Skip to content

Commit a5cec59

Browse files
maxvppedrosousahyperlint-ai[bot]
authored
[Gateway] Per-account certs (#16467)
Co-authored-by: Pedro Sousa <[email protected]> Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com>
1 parent 7afac1c commit a5cec59

File tree

18 files changed

+425
-347
lines changed

18 files changed

+425
-347
lines changed

‎public/_redirects‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1657,6 +1657,7 @@
16571657
/cloudflare-one/identity/service-auth/service-tokens/ /cloudflare-one/identity/service-tokens/ 301
16581658
/cloudflare-one/identity/users/short-lived-certificates/ /cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/ 301
16591659
/cloudflare-one/identity/users/validating-json/ /cloudflare-one/identity/authorization-cookie/validating-json/ 301
1660+
/cloudflare-one/policies/gateway/configuring-block-page/ /cloudflare-one/policies/gateway/block-page/ 301
16601661
/cloudflare-one/policies/lists/ /cloudflare-one/policies/gateway/lists 301
16611662
/cloudflare-one/policies/gateway/dns-policies/scheduled-dns-policies/ /cloudflare-one/policies/gateway/timed-policies/#scheduled-policies 301
16621663
/cloudflare-one/policies/zero-trust/ /cloudflare-one/policies/access/ 301

‎src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https.mdx‎

Lines changed: 72 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ pcx_content_type: how-to
33
title: DNS over HTTPS (DoH)
44
sidebar:
55
order: 3
6-
76
---
87

9-
import { Details, GlossaryTooltip, Render } from "~/components"
8+
import { Details, GlossaryTooltip, Render } from "~/components";
109

1110
With Cloudflare Gateway, you can filter DNS over HTTPS (DoH) requests by [DNS location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) or by user without needing to install the WARP client on your devices.
1211

@@ -34,7 +33,6 @@ Your DNS queries will now be sent to Gateway for filtering. To filter these requ
3433

3534
### Configure operating system for DoH
3635

37-
3836
<Details header="Windows 11">
3937

4038
1. Obtain the `A` and `AAAA` record values associated with your location's DoH endpoint.
@@ -71,20 +69,18 @@ Your DNS queries will now be sent to Gateway for filtering. To filter these requ
7169

7270
4. Under **DNS server assignment**, select **Edit**.
7371

74-
5. In the drop-down menu, choose *Manual*.
72+
5. In the drop-down menu, choose _Manual_.
7573

7674
6. Enable **IPv4**.
7775

78-
7. In **Preferred DNS** and **Alternate DNS**, enter the IPv4 addresses from your `A` record command. Set **DNS over HTTPS** to *On (automatic template)*.
76+
7. In **Preferred DNS** and **Alternate DNS**, enter the IPv4 addresses from your `A` record command. Set **DNS over HTTPS** to _On (automatic template)_.
7977

8078
8. Enable **IPv6**.
8179

82-
9. In **Preferred DNS** and **Alternate DNS**, enter the IPv6 addresses from your `AAAA` record command. Set **DNS over HTTPS** to *On (automatic template)*.
83-
80+
9. In **Preferred DNS** and **Alternate DNS**, enter the IPv6 addresses from your `AAAA` record command. Set **DNS over HTTPS** to _On (automatic template)_.
8481

8582
</Details>
8683

87-
8884
<Details header="Windows Server 2022">
8985

9086
Obtain the `A` and `AAAA` record values associated with your location's DoH endpoint.
@@ -107,7 +103,6 @@ nslookup -type=AAAA <your-subdomain>.cloudflare-gateway.com
107103

108104
For more information, refer to [Microsoft's DoH guide](https://learn.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) for Windows Server 2022 and newer.
109105

110-
111106
</Details>
112107

113108
## Filter DoH requests by user
@@ -128,27 +123,25 @@ curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/service_
128123

129124
Save the service token's `client_id`, `client_secret`, and `id`.
130125

131-
132126
<Details header="Example response">
133127

134128
```json null {3,4,7}
135129
{
136-
"result": {
137-
"client_id": "88bf3b6d86161464f6509f7219099e57.access",
138-
"client_secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5",
139-
"created_at": "2022-06-09T01:59:17Z",
140-
"expires_at": "2023-06-09T01:59:17Z",
141-
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
142-
"name": "ACME Corporation service token",
143-
"updated_at": "2022-06-09T01:59:17Z"
144-
},
145-
"success": true,
146-
"errors": [],
147-
"messages": []
130+
"result": {
131+
"client_id": "88bf3b6d86161464f6509f7219099e57.access",
132+
"client_secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5",
133+
"created_at": "2022-06-09T01:59:17Z",
134+
"expires_at": "2023-06-09T01:59:17Z",
135+
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
136+
"name": "ACME Corporation service token",
137+
"updated_at": "2022-06-09T01:59:17Z"
138+
},
139+
"success": true,
140+
"errors": [],
141+
"messages": []
148142
}
149143
```
150144

