Skip to content

Commit 5d4e3be

Browse files
maxvpmaxvp
committed
[ZT] APIRequest in Secure Internet Traffic (#24468)
1 parent 51ccb1c commit 5d4e3be

File tree

9 files changed

+577
-650
lines changed

9 files changed

+577
-650
lines changed

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx‎

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 2
66
---
77

8-
import { Tabs, TabItem } from "~/components";
8+
import { Tabs, TabItem, APIRequest } from "~/components";
99

1010
In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications.
1111

@@ -27,22 +27,20 @@ The following DNS policy will allow access to all approved corporate domains inc
2727

2828
<TabItem label="API">
2929

30-
```sh
31-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
32-
--header 'Content-Type: application/json' \
33-
--header "Authorization: Bearer <API_TOKEN>" \
34-
--data '{
35-
"name": "All-DNS-CorporateDomain-AllowList",
36-
"description": "Allow access to the corporate domains defined under the Corporate Domains list",
37-
"precedence": 1,
38-
"enabled": true,
39-
"action": "allow",
40-
"filters": [
41-
"dns"
42-
],
43-
"traffic": "any(dns.domains[*] in $<CORPORATE_DOMAINS_LIST_UUID>)"
44-
}'
45-
```
30+
<APIRequest
31+
path="/accounts/{account_id}/gateway/rules"
32+
method="POST"
33+
json={{
34+
name: "All-DNS-CorporateDomain-AllowList",
35+
description:
36+
"Allow access to the corporate domains defined under the Corporate Domains list",
37+
precedence: 1,
38+
enabled: true,
39+
action: "allow",
40+
filters: ["dns"],
41+
traffic: "any(dns.domains[*] in $<CORPORATE_DOMAINS_LIST_UUID>)",
42+
}}
43+
/>
4644

4745
</TabItem>
4846

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 1
66
---
77

8-
import { Render, Tabs, TabItem } from "~/components";
8+
import { Render, Tabs, TabItem, APIRequest } from "~/components";
99

1010
DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP.
1111

@@ -36,26 +36,26 @@ For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/d
3636

3737
To create a new DNS policy using cURL:
3838

39-
```sh
40-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
41-
--header 'Content-Type: application/json' \
42-
--header "Authorization: Bearer <API_TOKEN>" \
43-
--data '{
44-
"name": "All-DNS-SecurityCategories-Blocklist",
45-
"description": "Block known security risks based on Cloudflare's threat intelligence",
46-
"precedence": 0,
47-
"enabled": true,
48-
"action": "block",
49-
"filters": [
50-
"dns"
51-
],
52-
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
53-
"rule_settings": {
54-
"block_page_enabled": true,
55-
"block_reason": "This domain was blocked due to being classified as a security risk to your organization"
56-
}
57-
}'
58-
```
39+
<APIRequest
40+
path="/accounts/{account_id}/gateway/rules"
41+
method="POST"
42+
json={{
43+
name: "All-DNS-SecurityCategories-Blocklist",
44+
description:
45+
"Block known security risks based on Cloudflare's threat intelligence",
46+
precedence: 0,
47+
enabled: true,
48+
action: "block",
49+
filters: ["dns"],
50+
traffic:
51+
"any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
52+
rule_settings: {
53+
block_page_enabled: true,
54+
block_reason:
55+
"This domain was blocked due to being classified as a security risk to your organization",
56+
},
57+
}}
58+
/>
5959

6060
</TabItem>
6161

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx‎

Lines changed: 102 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 3
66
---
77

8-
import { Render, Tabs, TabItem } from "~/components";
8+
import { Render, Tabs, TabItem, APIRequest } from "~/components";
99

1010
We recommend you add the following DNS policies to build an Internet and SaaS app security strategy for your organization.
1111

@@ -26,22 +26,20 @@ Allowlist any known domains and hostnames. With this policy, you ensure that you
2626

