Skip to content

Commit 3192b2f

Browse files
maxvpmaxvp
committed
Adjust formatting
1 parent 237b683 commit 3192b2f

File tree

1 file changed

+83
-35
lines changed

1 file changed

+83
-35
lines changed

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx‎

Lines changed: 83 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,29 @@ title: Recommended DNS policies
33
pcx_content_type: learning-unit
44
sidebar:
55
order: 3
6-
76
---
87

9-
import { Details, Render, Tabs, TabItem } from "~/components"
8+
import { Details, Render, Tabs, TabItem } from "~/components";
109

1110
We recommend you add the following DNS policies to build an Internet and SaaS app security strategy for your organization.
1211

13-
1412
<Details header="All-DNS-Domain-Allowlist">
15-
<Tabs syncKey="dashPlusAPI">
13+
1614
Allowlist any known domains and hostnames. With this policy, you ensure that your users can access your organization's domains even if the domains fall under a blocked category, such as **Newly Seen Domains** or **Login Screens**.
15+
16+
<Tabs syncKey="dashPlusAPI">
17+
1718
<TabItem label="Dashboard">
19+
1820
| Selector | Operator | Value | Logic | Action |
1921
| -------- | -------- | --------------- | ----- | ------ |
20-
| Domain | in list | *Known Domains* | Or | Allow |
21-
| Host | in list | *Known Domains* | | |
22+
| Domain | in list | _Known Domains_ | Or | Allow |
23+
| Host | in list | _Known Domains_ | | |
24+
2225
</TabItem>
26+
2327
<TabItem label="API">
28+
2429
```sh
2530
curl --request POST \
2631
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
@@ -38,8 +43,11 @@ curl --request POST \
3843
"traffic": "any(dns.domains[*] in $<Global Whitelist UUID>) or dns.fqdn in $<Global Whitelist UUID>"
3944
}'
4045
```
46+
4147
</TabItem>
48+
4249
<TabItem label="Terraform">
50+
4351
```tf
4452
resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
4553
account_id = var.account_id
@@ -52,23 +60,29 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
5260
traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}) or dns.fqdn in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}"
5361
}
5462
```
63+
5564
</TabItem>
5665
</Tabs>
5766
</Details>
5867

59-
6068
<Details header="Quarantined-Users-DNS-Restricted-Access">
6169

6270
<Render file="zero-trust/blocklist-restricted-users" />
71+
6372
<Tabs syncKey="dashPlusAPI">
73+
6474
<TabItem label="Dashboard">
65-
| Selector | Operator | Value | Logic | Action |
66-
| ---------------- | ------------ | --------------------------------- | ----- | ------ |
67-
| Domain | not in list | *Allowed Remediation Domains* | Or | Block |
68-
| Host | not in list | *Allowed Remediation Domains* | And | |
69-
| User Group Names | in | *Quarantined Users* | | |
75+
76+
| Selector | Operator | Value | Logic | Action |
77+
| ---------------- | ----------- | ----------------------------- | ----- | ------ |
78+
| Domain | not in list | _Allowed Remediation Domains_ | Or | Block |
79+
| Host | not in list | _Allowed Remediation Domains_ | And | |
80+
| User Group Names | in | _Quarantined Users_ | | |
81+
7082
</TabItem>
83+
7184
<TabItem label="API">
85+
7286
```sh
7387
curl --request POST \
7488
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
@@ -92,8 +106,11 @@ curl --request POST \
92106
}
93107
}'
94108
```
109+
95110
</TabItem>
111+
96112
<TabItem label="Terraform">
113+
97114
```tf
98115
resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" {
99116
account_id = var.account_id
@@ -113,47 +130,53 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users"
113130
}
114131
}
115132
```
133+
116134
</TabItem>
117135
</Tabs>
118-
119136
</Details>
120137

121-
122138
<Details header="All-DNS-SecurityCategories-Blocklist">
123139

124140
<Render file="zero-trust/blocklist-security-categories" />
125141

126-
<Render file="gateway/policies/block-security-categories" product="cloudflare-one" />
127-
142+
<Render
143+
file="gateway/policies/block-security-categories"
144+
product="cloudflare-one"
145+
/>
128146

129147
</Details>
130148

131-
132149
<Details header="All-DNS-ContentCategories-Blocklist">
133150

134-
<Render file="zero-trust/blocklist-content-categories" params={{ one: "DNS", two: "Security Risks" }} />
135-
151+
<Render
152+
file="zero-trust/blocklist-content-categories"
153+
params={{ one: "DNS", two: "Security Risks" }}
154+
/>
136155

