Issue with WAF

D

DadoneOP•7/30/24, 3:11 PM

As my custom rules, after 5minutes or less get changed to block, and unused filter.

D

DadoneOP•7/30/24, 3:11 PM

like this.

D

DadoneOP•7/30/24, 3:12 PM

pretty much the action changes.

DDadone hello is there an issue with cloudflare WAF? custom rules?

C

Chaika•7/30/24, 3:13 PM

no known issues https://www.cloudflarestatus.com/, and nothing like that

C

Chaika•7/30/24, 3:13 PM

I would check your Audit Log to see what's changing it. If you're using a partner like Ezotic or something with access to your account

D

DadoneOP•7/30/24, 3:14 PM

D

DadoneOP•7/30/24, 3:15 PM

User cloudflare... and it changes the value this part specifically.

C

Chaika•7/30/24, 3:16 PM

show the full audit event (hiding your account name/etc as needed)?

CChaika show the full audit event (hiding your account name/etc as needed)?

D

DadoneOP•7/30/24, 3:18 PM

D

DadoneOP•7/30/24, 3:18 PM

]

D

DadoneOP•7/30/24, 3:18 PM

DDadone Click to see attachment

C

Chaika•7/30/24, 3:23 PM

is there any other events or interest around/before that? That w/ the firewall api property kind of looks like something using the old firewalls api and it being translated to a custom rule update

C

Chaika•7/30/24, 3:23 PM

Like terraform or something like that, using those old endpoints

D

DadoneOP•7/30/24, 3:34 PM

i have 3 api keys

D

DadoneOP•7/30/24, 3:34 PM

1 which i should remove, and i will do now,
1 for subdomains (custom stuff)
1 for fail2ban

D

DadoneOP•7/30/24, 3:34 PM

i think fail2ban is the issue, as it wasnt doing this before

D

DadoneOP•7/30/24, 3:35 PM

C

Chaika•7/30/24, 3:35 PM

you don't see anything else in the audit log, and fail2ban is given access to that domain/zone?

D

DadoneOP•7/30/24, 3:35 PM

yes fail2ban has access to the zone

D

DadoneOP•7/30/24, 3:35 PM

C

Chaika•7/30/24, 3:36 PM

could you just stop/pause fail2banfor a bit, change the custom rule back, and see if it happens again?

C

Chaika•7/30/24, 3:36 PM

easier to turn back on then reissuing the token and setting it up again

D

DadoneOP•7/30/24, 3:36 PM

o9k ill pause it and see what happens

D

DadoneOP•7/30/24, 3:36 PM

ok ill pause fail2ban everywhere

D

DadoneOP•7/30/24, 3:40 PM

k paused everywhere, now ill change the rule again.

D

DadoneOP•7/30/24, 3:41 PM

and now we wait

D

DadoneOP•7/30/24, 3:45 PM

seems like that was the issue.

D

DadoneOP•7/30/24, 3:46 PM

but i need fail2ban with cloudflare, not sure what i did wrong with permission.

DDadone but i need fail2ban with cloudflare, not sure what i did wrong with permission.

C

Chaika•7/30/24, 3:47 PM

not permission based, not sure how exactly fail2ban interfaces with Cloudflare (a plugin maybe?), but it looks like it's 1. using the old Firewall API (will be gone in 2025 Jan) and 2. overriding other rules

D

DadoneOP•7/30/24, 3:47 PM

Ok how can i use the new firewall api ig

D

DadoneOP•7/30/24, 3:48 PM

for the record it's here - /etc/fail2ban/action.d/cloudflare.conf and it should be there by default.

D

DadoneOP•7/30/24, 3:50 PM

this is what i had there.

D

DadoneOP•7/30/24, 3:50 PM

i have removed personal information.

