Skip to content

Commit 6cb16df

Browse files
tcerqueira-cfmaxvp
tcerqueira-cf
and
maxvp
authored
Adding DNS API calls to secure-internet-traffic learning path (#18388)
Co-authored-by: Max Phillips <[email protected]>
1 parent 61cf89e commit 6cb16df

File tree

24 files changed

+881
-360
lines changed

24 files changed

+881
-360
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx‎

Lines changed: 9 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -54,101 +54,28 @@ To get the UUIDs of your lists, use the [List Zero Trust lists](/api/resources/z
5454

5555
Block [security categories](/cloudflare-one/policies/gateway/domain-categories/#security-categories) such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence.
5656

57-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
58-
5957
<Render
60-
file="gateway/policies/block-security-categories"
58+
file="gateway/policies/dash-plus-api/dns/block-security-categories"
6159
product="cloudflare-one"
6260
/>
6361

64-
</TabItem>
65-
66-
<TabItem label="API">
67-
68-
```bash
69-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
70-
--header "Content-Type: application/json" \
71-
--header "Authorization: Bearer <API_TOKEN>" \
72-
--data '{
73-
"name": "Block security threats",
74-
"description": "Block all default Cloudflare DNS security categories",
75-
"enabled": true,
76-
"action": "block",
77-
"filters": [
78-
"dns"
79-
],
80-
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
81-
"identity": ""
82-
}'
83-
```
84-
85-
</TabItem> </Tabs>
86-
8762
## Block content categories
8863

8964
The categories included in this policy are not always a security threat, but blocking them can help minimize the risk that your organization is exposed to. For more information, refer to [domain categories](/cloudflare-one/policies/gateway/domain-categories/).
9065

91-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
92-
93-
| Selector | Operator | Value | Action |
94-
| ------------------ | -------- | --------------------------------------------------------- | ------ |
95-
| Content Categories | in | _Questionable Content_, _Security Risks_, _Miscellaneous_ | Block |
96-
97-
</TabItem>
98-
99-
<TabItem label="API">
100-
101-
```bash
102-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
103-
--header "Content-Type: application/json" \
104-
--header "Authorization: Bearer <API_TOKEN>" \
105-
--data '{
106-
"name": "Block content categories",
107-
"description": "Block common content categories that may pose a risk",
108-
"enabled": true,
109-
"action": "block",
110-
"filters": [
111-
"dns"
112-
],
113-
"traffic": "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})",
114-
"identity": ""
115-
}'
116-
```
117-
118-
</TabItem> </Tabs>
66+
<Render
67+
file="gateway/policies/dash-plus-api/dns/block-content-categories"
68+
product="cloudflare-one"
69+
/>
11970

12071
## Block unauthorized applications
12172

12273
<Render file="gateway/policies/block-applications" product="cloudflare-one" />
12374

124-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
125-
126-
| Selector | Operator | Value | Action |
127-
| ----------- | -------- | ------------------------- | ------ |
128-
| Application | in | _Artificial Intelligence_ | Block |
129-
130-
</TabItem>
131-
132-
<TabItem label="API">
133-
134-
```bash
135-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
136-
--header "Content-Type: application/json" \
137-
--header "Authorization: Bearer <API_TOKEN>" \
138-
--data '{
139-
"name": "Block unauthorized applications",
140-
"description": "Block access to unauthorized AI applications",
141-
"enabled": true,
142-
"action": "block",
143-
"filters": [
144-
"dns"
145-
],
146-
"traffic": "any(app.type.ids[*] in {25})",
147-
"identity": ""
148-
}'
149-
```
150-
151-
</TabItem> </Tabs>
75+
<Render
76+
file="gateway/policies/dash-plus-api/dns/block-applications"
77+
product="cloudflare-one"
78+
/>
15279

15380
## Block banned countries
15481

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx‎

Lines changed: 8 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -92,69 +92,19 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
9292