151-
152145
</Details>
153146

154147
### 2. Enable DoH functionality for the service token
@@ -162,27 +155,25 @@ curl --request PUT \
162155

163156
If you get an `access.api.error.service_token_not_found` error, check that `{service_token_id}` is the value of `id` and not `client_id`.
164157

165-
166158
<Details header="Example response">
167159

168160
```json
169161
{
170-
"result": {
171-
"client_id": "88bf3b6d86161464f6509f7219099e57.access",
172-
"created_at": "2022-06-09T01:59:17Z",
173-
"expires_at": "2023-06-09T01:59:17Z",
174-
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
175-
"name": "ACME Corporation service token",
176-
"updated_at": "2022-06-09T01:59:17Z",
177-
"duration": "8760h"
178-
},
179-
"success": true,
180-
"errors": [],
181-
"messages": []
162+
"result": {
163+
"client_id": "88bf3b6d86161464f6509f7219099e57.access",
164+
"created_at": "2022-06-09T01:59:17Z",
165+
"expires_at": "2023-06-09T01:59:17Z",
166+
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
167+
"name": "ACME Corporation service token",
168+
"updated_at": "2022-06-09T01:59:17Z",
169+
"duration": "8760h"
170+
},
171+
"success": true,
172+
"errors": [],
173+
"messages": []
182174
}
183175
```
184176

185-
186177
</Details>
187178

188179
### 3. Create a user
@@ -203,43 +194,39 @@ curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/users" \
203194

204195
Save the user's `id` returned in the response.
205196

206-
207197
<Details header="Example response">
208198

209199
```json null {3}
210200
{
211-
"result": {
212-
"id": "54d425de-7a78-4186-9975-d43c88ee7899",
213-
"created_at": "2022-03-16T21:18:39.93598Z",
214-
"updated_at": "2022-05-17T23:50:39.598345Z",
215-
"uid": "54d425de-7a78-4186-9975-d43c88ee7899",
216-
"name": "John Doe",
217-
"email": "[email protected]",
218-
"custom": {
219-
"groups": [
220-
{
221-
"email": "[email protected]",
222-
"id": "02fk6b3p3majl10",
223-
"name": "Finance"
224-
}
225-
]
226-
}
227-
},
228-
"success": true,
229-
"errors": [],
230-
"messages": []
201+
"result": {
202+
"id": "54d425de-7a78-4186-9975-d43c88ee7899",
203+
"created_at": "2022-03-16T21:18:39.93598Z",
204+
"updated_at": "2022-05-17T23:50:39.598345Z",
205+
"uid": "54d425de-7a78-4186-9975-d43c88ee7899",
206+
"name": "John Doe",
207+
"email": "[email protected]",
208+
"custom": {
209+
"groups": [
210+
{
211+
"email": "[email protected]",
212+
"id": "02fk6b3p3majl10",
213+
"name": "Finance"
214+
}
215+
]
216+
}
217+
},
218+
"success": true,
219+
"errors": [],
220+
"messages": []
231221
}
232222
```
233223

234-
235224
</Details>
236225

237226
:::note
238227

239-
240228
Steps 1-3 above only need to be completed once, while Steps 4-5 below would occur during normal operation.
241229

242-
243230
:::
244231

245232
### 4. Generate a DoH token for the user
@@ -254,14 +241,14 @@ curl "https://<TEAM_NAME>.cloudflareaccess.com/cdn-cgi/access/doh-token?account-
254241

255242
The response contains a unique DoH token associated with the user. This token expires in 24 hours. We recommend setting up a refresh flow for the DoH token instead of generating a new one for every DoH query.
256243