137156
</Details>
138157

139-
140158
<Details header="All-DNS-Application-Blocklist">
141159

142160
<Render file="zero-trust/blocklist-application" />
143161

144-
145162
</Details>
146163

147-
148164
<Details header="All-DNS-GeoCountryIP-Blocklist">
165+
149166
Block websites hosted in countries categorized as high risk. The designation of such countries may result from your organization's users or through the implementation of regulations including [EAR](https://www.tradecompliance.pitt.edu/embargoed-and-sanctioned-countries), [OFAC](https://orpa.princeton.edu/export-controls/sanctioned-countries), and [ITAR](https://www.tradecompliance.pitt.edu/embargoed-and-sanctioned-countries).
167+
150168
<Tabs syncKey="dashPlusAPI">
169+
151170
<TabItem label="Dashboard">
171+
152172
| Selector | Operator | Value | Action |
153173
| ------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
154-
| Resolved Country IP Geolocation | in | *Afghanistan*, *Belarus*, *Congo (Kinshasa)*, *Cuba*, *Iran*, *Iraq*, *Korea (North)*, *Myanmar*, *Russian Federation*, *Sudan*, *Syria*, *Ukraine*, *Zimbabwe* | Block |
174+
| Resolved Country IP Geolocation | in | _Afghanistan_, _Belarus_, _Congo (Kinshasa)_, _Cuba_, _Iran_, _Iraq_, _Korea (North)_, _Myanmar_, _Russian Federation_, _Sudan_, _Syria_, _Ukraine_, _Zimbabwe_ | Block |
175+
155176
</TabItem>
177+
156178
<TabItem label="API">
179+
157180
```sh
158181
curl --request POST \
159182
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
@@ -175,8 +198,11 @@ curl --request POST \
175198
}
176199
}'
177200
```
201+
178202
</TabItem>
203+
179204
<TabItem label="Terraform">
205+
180206
```tf
181207
resource "cloudflare_zero_trust_gateway_policy" "dns_geolocation_block_policy" {
182208
account_id = var.account_id
@@ -193,21 +219,27 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_geolocation_block_policy" {
193219
}
194220
}
195221
```
222+
196223
</TabItem>
197224
</Tabs>
198-
199225
</Details>
200226

201-
202227
<Details header="All-DNS-DomainTopLevel-Blocklist">
228+
203229
Block frequently misused top-level domains (TLDs) to reduce security risks, especially when there is no discernible advantage to be gained from allowing access. Similarly, restricting access to specific country-level TLDs may be necessary to comply with regulations such as [OFAC](https://orpa.princeton.edu/export-controls/sanctioned-countries) and [ITAR](https://www.tradecompliance.pitt.edu/embargoed-and-sanctioned-countries).
230+
204231
<Tabs syncKey="dashPlusAPI">
232+
205233
<TabItem label="Dashboard">
234+
206235
| Selector | Operator | Value | Action |
207236
| -------- | ------------- | -------------------------------------------------------------------------------------------------------- | ------ |
208237
| Domain | matches regex | `[.](cn\|ru)$ or [.](rest\|hair\|top\|live\|cfd\|boats\|beauty\|mom\|skin\|okinawa)$ or [.](zip\|mobi)$` | Block |
238+
209239
</TabItem>
240+
210241
<TabItem label="API">
242+
211243
```sh
212244
curl --request POST \
213245
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
@@ -229,8 +261,11 @@ curl --request POST \
229261
}
230262
}'
231263
```
264+
232265
</TabItem>
266+
233267
<TabItem label="Terraform">
268+
234269
```tf
235270
resource "cloudflare_zero_trust_gateway_policy" "dns_blacklist_policy" {
236271
account_id = var.account_id
@@ -247,23 +282,28 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_blacklist_policy" {
247282
}
248283
}
249284
```
285+
250286
</TabItem>
251287
</Tabs>
252-
253288
</Details>
254289

255-
256290
<Details header="All-DNS-DomainPhishing-Blocklist">
257291

258292
Block misused domains to protect your users against sophisticated phishing attacks, such as domains that specifically target your organization. For example, the following policy blocks specific keywords associated with an organization or its authentication services (such as `okta`, `2fa`, `cloudflare` and `sso`) while still allowing access to known domains.
293+
259294
<Tabs syncKey="dashPlusAPI">
295+
260296
<TabItem label="Dashboard">
297+
261298
| Selector | Operator | Value | Logic | Action |
262299
| -------- | ------------- | ------------------------------------------- | ----- | ------ |
263-
| Domain | not in list | *Known Domains* | And | Block |
300+
| Domain | not in list | _Known Domains_ | And | Block |
264301
| Domain | matches regex | `.*okta.*\|.*cloudflare.*\|.*mfa.*\|.sso.*` | | |
302+
265303
</TabItem>
304+
266305
<TabItem label="API">
306+
267307
```sh
268308
curl --request POST \
269309
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
@@ -286,8 +326,11 @@ curl --request POST \
286326
287327
}'
288328
```
329+
289330
</TabItem>
331+
290332
<TabItem label="Terraform">
333+
291334
```tf
292335
resource "cloudflare_zero_trust_gateway_policy" "dns_phishing_domains_block" {
293336
account_id = var.account_id
@@ -304,25 +347,29 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_phishing_domains_block" {
304347
}
305348
}
306349
```
350+
307351
</TabItem>
308352
</Tabs>
309-
310353
</Details>
311354

312-
313355
<Details header="All-DNS-ResolvedIP-Blocklist">
314356

315357
Block specific IP addresses that are malicious or pose a threat to your organization.
316358

317359
<Render file="zero-trust/threat-intelligence-automation" />
318360

319361
<Tabs syncKey="dashPlusAPI">
362+
320363
<TabItem label="Dashboard">
364+
321365
| Selector | Operator | Value | Action |
322366
| ----------- | -------- | -------------- | ------ |
323-
| Resolved IP | in list | *IP Blocklist* | Block |
367+
| Resolved IP | in list | _IP Blocklist_ | Block |
368+
324369
</TabItem>
370+
325371
<TabItem label="API">
372+
326373
```sh
327374
curl --request POST \
328375
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
@@ -344,8 +391,11 @@ curl --request POST \
344391
}
345392
}'
346393
```
394+
347395
</TabItem>
396+
348397
<TabItem label="Terraform">
398+
349399
```tf
350400
resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" {
351401
account_id = var.account_id
@@ -362,15 +412,13 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule"
362412
}
363413
}
364414
```
415+
365416
</TabItem>
366417
</Tabs>
367-
368418
</Details>
369419

370-
371420
<Details header="All-DNS-DomainHost-Blocklist">
372421

373422
<Render file="zero-trust/blocklist-domain-host" params={{ one: "DNS" }} />
374423

375-
376-
</Details>
424+
</Details>

0 commit comments

Comments
 (0)