9393
Block content categories which go against your organization's acceptable use policy.
9494

95-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
96-
97-
| Selector | Operator | Value | Action |
98-
| ------------------ | -------- | -------------------------- | ------ |
99-
| Content Categories | in | _Adult Themes_, _Gambling_ | Block |
100-
101-
</TabItem>
102-
103-
<TabItem label="API">
104-
105-
```bash
106-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
107-
--header "Content-Type: application/json" \
108-
--header "Authorization: Bearer <API_TOKEN>" \
109-
--data '{
110-
"name": "Block content categories",
111-
"description": "Block access to unauthorized adult and gambling applications",
112-
"enabled": true,
113-
"action": "block",
114-
"filters": [
115-
"http"
116-
],
117-
"traffic": "any(http.request.uri.content_category[*] in {2 67 125 133 99})",
118-
"identity": "",
119-
"device_posture": ""
120-
}'
121-
```
122-
123-
</TabItem> </Tabs>
95+
<Render
96+
file="gateway/policies/dash-plus-api/http/block-content-categories"
97+
product="cloudflare-one"
98+
/>
12499

125100
## Block unauthorized applications
126101

127102
<Render file="gateway/policies/block-applications" product="cloudflare-one" />
128103

129-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
130-
131-
| Selector | Operator | Value | Action |
132-
| ----------- | -------- | ------------------------- | ------ |
133-
| Application | in | _Artificial Intelligence_ | Block |
134-
135-
</TabItem>
136-
137-
<TabItem label="API">
138-
139-
```bash
140-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
141-
--header "Content-Type: application/json" \
142-
--header "Authorization: Bearer <API_TOKEN>" \
143-
--data '{
144-
"name": "Block unauthorized applications",
145-
"description": "Block access to unauthorized AI applications",
146-
"enabled": true,
147-
"action": "block",
148-
"filters": [
149-
"http"
150-
],
151-
"traffic": "any(app.type.ids[*] in {25})",
152-
"identity": "",
153-
"device_posture": ""
154-
}'
155-
```
156-
157-
</TabItem> </Tabs>
104+
<Render
105+
file="gateway/policies/dash-plus-api/http/block-applications"
106+
product="cloudflare-one"
107+
/>
158108

159109
## Check user identity
160110

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ The Allow action allows outbound traffic to reach destinations you specify withi
8585

8686
| Selector | Operator | Value | Action |
8787
| ------------------ | -------- | ----------- | ------ |
88-
| Content Categories | in | `Education` | Allow |
88+
| Content Categories | in | _Education_ | Allow |
8989

9090
#### Untrusted certificates
9191

‎src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx‎

Lines changed: 4 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -87,35 +87,10 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
8787

8888
Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the [device posture section](/cloudflare-one/identity/devices/). For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
8989

90-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
91-
92-
<Render file="gateway/policies/enforce-device-posture" />
93-
94-
</TabItem>
95-
96-
<TabItem label="API">
97-
98-
```bash
99-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
100-
--header "Content-Type: application/json" \
101-
--header "Authorization: Bearer <API_TOKEN>" \
102-
--data '{
103-
"name": "Enforce device posture",
104-
"description": "Limit access to an internal application to approved organization devices",
105-
"enabled": true,
106-
"action": "block",
107-
"filters": [
108-
"l4"
109-
],
110-
"traffic": "any(net.sni.domains[*] == \"example.com\")",
111-
"identity": "",
112-
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<POSTURE_CHECK_UUID>\"}))"
113-
}'
114-
```
115-
116-
To get the UUIDs of your device posture checks, use the [List device posture rules](/api/resources/zero_trust/subresources/devices/subresources/posture/methods/list/) endpoint.
117-
118-
</TabItem> </Tabs>
90+
<Render
91+
file="gateway/policies/dash-plus-api/network/enforce-device-posture"
92+
product="cloudflare-one"
93+
/>
11994

12095
## Enforce session duration
12196

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,66 @@ title: Create an allowlist or blocklist
33
pcx_content_type: learning-unit
44
sidebar:
55
order: 2
6-
76
---
87

8+
import { Tabs, TabItem } from "~/components";
9+
910
In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications.
1011

1112
Gateway supports creating [lists](/cloudflare-one/policies/gateway/lists/) of URLs, hostnames, or other entries to use in your policies.
1213

1314
## Example list policy
1415

16+
<Tabs syncKey="dashPlusAPI">
17+
18+
<TabItem label="Dashboard">
19+
1520
The following DNS policy will allow access to all approved corporate domains included in a list called **Corporate Domains**.
1621

