Skip to content

Commit 95be41f

Browse files
committed
Fix formatting
1 parent 7f40cc7 commit 95be41f

File tree

3 files changed

+55
-37
lines changed

3 files changed

+55
-37
lines changed

src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ title: Create an allowlist or blocklist
33
pcx_content_type: learning-unit
44
sidebar:
55
order: 2
6-
76
---
87

9-
import { Tabs, TabItem } from "~/components"
8+
import { Tabs, TabItem } from "~/components";
109

1110
In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications.
1211

@@ -15,35 +14,42 @@ Gateway supports creating [lists](/cloudflare-one/policies/gateway/lists/) of UR
1514
## Example list policy
1615

1716
<Tabs syncKey="dashPlusAPI">
17+
1818
<TabItem label="Dashboard">
19+
1920
The following DNS policy will allow access to all approved corporate domains included in a list called **Corporate Domains**.
2021

2122
| Selector | Operator | Value | Action |
2223
| -------- | -------- | ------------------- | ------ |
23-
| Domain | in list | *Corporate Domains* | Allow |
24+
| Domain | in list | _Corporate Domains_ | Allow |
25+
2426
</TabItem>
27+
2528
<TabItem label="API">
26-
```sh
27-
curl --request POST \
28-
--URL https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
29+
30+
```sh
31+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
2932
--header 'Content-Type: application/JSON' \
30-
--header "Authorization: Bearer <API TOKEN>" \
33+
--header "Authorization: Bearer <API_TOKEN>" \
3134
--data '{
3235
"name": "All-DNS-CorporateDomain-AllowList",
3336
"description": "Allow access to the corporate domains defined under the Corporate Domains list",
3437
"precedence": 1,
35-
"enabled": false,
38+
"enabled": true,
3639
"action": "allow",
3740
"filters": [
3841
"dns"
3942
],
40-
"traffic": "any(dns.domains[*] in $<Corporate Domains List UUID>)"
43+
"traffic": "any(dns.domains[*] in $<CORPORATE_DOMAINS_LIST_UUID>)"
4144
}'
45+
```
4246

43-
```
4447
</TabItem>
48+
4549
<TabItem label="Terraform">
50+
4651
To create a new DNS policy using **Terraform** to allow access to all approved corporate domains included in a list called **Corporate Domains**.
52+
4753
```tf
4854
resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" {
4955
account_id = var.account_id
@@ -56,5 +62,7 @@ resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access"
5662
traffic = "any(dns.domains[*] in $<Corporate Domains List UUID>)"
5763
}
5864
```
65+
5966
</TabItem>
60-
</Tabs>
67+
68+
</Tabs>

src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx

Lines changed: 35 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 1
66
---
77

8-
import { Tabs, TabItem, Render } from "~/components"
8+
import { Render, Tabs, TabItem } from "~/components";
99

1010
DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP.
1111

@@ -14,7 +14,9 @@ You can filter DNS traffic based on query or response parameters (such as domain
1414
To create a new DNS policy:
1515

1616
<Tabs syncKey="dashPlusAPI">
17+
1718
<TabItem label="Dashboard">
19+
1820
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
1921
2. In the **DNS** tab, select **Add a policy**.
2022
3. Name the policy.
@@ -27,48 +29,57 @@ To create a new DNS policy:
2729
6. Select **Create policy**.
2830

2931
For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/).
32+
3033
</TabItem>
34+
3135
<TabItem label="API">
32-
To create a new DNS policy using **cURL**:
33-
```sh
34-
curl --request POST \
35-
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
36-
--header 'Content-Type: application/JSON' \
37-
--header "Authorization: Bearer <API_TOKEN>" \
38-
--data '{
36+
37+
To create a new DNS policy using cURL:
38+
39+
```sh
40+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
41+
--header 'Content-Type: application/JSON' \
42+
--header "Authorization: Bearer <API_TOKEN>" \
43+
--data '{
3944
"name": "All-DNS-SecurityCategories-Blocklist",
40-
"description": "Block known security risks based on Cloudflare's threat intelligence",
41-
"precedence": 0,
42-
"enabled": false,
43-
"action": "block",
44-
"filters": [
45-
"dns"
46-
],
47-
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
48-
"rule_settings": {
49-
"block_page_enabled": true,
50-
"block_reason": "This domain was blocked due to being classified as a security risk to the organisation"
51-
}
52-
}'
53-
```
45+
"description": "Block known security risks based on Cloudflare's threat intelligence",
46+
"precedence": 0,
47+
"enabled": true,
48+
"action": "block",
49+
"filters": [
50+
"dns"
51+
],
52+
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
53+
"rule_settings": {
54+
"block_page_enabled": true,
55+
"block_reason": "This domain was blocked due to being classified as a security risk to your organization"
56+
}
57+
}'
58+
```
59+
5460
</TabItem>
61+
5562
<TabItem label="Terraform">
63+
5664
To create a new DNS policy using **Terraform**:
65+
5766
```tf
5867
resource "cloudflare_zero_trust_gateway_policy" "security_risks_dns_policy" {
5968
account_id = var.account_id
6069
name = "All-DNS-SecurityCategories-Blocklist"
6170
description = "Block known security risks based on Cloudflare's threat intelligence"
6271
precedence = 0
63-
enabled = false
72+
enabled = true
6473
action = "block"
6574
filters = ["dns"]
6675
traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
6776
rule_settings {
6877
block_page_enabled = true
69-
block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation"
78+
block_page_reason = "This domain was blocked due to being classified as a security risk to your organization"
7079
}
7180
}
7281
```
82+
7383
</TabItem>
84+
7485
</Tabs>

src/content/partials/cloudflare-one/gateway/lists.mdx

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,8 @@ You can now use this list in the policy builder by choosing the _in list_ operat
3838

3939
```bash
4040
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/lists \
41-
--header "X-Auth-Email: <EMAIL>" \
42-
--header "X-Auth-Key: <API_KEY>" \
4341
--header "Content-Type: application/json" \
42+
--header "Authorization: Bearer <API_TOKEN>" \
4443
--data '{
4544
"description": "Private application IPs",
4645
"items": [{"value": "10.226.0.177/32"},{"value": "10.226.1.177/32"}],

0 commit comments

Comments
 (0)