, they signed in with a specific gmail address) and then setup a policy to allow specific addresses

Chaika•1/3/24, 3:06 PM

a lot better then just IP Whitelisting and hoping

HelixEvoOP•1/3/24, 3:08 PM

I guess a good secure way would be to cloudflared the connection from origin, then put that in access for auth users. Save exposing the origin ingress entirely?

Chaika•1/3/24, 3:10 PM

Yes absolutely, and even more with Public Hostnames under additional settings you can enable the Access integration and select the specific app.

One key part of Access is ensuring they actually passed through Access to send the request to your application and didn't just circumvent it. Each request which succesfully passes through CF Access gets a signed JWT. https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/
By enabling that feature in cloudflared/Public Hostname, the connector which lives on your origin verifies the request actually passed that access app/your zt team

Chaika•1/3/24, 3:11 PM

The security being your tunnel can be only used in your account, and that public hostname/origin could only be reached by requests which passed through Access, a nice combo. Just have to not open ports/have a firewall with default block/not allowing your web server to be reachable externally and you're set

CChaika Yes absolutely, and even more with Public Hostnames under additional settings yo...

HelixEvoOP•1/3/24, 3:15 PM

Thanks. That looks like something which can be used as extra security via the application code

AA•1/3/24, 7:21 PM

hmm I ran into some bugs linking cloudflare to github, I've fixed it except cloudflare doesnt have the correct github installation id... anyone know how to change or fix that?

AA•1/3/24, 7:22 PM

i suspect its something internal that cant be fixed without support

Hyper•1/3/24, 8:05 PM

Hello. I just read the blog post about Cloudflare Calls and my team and I are interested in using it to build a real-time video and audio application at scale. Any ideas on how to get access to the beta?

Pprender i saw access you can also pin to applications that arent proxied right? such as ...

Chaika•1/3/24, 9:33 PM

I think you're talking about bookmarks? It just adds them to the app launcher, and doesn't do anything else?

Chaika•1/3/24, 9:33 PM

https://developers.cloudflare.com/cloudflare-one/applications/bookmarks/

Add bookmarks · Cloudflare Zero Trust docs

With Cloudflare Zero Trust, you can show applications on the App Launcher even if those applications are not secured behind Access. This way, users …

Chaika•1/3/24, 9:35 PM

oh I've never played around with that before but it looks like its just through various integrations with them

Chaika•1/3/24, 9:35 PM

https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/saas-apps/salesforce-saas/

Salesforce - Access for SaaS · Cloudflare Zero Trust docs

This guide covers how to:

Chaika•1/3/24, 9:35 PM

i.e for Sales force it looks like you configure it to use saml single-on with ZT so people login to Salesforce through Zero Trust

Chaika•1/3/24, 9:35 PM

Chaika•1/3/24, 9:36 PM

those are specific integrations with specific vendors

Chaika•1/3/24, 9:36 PM

I mean with self-hosted, you can use it with any origin you have (that origin should also be validating the jwt its sent -- https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/)

Chaika•1/3/24, 9:36 PM

but the external stuff is just integrations afaik

Chaika•1/3/24, 9:39 PM

Only the Go one is really maintained afaik

Pprender ah and the others just rely on cloudflare partnered with that external integrati...

Chaika•1/3/24, 9:41 PM

As for securing apps, if it supports saml can use saas app, if you can put it behind Cloudflare as an origin (and have it verify jwts), self-hosted

Pprender ok thanks for the info, quick thing: PUT method not allowed for the api_token au...

Chaika•1/3/24, 10:21 PM

Sounds like you have both Authorization (for API Tokens) and X-Auth-Email/X-Auth-Key (for Global API Keys) headers, use one or the other

Chaika•1/3/24, 10:22 PM

What's the exact request you're trying (remove any sensitive info)?

Pprender ```js const apiUrl = `https://api.cloudflare.com/client/v4/accounts/${accountId}...

Chaika•1/3/24, 10:27 PM

Is that a valid endpoint? I'll test in a sec
The API Docs detail values/{key_name} or /bulk for a list of them
https://developers.cloudflare.com/api/operations/workers-kv-namespace-write-key-value-pair-with-metadata

Cloudflare API Documentation

Interact with Cloudflare's products and services via the Cloudflare API

Pprender still failing

Chaika•1/3/24, 10:34 PM

you didn't specify what broke so I'll just give you what ChatGPT 4 gives me which I know does work

fedeb🇦🇷•1/4/24, 2:04 AM

Can I use Cache endpoints response for server hosted with Zero Trust Tunnel in the the Free Plan?

Cyb3r-Jak3•1/4/24, 3:12 AM

Workers fronted by Access don't have cache API, but if you make the requests from your worker to a different domain with zero trust then it can use the cache api

Mirand•1/4/24, 12:44 PM

Hello All, i'm having an issue with my application like this: When i'm opening my app via the loptop, the human verification step is acting normal, but when i'm trying to open with mobile devices, then human verification security is taking very long time to be checked. anyone any clue on that what could be issue?

aaaaaaaaaaaaaaaaa•1/4/24, 6:07 PM

Seeing what ever happened to Privacy Pass reminds me. What is happening with Cloudflare Snippets?

Unsmart•1/4/24, 6:09 PM

They are being worked on and tested probably mostly with enterprise customers if I had to guess

AlphaCentauri•1/4/24, 6:25 PM

Every day I open up Discord and the CF blog just to check if it's in open beta, then subsequently close my computer utterly disappointed, and the cycle repeats.

AlphaCentauri•1/4/24, 6:25 PM

I can probably take a few more weeks before I go insane tbh

Andy•1/4/24, 7:28 PM

is something wrong with pages? i keep getting served old versions of files even tho it keeps saying last modified a few seconds ago when i go to view the new page

Is there documents that specify the difference now between WAF Custom rules, Zone Lockdown and the I

Similar Threads

Similar Threads

Similar Threads