[Definition]

# Option:  actionstart
actionstart =

# Option:  actionstop
actionstop =

# Option:  actioncheck
actioncheck =

# Option:  actionban
actionban = curl -s -o /dev/null -X POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules" \
            -H "Authorization: Bearer <YOUR_API_TOKEN>" \
            -H "Content-Type: application/json" \
            --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"Fail2Ban"}'

# Option:  actionunban
actionunban = id=$(curl -s -X GET -H "Authorization: Bearer <YOUR_API_TOKEN>" \
                   -H "Content-Type: application/json" \
                   "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules?mode=block&configuration_target=ip&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban" \
                   | jq -r '.result[0].id'); \
              if [ -z "$id" ]; then echo "Fail2Ban: id for <ip> cannot be found"; exit 0; fi; \
              curl -s -o /dev/null -X DELETE -H "Authorization: Bearer <YOUR_API_TOKEN>" \
              "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules/$id"

[Init]

cftoken = <YOUR_API_TOKEN>
cfuser = <YOUR_EMAIL>

[Definition]

# Option:  actionstart
actionstart =

# Option:  actionstop
actionstop =

# Option:  actioncheck
actioncheck =

# Option:  actionban
actionban = curl -s -o /dev/null -X POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules" \
            -H "Authorization: Bearer <YOUR_API_TOKEN>" \
            -H "Content-Type: application/json" \
            --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"Fail2Ban"}'

# Option:  actionunban
actionunban = id=$(curl -s -X GET -H "Authorization: Bearer <YOUR_API_TOKEN>" \
                   -H "Content-Type: application/json" \
                   "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules?mode=block&configuration_target=ip&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban" \
                   | jq -r '.result[0].id'); \
              if [ -z "$id" ]; then echo "Fail2Ban: id for <ip> cannot be found"; exit 0; fi; \
              curl -s -o /dev/null -X DELETE -H "Authorization: Bearer <YOUR_API_TOKEN>" \
              "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules/$id"

[Init]

cftoken = <YOUR_API_TOKEN>
cfuser = <YOUR_EMAIL>

[Definition]

# Option:  actionstart
actionstart =

# Option:  actionstop
actionstop =

# Option:  actioncheck
actioncheck =

# Option:  actionban
actionban = curl -s -o /dev/null -X POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules" \
            -H "Authorization: Bearer <YOUR_API_TOKEN>" \
            -H "Content-Type: application/json" \
            --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"Fail2Ban"}'

# Option:  actionunban
actionunban = id=$(curl -s -X GET -H "Authorization: Bearer <YOUR_API_TOKEN>" \
                   -H "Content-Type: application/json" \
                   "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules?mode=block&configuration_target=ip&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban" \
                   | jq -r '.result[0].id'); \
              if [ -z "$id" ]; then echo "Fail2Ban: id for <ip> cannot be found"; exit 0; fi; \
              curl -s -o /dev/null -X DELETE -H "Authorization: Bearer <YOUR_API_TOKEN>" \
              "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules/$id"

[Init]

cftoken = <YOUR_API_TOKEN>
cfuser = <YOUR_EMAIL>

[Definition]

# Option:  actionstart
actionstart =

# Option:  actionstop
actionstop =

# Option:  actioncheck
actioncheck =

# Option:  actionban
actionban = curl -s -o /dev/null -X POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules" \
            -H "Authorization: Bearer <YOUR_API_TOKEN>" \
            -H "Content-Type: application/json" \
            --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"Fail2Ban"}'

# Option:  actionunban
actionunban = id=$(curl -s -X GET -H "Authorization: Bearer <YOUR_API_TOKEN>" \
                   -H "Content-Type: application/json" \
                   "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules?mode=block&configuration_target=ip&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban" \
                   | jq -r '.result[0].id'); \
              if [ -z "$id" ]; then echo "Fail2Ban: id for <ip> cannot be found"; exit 0; fi; \
              curl -s -o /dev/null -X DELETE -H "Authorization: Bearer <YOUR_API_TOKEN>" \
              "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/rules/$id"

[Init]

cftoken = <YOUR_API_TOKEN>
cfuser = <YOUR_EMAIL>

D

DadoneOP•7/30/24, 4:19 PM

Any idea what could be causing it to change the rules?

DDadone Any idea what could be causing it to change the rules?

C

Chaika•7/30/24, 4:26 PM

it was making a fw rule per ban? You'd run out rather quickly I would assume

C

Chaika•7/30/24, 4:26 PM

I'm not sure of all the auto translation magic between old firewall api and the new custom rules, there's some docs here: https://developers.cloudflare.com/waf/reference/migration-guides/firewall-rules-to-custom-rules/#relevant-changes-for-api-users

Cloudflare Docs

Firewall Rules to WAF custom rules migration · Cloudflare Web Appli...