257-
258244
<Details header="Example response">
259245

260246
```json
261-
{"token":"y2khbGciOiJSUzI1NiIsImtpZCI6ImJlZjVkYjg4ZTEwMjk3ZDEwNzhkMmEyYjE0MjMxZTljYTQwMjQ2NjAwOTQzNmJhOTQwOGJkODY3ZmI4OWFiOGQifQ.eyJ0eXBlIjoiZG9oIiwiYXVkIjoiY2xvdWRmbGFyZS1nYXRld2F5LmNvbSIsImlhdCI6MTY1NDc1MTg3NSwiZXhwIjoxNjU0ODM4Mjc1LCJhY2NvdW50LWlkIjoiMTA4MDM0OGIyZGYzYmQwN2QxZmI1MjM3Y2Q1ZDU5M2EiLCJ1c2VyLWlkIjoiNTRkNDI1ZGUtN2E3OC00MTg2LTk5NzUtZDQzYzg4ZWU3ODk5In0.I5p4WsH2dPhQ8vwy84zF05PsoBHCsUSXAaMpNhEH36oFZ3tXcs9ksLz7OzpZ_x3HxUfO3n57LlpAF1VehaBt2i94XCkvSgtHpYcwd_qZydLp-BGtcyfU1LbdXQC3m6zxKcIWu5VySi8I-J25UYlpyJhYgZ4DQUZIpqbSSt6WcVRKvA7OBa7xjkTux4OcqWAViO_ZS-GLwl-fqhvolmiwk37seBD3YuV1zG06VeWXfrMkZ5MbhooHD1DZDBHOZpTtmN8MbeKeI4tlY1mb_O3-jE-um6F9Hrl4NQm89MKFzsum-_Rywi5m4PTSlDza7fjdJs7RzFgJd3VWgzG-jgyQKw"}
247+
{
248+
"token": "y2khbGciOiJSUzI1NiIsImtpZCI6ImJlZjVkYjg4ZTEwMjk3ZDEwNzhkMmEyYjE0MjMxZTljYTQwMjQ2NjAwOTQzNmJhOTQwOGJkODY3ZmI4OWFiOGQifQ.eyJ0eXBlIjoiZG9oIiwiYXVkIjoiY2xvdWRmbGFyZS1nYXRld2F5LmNvbSIsImlhdCI6MTY1NDc1MTg3NSwiZXhwIjoxNjU0ODM4Mjc1LCJhY2NvdW50LWlkIjoiMTA4MDM0OGIyZGYzYmQwN2QxZmI1MjM3Y2Q1ZDU5M2EiLCJ1c2VyLWlkIjoiNTRkNDI1ZGUtN2E3OC00MTg2LTk5NzUtZDQzYzg4ZWU3ODk5In0.I5p4WsH2dPhQ8vwy84zF05PsoBHCsUSXAaMpNhEH36oFZ3tXcs9ksLz7OzpZ_x3HxUfO3n57LlpAF1VehaBt2i94XCkvSgtHpYcwd_qZydLp-BGtcyfU1LbdXQC3m6zxKcIWu5VySi8I-J25UYlpyJhYgZ4DQUZIpqbSSt6WcVRKvA7OBa7xjkTux4OcqWAViO_ZS-GLwl-fqhvolmiwk37seBD3YuV1zG06VeWXfrMkZ5MbhooHD1DZDBHOZpTtmN8MbeKeI4tlY1mb_O3-jE-um6F9Hrl4NQm89MKFzsum-_Rywi5m4PTSlDza7fjdJs7RzFgJd3VWgzG-jgyQKw"
249+
}
262250
```
263251

264-
265252
</Details>
266253

267254
### 5. Send an authenticated DoH query
@@ -274,37 +261,35 @@ curl --silent "https://<ACCOUNT_ID>.cloudflare-gateway.com/dns-query?name=exampl
274261
--header "CF-Authorization: <USER_DOH_TOKEN>" | jq
275262
```
276263

277-
If the site is blocked and you have enabled [**Display block page**](/cloudflare-one/policies/gateway/configuring-block-page/#turn-on-the-block-page) for the policy, the query will return `162.159.36.12` (the IP address of the Gateway block page). If the block page is disabled, the response will be `0.0.0.0`.
278-
264+
If the site is blocked and you have enabled [**Display block page**](/cloudflare-one/policies/gateway/block-page/#turn-on-the-block-page) for the policy, the query will return `162.159.36.12` (the IP address of the Gateway block page). If the block page is disabled, the response will be `0.0.0.0`.
279265

280266
<Details header="Example response">
281267

282268
```json
283269
{
284-
"Status": 0,
285-
"TC": false,
286-
"RD": true,
287-
"RA": true,
288-
"AD": false,
289-
"CD": false,
290-
"Question": [
291-
{
292-
"name": "example.com",
293-
"type": 1
294-
}
295-
],
296-
"Answer": [
297-
{
298-
"name": "example.com",
299-
"type": 1,
300-
"TTL": 60,
301-
"data": "162.159.36.12"
302-
}
303-
]
270+
"Status": 0,
271+
"TC": false,
272+
"RD": true,
273+
"RA": true,
274+
"AD": false,
275+
"CD": false,
276+
"Question": [
277+
{
278+
"name": "example.com",
279+
"type": 1
280+
}
281+
],
282+
"Answer": [
283+
{
284+
"name": "example.com",
285+
"type": 1,
286+
"TTL": 60,
287+
"data": "162.159.36.12"
288+
}
289+
]
304290
}
305291
```
306292

307-
308293
</Details>
309294

310295
You can verify that the request was associated with the correct user email by checking your [Gateway DNS logs](/cloudflare-one/insights/logs/gateway-logs/). To filter these requests, build a DNS policy using any of the Gateway [identity-based selectors](/cloudflare-one/policies/gateway/identity-selectors/).

0 commit comments

Comments
 (0)