Skip to content

Commit c17ddeb

Browse files
ranbelranbel
authored
[ZT] Terraform - Replace your VPN policies (#22338)
* lists * policies * session timeout * block page
1 parent 42ef22d commit c17ddeb

File tree

5 files changed

+248
-5
lines changed

5 files changed

+248
-5
lines changed

‎src/content/docs/learning-paths/replace-vpn/build-policies/block-page.mdx‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 5
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, Tabs, TabItem } from "~/components";
99

1010
With Cloudflare Zero Trust, you can deliver actionable feedback to users when they are blocked by a Gateway policy. Custom block messages can reduce user confusion and decrease your IT ticket load.
1111

@@ -35,6 +35,8 @@ The Gateway custom block page is a different concept from [Access custom block p
3535

3636
For DNS policies, you will need to enable the block page on a per-policy basis.
3737

38+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
39+
3840
<Render
3941
file="gateway/add-block-page"
4042
product="cloudflare-one"
@@ -45,6 +47,47 @@ For DNS policies, you will need to enable the block page on a per-policy basis.
4547

4648
/>
4749

50+
</TabItem>
51+
<TabItem label="Terraform (v5)">
52+
53+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
54+
- `Zero Trust Write`
55+
56+
2. Choose a DNS policy with a Block action.
57+
58+
3. In the policy's [`rule_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_gateway_policy), turn on `block_page_enabled`. If you have configured a [custom Gateway block page](/cloudflare-one/policies/gateway/block-page/#customize-the-block-page), you can optionally show an additional `block_reason` when traffic is blocked by this policy.
59+
60+
```tf
61+
resource "cloudflare_zero_trust_gateway_policy" "dns_block_security_categories" {
62+
name = "Block DNS Security Categories"
63+
enabled = true
64+
account_id = var.cloudflare_account_id
65+
description = "Managed by Terraform - Generic security policy based on Cloudflare Threat Intelligence categories."
66+
precedence = 101
67+
action = "block"
68+
filters = ["dns"]
69+
/* Categories being enabled here:
70+
- 80: "Command and Control & Botnet"
71+
- 83: "Cryptomining"
72+
- 117: "Malware"
73+
- 131: "Phishing"
74+
- 153: "Spyware"
75+
- 175: "DNS Tunneling"
76+
- 176: "DGA Domains"
77+
- 178: "Brand Embedding"
78+
*/
79+
traffic = "any(dns.security_category[*] in {80 83 117 131 153 175 176 178})"
80+
identity = ""
81+
82+
rule_settings = {
83+
block_page_enabled = true
84+
block_reason = "This domain has been flagged as a potential security risk." // Adds an additional message to the custom block page. Requires enabling custom block page in cloudflare_zero_trust_gateway_settings.
85+
}
86+
}
87+
```
88+
</TabItem>
89+
</Tabs>
90+
4891
### Customize the block page
4992

5093
<Render file="gateway/customize-block-page" product="cloudflare-one" />

‎src/content/docs/learning-paths/replace-vpn/build-policies/create-policy.mdx‎

Lines changed: 56 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,25 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
7777
}'
7878
```
7979

80-
</TabItem> </Tabs>
80+
</TabItem>
81+
<TabItem label="Terraform (v5)">
82+
83+
```tf
84+
resource "cloudflare_zero_trust_gateway_policy" "dns_allow_wiki_domains" {
85+
name = "Company Wiki DNS policy"
86+
enabled = true
87+
account_id = var.cloudflare_account_id
88+
description = "Managed by Terraform - Allow employees to access company wiki domains."
89+
precedence = 102
90+
action = "allow"
91+
filters = ["dns"]
92+
traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.wiki_domains.id})"
93+
identity = "identity.email matches \".*@example.com\""
94+
}
95+
```
96+
97+
</TabItem>
98+
</Tabs>
8199

82100
## Example network policy
83101

@@ -135,7 +153,25 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
135153
}'
136154
```
137155

138-
</TabItem> </Tabs>
156+
</TabItem>
157+
<TabItem label="Terraform (v5)">
158+
159+
```tf
160+
resource "cloudflare_zero_trust_gateway_policy" "network_allow_wiki_IPs" {
161+
name = "Company Wiki Network policy"
162+
enabled = true
163+
account_id = var.cloudflare_account_id
164+
description = "Managed by Terraform - Allow employees to access company wiki IPs."
165+
precedence = 103
166+
action = "allow"
167+
filters = ["l4"]
168+
traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.wiki_IPs.id}"
169+
identity = "identity.email matches \".*@example.com\""
170+
}
171+
```
172+
173+
</TabItem>
174+
</Tabs>
139175