2727
<TabItem label="API">
2828

29-
```sh
30-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
31-
--header "Content-Type: application/json" \
32-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
33-
--data '{
34-
"name": "All-DNS-Domain-Allowlist",
35-
"description": "Allowlist any known domains and hostnames",
36-
"precedence": 0,
37-
"enabled": true,
38-
"action": "allow",
39-
"filters": [
40-
"dns"
41-
],
42-
"traffic": "any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>) or dns.fqdn in $<KNOWN_DOMAINS_LIST_UUID>"
43-
}'
44-
```
29+
<APIRequest
30+
path="/accounts/{account_id}/gateway/rules"
31+
method="POST"
32+
json={{
33+
name: "All-DNS-Domain-Allowlist",
34+
description: "Allowlist any known domains and hostnames",
35+
precedence: 0,
36+
enabled: true,
37+
action: "allow",
38+
filters: ["dns"],
39+
traffic:
40+
"any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>) or dns.fqdn in $<KNOWN_DOMAINS_LIST_UUID>",
41+
}}
42+
/>
4543

4644
</TabItem>
4745

@@ -81,23 +79,22 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
8179

8280
<TabItem label="API">
8381

84-
```sh
85-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
86-
--header "Content-Type: application/json" \
87-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
88-
--data '{
89-
"name": "Quarantined-Users-DNS-Restricted-Access",
90-
"description": "Restrict access for users included in an identity provider (IdP) user group for risky users",
91-
"precedence": 10,
92-
"enabled": true,
93-
"action": "block",
94-
"filters": [
95-
"dns"
96-
],
97-
"traffic": "not(any(dns.domains[*] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>)) or not(any(dns.domains[*] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>))",
98-
"identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})"
99-
}'
100-
```
82+
<APIRequest
83+
path="/accounts/{account_id}/gateway/rules"
84+
method="POST"
85+
json={{
86+
name: "Quarantined-Users-DNS-Restricted-Access",
87+
description:
88+
"Restrict access for users included in an identity provider (IdP) user group for risky users",
89+
precedence: 10,
90+
enabled: true,
91+
action: "block",
92+
filters: ["dns"],
93+
traffic:
94+
"not(any(dns.domains[] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>)) or not(any(dns.domains[] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>))",
95+
identity: 'any(identity.groups.name[*] in {"Quarantined Users"})',
96+
}}
97+
/>
10198

10299
</TabItem>
103100

@@ -166,22 +163,21 @@ Block websites hosted in countries categorized as high risk. The designation of
166163

167164
<TabItem label="API">
168165

169-
```sh
170-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
171-
--header "Content-Type: application/json" \
172-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
173-
--data '{
174-
"name": "All-DNS-GeoCountryIP-Blocklist",
175-
"description": "Block traffic hosted in countries categorized as high security risks",
176-
"precedence": 50,
177-
"enabled": true,
178-
"action": "block",
179-
"filters": [
180-
"dns"
181-
],
182-
"traffic": "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})"
183-
}'
184-
```
166+
<APIRequest
167+
path="/accounts/{account_id}/gateway/rules"
168+
method="POST"
169+
json={{
170+
name: "All-DNS-GeoCountryIP-Blocklist",
171+
description:
172+
"Block traffic hosted in countries categorized as high security risks",
173+
precedence: 50,
174+
enabled: true,
175+
action: "block",
176+
filters: ["dns"],
177+
traffic:
178+
'any(dns.dst.geo.country[*] in {"AF" "BY" "CD" "CU" "IR" "IQ" "KP" "MM" "RU" "SD" "SY" "UA" "ZW"})',
179+
}}
180+
/>
185181

186182
</TabItem>
187183

@@ -219,22 +215,19 @@ Block frequently misused top-level domains (TLDs) to reduce security risks, espe
219215

220216
<TabItem label="API">
221217

222-
```sh
223-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
224-
--header "Content-Type: application/json" \
225-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
226-
--data '{
227-
"name": "All-DNS-DomainTopLevel-Blocklist",
228-
"description": "Block DNS queries of known risky TLDs",
229-
"precedence": 60,
230-
"enabled": true,
231-
"action": "block",
232-
"filters": [
233-
"dns"
234-
],
235-
"traffic": "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")"
236-
}'
237-
```
218+
<APIRequest
219+
path="/accounts/{account_id}/gateway/rules"
220+
method="POST"
221+
json={{
222+
name: "All-DNS-DomainTopLevel-Blocklist",
223+
description: "Block DNS queries of known risky TLDs",
224+
precedence: 60,
225+
enabled: true,
226+
action: "block",
227+
filters: ["dns"],
228+
traffic: 'any(dns.domains[*] matches ".$ or .$ or .$")',
229+
}}
230+
/>
238231

