The Ultimate Guide to Cloudflare Firewall Rules (2023 Update)

The Ultimate Guide to Cloudflare Firewall Rules (2023 Update)

Cloudflare’s Firewall Rules are a powerful, yet often underutilized, feature that provides granular control over traffic hitting your website. They form the bedrock of your Web Application Firewall (WAF), allowing you to block malicious requests, filter based on diverse criteria, and fine-tune your security posture beyond pre-configured rulesets. This guide provides a comprehensive overview of Cloudflare Firewall Rules, updated for 2023, covering everything from basic principles to advanced configurations.

What are Cloudflare Firewall Rules?

At their core, Firewall Rules are a set of “if-then” statements applied to incoming HTTP requests. You define the “if” (the criteria a request must meet) and the “then” (the action Cloudflare should take). This allows you to create highly specific security policies tailored to your application’s needs.

Key Concepts and Terminology:

• Fields: The attributes of an incoming HTTP request you can use in your rules. Examples include:

  • http.request.uri.path: The path portion of the URL (e.g., /blog/article1).
  • http.request.method: The HTTP method (e.g., GET, POST, PUT).
  • http.request.headers["user-agent"]: The User-Agent header.
  • ip.src: The source IP address.
  • cf.threat_score: Cloudflare’s threat score for the IP address.
  • cf.bot_management.score: Bot Management score (for Pro plans and above).
  • asn: The Autonomous System Number (ASN) of the originating network.
  • country: The country the request originated from.
  • http.request.cookies["cookie_name"]: A specific cookie value.
  • http.request.full_uri: The complete URL, including query parameters.
  • http.request.uri.query: The query string portion of the URL.
  • http.referer: The Referer header.
  • ssl: Whether the request is using HTTPS.
  • ja3_md5: JA3 fingerprint hash (for identifying client applications). Powerful for bot detection.
  • http.request.version: The HTTP version (e.g., HTTP/1.1, HTTP/2).

• Operators: Comparisons used to evaluate fields against your specified values. Examples include:

  • equals
  • not equals
  • contains
  • not contains
  • matches (regex) (Regular expression matching – extremely powerful).
  • not matches (regex)
  • in (Checks if a value is within a list).
  • not in
  • greater than
  • less than
  • greater than or equals
  • less than or equals
  • starts_with
  • ends_with

• Values: The specific values you compare against the fields using the operators. These can be strings, numbers, regular expressions, or lists.

• Logical Operators: Combine multiple conditions within a single rule.

  • and: All conditions must be true.
  • or: At least one condition must be true.
  • not: Negates a condition

• Actions: The action Cloudflare takes when a rule matches.

  • Block: Completely blocks the request.
  • Challenge (Captcha): Presents a CAPTCHA challenge to the user.
  • JS Challenge: Presents a JavaScript challenge (more subtle than CAPTCHA, better for bots).
  • Managed Challenge: Automatically selects the best challenge type based on the threat.
  • Allow: Explicitly allows the request, bypassing further rule evaluation.
  • Bypass: Disables specific Cloudflare features for the matching request (e.g., Bypass WAF, Bypass Page Rules).
  • Log: Logs the request but doesn’t block it (useful for testing).
  • Skip: Skips specific Firewall Rules (useful for creating exceptions to broader rules).

Creating Firewall Rules:

1. Log in to your Cloudflare Dashboard: Go to the website for which you want to create rules.
2. Navigate to Security -> WAF -> Firewall rules.
3. Click “Create a Firewall rule”.

You can create rules using two methods:

• Rule Builder (Visual Editor): A user-friendly interface for constructing rules using dropdowns and input fields. This is ideal for most use cases.
• Expression Editor (Text Editor): Allows you to write rules directly using Cloudflare’s expression language. This provides maximum flexibility and is necessary for complex or highly customized rules.

Example Firewall Rules (with explanations):

1. Block a Specific IP Address:

(ip.src eq "192.0.2.1")

• Field: ip.src (Source IP address)
• Operator: eq (equals)
• Value: "192.0.2.1" (The IP address to block)
• Action: (Implicitly, the default action will apply, likely Block if no action is specified on the rule.) You should explicitly define an action. So, in the rule builder, choose Block for the action.

2. Block Requests from a Specific Country:

(ip.geoip.country eq "RU")
* Action: Block

This rule blocks all requests originating from Russia.

3. Block POST Requests to a Specific Path:

(http.request.method eq "POST" and http.request.uri.path eq "/admin/login")
* Action: Block

This rule blocks POST requests to the /admin/login path. A more realistic rule would use Challenge or JS Challenge instead of Block, to allow legitimate login attempts.