1722
| Selector | Operator | Value | Action |
1823
| -------- | -------- | ------------------- | ------ |
19-
| Domain | in list | *Corporate Domains* | Allow |
24+
| Domain | in list | _Corporate Domains_ | Allow |
25+
26+
</TabItem>
27+
28+
<TabItem label="API">
29+
30+
```sh
31+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
32+
--header 'Content-Type: application/json' \
33+
--header "Authorization: Bearer <API_TOKEN>" \
34+
--data '{
35+
"name": "All-DNS-CorporateDomain-AllowList",
36+
"description": "Allow access to the corporate domains defined under the Corporate Domains list",
37+
"precedence": 1,
38+
"enabled": true,
39+
"action": "allow",
40+
"filters": [
41+
"dns"
42+
],
43+
"traffic": "any(dns.domains[*] in $<CORPORATE_DOMAINS_LIST_UUID>)"
44+
}'
45+
```
46+
47+
</TabItem>
48+
49+
<TabItem label="Terraform">
50+
51+
To create a new DNS policy using **Terraform** to allow access to all approved corporate domains included in a list called **Corporate Domains**.
52+
53+
```tf
54+
resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" {
55+
account_id = var.account_id
56+
name = "All-DNS-CorporateDomain-AllowList"
57+
description = "Allow access to the corporate domains defined under the Corporate Domains list"
58+
precedence = 1
59+
enabled = false
60+
action = "allow"
61+
filters = ["dns"]
62+
traffic = "any(dns.domains[*] in $<Corporate Domains List UUID>)"
63+
}
64+
```
65+
66+
</TabItem>
67+
68+
</Tabs>

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx‎

Lines changed: 73 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,81 @@ sidebar:
55
order: 1
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, Tabs, TabItem } from "~/components";
99

1010
DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP.
1111

1212
You can filter DNS traffic based on query or response parameters (such as domain, source IP, or geolocation). You can also filter by user identity if you connect your devices to Gateway with the [WARP client or Cloudflare One Agent](/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent/).
1313

14-
<Render file="gateway/get-started/create-dns-policy" product="cloudflare-one" />
14+
To create a new DNS policy:
15+
16+
<Tabs syncKey="dashPlusAPI">
17+
18+
<TabItem label="Dashboard">
19+
20+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
21+
2. In the **DNS** tab, select **Add a policy**.
22+
3. Name the policy.
23+
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block.
24+
5. Choose an **Action** to take when traffic matches the logical expression. For example, we recommend adding a policy to block all [security categories](/cloudflare-one/policies/gateway/domain-categories/#security-categories):
25+
<Render
26+
file="gateway/policies/block-security-categories"
27+
product="cloudflare-one"
28+
/>
29+
6. Select **Create policy**.
30+
31+
For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/).
32+
33+
</TabItem>
34+
35+
<TabItem label="API">
36+
37+
To create a new DNS policy using cURL:
38+
39+
```sh
40+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
41+
--header 'Content-Type: application/json' \
42+
--header "Authorization: Bearer <API_TOKEN>" \
43+
--data '{
44+
"name": "All-DNS-SecurityCategories-Blocklist",
45+
"description": "Block known security risks based on Cloudflare's threat intelligence",
46+
"precedence": 0,
47+
"enabled": true,
48+
"action": "block",
49+
"filters": [
50+
"dns"
51+
],
52+
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
53+
"rule_settings": {
54+
"block_page_enabled": true,
55+
"block_reason": "This domain was blocked due to being classified as a security risk to your organization"
56+
}
57+
}'
58+
```
59+
60+
</TabItem>
61+
62+
<TabItem label="Terraform">
63+
64+
To create a new DNS policy using **Terraform**:
65+
66+
```tf
67+
resource "cloudflare_zero_trust_gateway_policy" "security_risks_dns_policy" {
68+
account_id = var.account_id
69+
name = "All-DNS-SecurityCategories-Blocklist"
70+
description = "Block known security risks based on Cloudflare's threat intelligence"
71+
precedence = 0
72+
enabled = true
73+
action = "block"
74+
filters = ["dns"]
75+
traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
76+
rule_settings {
77+
block_page_enabled = true
78+
block_page_reason = "This domain was blocked due to being classified as a security risk to your organization"
79+
}
80+
}
81+
```
82+
83+
</TabItem>
84+
85+
</Tabs>

0 commit comments

Comments
 (0)