239232
</TabItem>
240233

@@ -273,22 +266,20 @@ Block misused domains to protect your users against sophisticated phishing attac
273266

274267
<TabItem label="API">
275268

276-
```sh
277-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
278-
--header "Content-Type: application/json" \
279-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
280-
--data '{
281-
"name": "All-DNS-DomainPhishing-Blocklist",
282-
"description": "Block misused domains used in phishing campaigns",
283-
"precedence": 70,
284-
"enabled": true,
285-
"action": "block",
286-
"filters": [
287-
"dns"
288-
],
289-
"traffic": "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>))"
290-
}'
291-
```
269+
<APIRequest
270+
path="/accounts/{account_id}/gateway/rules"
271+
method="POST"
272+
json={{
273+
name: "All-DNS-DomainPhishing-Blocklist",
274+
description: "Block misused domains used in phishing campaigns",
275+
precedence: 70,
276+
enabled: true,
277+
action: "block",
278+
filters: ["dns"],
279+
traffic:
280+
'any(dns.domains[] matches ".okta.|.cloudflare.|.mfa.|.sso.") and not(any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>))',
281+
}}
282+
/>
292283

293284
</TabItem>
294285

@@ -328,22 +319,20 @@ Block specific IP addresses that are malicious or pose a threat to your organiza
328319

329320
<TabItem label="API">
330321

331-
```sh
332-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
333-
--header "Content-Type: application/json" \
334-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
335-
--data '{
336-
"name": "All-DNS-ResolvedIP-Blocklist",
337-
"description": "Block specific IP addresses deemed to be a risk to the Organization",
338-
"precedence": 80,
339-
"enabled": true,
340-
"action": "block",
341-
"filters": [
342-
"dns"
343-
],
344-
"traffic": "any(dns.resolved_ips[*] in $<IP_BLOCKLIST_UUID>)"
345-
}'
346-
```
322+
<APIRequest
323+
path="/accounts/{account_id}/gateway/rules"
324+
method="POST"
325+
json={{
326+
name: "All-DNS-ResolvedIP-Blocklist",
327+
description:
328+
"Block specific IP addresses deemed to be a risk to the Organization",
329+
precedence: 80,
330+
enabled: true,
331+
action: "block",
332+
filters: ["dns"],
333+
traffic: "any(dns.resolved_ips[*] in $<IP_BLOCKLIST_UUID>)",
334+
}}
335+
/>
347336

348337
</TabItem>
349338

@@ -386,22 +375,21 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule"
386375

387376
<TabItem label="API">
388377

389-
```sh
390-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
391-
--header "Content-Type: application/json" \
392-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN>" \
393-
--data '{
394-
"name": "All-DNS-DomainHost-Blocklist",
395-
"description": "Block specific domains or hosts that are malicious or pose a threat to your organization.",
396-
"precedence": 90,
397-
"enabled": true,
398-
"action": "block",
399-
"filters": [
400-
"dns"
401-
],
402-
"traffic": "any(dns.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) and dns.fqdn in $<HOST_BLOCKLIST_UUID> and dns.fqdn matches \".*example\\.com\""
403-
}'
404-
```
378+
<APIRequest
379+
path="/accounts/{account_id}/gateway/rules"
380+
method="POST"
381+
json={{
382+
name: "All-DNS-DomainHost-Blocklist",
383+
description:
384+
"Block specific domains or hosts that are malicious or pose a threat to your organization.",
385+
precedence: 90,
386+
enabled: true,
387+
action: "block",
388+
filters: ["dns"],
389+
traffic:
390+
'any(dns.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) and dns.fqdn in $<HOST_BLOCKLIST_UUID> and dns.fqdn matches ".*example\.com"',
391+
}}
392+
/>
405393

406394
</TabItem>
407395

0 commit comments

Comments
 (0)