4. Challenge Requests with a High Threat Score:

(cf.threat_score gt 20)
* Action: Managed Challenge

This rule presents a challenge to requests from IP addresses with a Cloudflare threat score greater than 20.

5. Block Requests with a Suspicious User-Agent (Regex):

(http.request.headers["user-agent"] matches ".*(badbot|malicious-scraper).*")
* Action: Block

This uses a regular expression to block requests with “badbot” or “malicious-scraper” in the User-Agent header.

6. Allow a Specific IP Address to Bypass the WAF:

(ip.src eq "198.51.100.5")
* Action: Allow

This rule allows requests from the IP address 198.51.100.5 to bypass all other Firewall Rules and WAF settings. Use with extreme caution! It’s generally better to use the Skip action to bypass specific rules.

7. Skip Certain Rules for a Known Bot (e.g., Googlebot):

First, create a rule to identify Googlebot (this is a simplified example; a more robust method would use ASNs or verified bot lists):

(http.request.headers["user-agent"] contains "Googlebot")

• Action: Skip
• Skip: Select “All remaining rules” or select specific rule IDs to skip.

This rule, placed before other blocking rules, will allow Googlebot to crawl your site even if it would otherwise trigger a block.

8. Block Based on JA3 Fingerprint (Advanced Bot Detection):
(cf.bot_management.ja3_hash eq "a7d579e6c79b08651e8f091534173cb3")
* Action: Block

This rule blocks requests with a specific JA3 fingerprint hash, which can be associated with a particular bot or client application. Identifying the correct JA3 hashes requires analyzing your traffic logs.

9. Block XML-RPC Attacks (WordPress):
(http.request.uri.path eq "/xmlrpc.php")
* Action: Block (or JS Challenge if you need XML-RPC for legitimate purposes, but filter by IP or other criteria).

10. Block Common SQL Injection Attempts (Basic):
(http.request.uri.query contains "select" and http.request.uri.query contains "from")
* Action: Block

This is a very basic example and should be supplemented by Cloudflare's WAF managed rulesets. It looks for the keywords "select" and "from" in the query string.  It is *not* comprehensive SQL injection protection.

Best Practices and Tips (2023 Update):

• Start Simple, Then Refine: Don’t try to create overly complex rules initially. Start with basic rules and gradually add more complexity as needed.
• Test Thoroughly: Use the “Log” action to test your rules before deploying them with blocking actions. Analyze your logs to ensure they are working as expected and not blocking legitimate traffic.
• Use Managed Rulesets: Cloudflare’s managed rulesets (OWASP Core Ruleset, Cloudflare Specials, etc.) provide excellent baseline protection. Firewall Rules should be used to supplement these rulesets, not replace them.
• Prioritize Rules: Firewall Rules are evaluated in the order they appear in the list. Place more specific rules (e.g., allowing a specific IP) before broader rules (e.g., blocking a country).
• Regularly Review and Update: Your security needs will evolve. Regularly review your Firewall Rules to ensure they are still relevant and effective. Attack patterns change, so your rules should too.
• Use Rate Limiting: Combine Firewall Rules with Cloudflare’s Rate Limiting feature to protect against brute-force attacks and other abuse.
• Leverage Bot Management: For Pro, Business, and Enterprise plans, Cloudflare’s Bot Management features provide powerful bot detection and mitigation capabilities. Integrate Firewall Rules with Bot Management scores for enhanced protection.
• Use Page Rules Carefully with Firewall Rules: Page Rules can interact with Firewall Rules, sometimes in unexpected ways. Understand the order of operations and how these features interact. The Bypass action in Firewall Rules is crucial for managing this interaction.
• Understand the Limits: Be aware of the rule limits for your Cloudflare plan. Free plans have a limited number of active rules.
• Use Workers for Complex Logic: For very complex scenarios or custom logic, consider using Cloudflare Workers in conjunction with Firewall Rules.
• Monitor Security Events: Use the Security Events log in the Cloudflare dashboard to see which rules are being triggered and by what traffic. This helps you identify false positives and refine your rules.

Conclusion:

Cloudflare Firewall Rules are a powerful tool for securing your website. By understanding the core concepts, fields, operators, and actions, you can create custom rules to protect against a wide range of threats. This guide, updated for 2023, provides a solid foundation for mastering Firewall Rules and building a robust security posture for your web applications. Remember to always test your rules thoroughly, stay updated on the latest threats, and leverage Cloudflare’s other security features for comprehensive protection.