140176
### Catch-all policy
141177

@@ -197,7 +233,24 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
197233
}'
198234
```
199235

200-
</TabItem> </Tabs>
236+
</TabItem>
237+
<TabItem label="Terraform (v5)">
238+
239+
```tf
240+
resource "cloudflare_zero_trust_gateway_policy" "network_catch_all" {
241+
name = "Catch-all block policy"
242+
enabled = true
243+
account_id = var.cloudflare_account_id
244+
description = "Managed by Terraform - Block access to private network."
245+
precedence = 14002
246+
action = "block"
247+
filters = ["l4"]
248+
traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.private_IPs.id} or any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.private_domains.id})"
249+
}
250+
```
251+
252+
</TabItem>
253+
</Tabs>
201254

202255
Network policies are evaluated in [top-down order](/cloudflare-one/policies/gateway/order-of-enforcement/#order-of-precedence), so if a user does not match an explicitly defined policy for an application, they will be blocked.
203256
To learn how multiple policies interact, refer to [Order of enforcement](/cloudflare-one/policies/gateway/order-of-enforcement/).

‎src/content/partials/cloudflare-one/gateway/customize-block-page.mdx‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,14 @@
22
{}
33
---
44

5+
import { Tabs, TabItem } from "~/components";
6+
57
You can customize the Cloudflare-hosted block page by making global changes that Gateway will display every time a user reaches your block page. Customizations will apply regardless of the type of policy (DNS or HTTP) that blocks the traffic.
68

79
To customize your block page:
810

11+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
12+
913
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Custom Pages**.
1014
2. Under **Account Gateway block page**, select **Customize**.
1115
3. Choose **Custom Gateway block page**. Gateway will display a preview of your custom block page. Available customizations include:
@@ -17,4 +21,35 @@ To customize your block page:
1721
- Background color
1822
4. Select **Save**.
1923

24+
25+
</TabItem>
26+
<TabItem label="Terraform (v5)">
27+
28+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
29+
- `Zero Trust Write`
30+
31+
2. In [`cloudflare_zero_trust_gateway_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_gateway_settings), configure the `block_page` argument with your customizations:
32+
33+
```tf
34+
resource "cloudflare_zero_trust_gateway_settings" "team_name" {
35+
account_id = var.cloudflare_account_id
36+
settings = {
37+
block_page = {
38+
enabled = true //do not use the default Gateway block page
39+
mode = "customized_block_page" //use a custom block page
40+
name = "Cloudflare"
41+
logo_path = "https://logos.com/a.png"
42+
header_text = "--header--"
43+
footer_text = "--footer--"
44+
mailto_address = "[email protected]"
45+
mailto_subject = "Blocked Request"
46+
background_color = "#ffffff"
47+
suppress_footer = false
48+
}
49+
}
50+
}
51+
```
52+
</TabItem>
53+
</Tabs>
54+
2055
Gateway will now display a custom Gateway block page when your users visit a blocked website.

‎src/content/partials/cloudflare-one/gateway/lists.mdx‎

Lines changed: 76 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,42 @@ When you format a CSV file for upload:
2525

2626
To upload the list to Zero Trust:
2727

28+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
29+
2830
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **My Team** > **Lists**.
2931
2. Select **Upload CSV**.
3032
3. Next, specify a **List name**, enter an optional description, and choose a **List type**.
3133
4. Drag and drop a file into the **CSV file** window, or select a file.
3234
5. Select **Create**.
3335

36+
</TabItem>
37+
<TabItem label="Terraform (v5)">
38+
39+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
40+
- `Zero Trust Write`
41+
42+
2. Decode the contents of the CSV file and store it as a local value:
43+
44+
```tf
45+
locals {
46+
ip_list = csvdecode(file("${path.module}/list-test.csv"))
47+
}
48+
```
49+
3. Create a list using the [`cloudflare_zero_trust_list`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_list) resource:
50+
51+
```tf
52+
resource "cloudflare_zero_trust_list" "ips_from_csv" {
53+
account_id = var.cloudflare_account_id
54+
name = "IPs imported from CSV"
55+
description = "Managed by Terraform"
56+
type = "IP"
57+
items = local.ip_list
58+
}
59+
```
60+
61+
</TabItem>
62+
</Tabs>
63+
3464
You can now use this list in the policy builder by choosing the _in list_ operator.
3565

3666
## Create a list manually
@@ -59,6 +89,51 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/lists \
5989
}'
6090
```
6191

62-
</TabItem> </Tabs>
92+
</TabItem>
93+
<TabItem label="Terraform (v5)">
94+
95+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
96+
- `Zero Trust Write`
97+
98+
2. Create a list using the [`cloudflare_zero_trust_list`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_list) resource.
99+
100+
Example list of IPs:
101+
```tf
102+
resource "cloudflare_zero_trust_list" "wiki_IPs" {
103+
account_id = var.cloudflare_account_id
104+
name = "Company Wiki IP addresses"
105+
description = "Managed by Terraform"
106+
type = "IP"
107+
items = [
108+
{
109+
description = "Example IP address range"
110+
value = "192.0.2.0/24",
111+
},
112+
{
113+
value = "198.51.100.0/24"
114+
}
115+
]
116+
}
117+
```
118+
119+
Example list of domains:
120+
```tf
121+
resource "cloudflare_zero_trust_list" "wiki_domains" {
122+
account_id = var.cloudflare_account_id
123+
name = "Company Wiki Domains"
124+
description = "Managed by Terraform"
125+
type = "DOMAIN"
126+
items = [
127+
{
128+
value = "wiki.example.com"
129+
},
130+
{
131+
value = "wiki2.example.com"
132+
}]
133+
}
134+
```
135+
136+
</TabItem>
137+
</Tabs>
63138

64139
You can now use this list in the policy builder by choosing the _in list_ operator.

‎src/content/partials/cloudflare-one/warp/warp-sessions-gateway.mdx‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,53 @@
33

44
---
55

6+
import { TabItem, Tabs } from "~/components";
7+
68
You can enforce WARP session timeouts on any Gateway Network and HTTP policy that has an Allow action. If you do not specify a session timeout, the WARP session will be unlimited by default.
79

810
Session timeouts have no impact on Gateway DNS policies. DNS policies remain active even when a user needs to re-authenticate.
911

1012
To configure a session timeout for a Gateway policy:
1113

14+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
15+
1216
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to either **Gateway** > **Firewall Policies**. Choose either **Network** or **HTTP**.
1317
2. Add a policy and select the *Allow* action. Alternatively, choose any existing *Allow* policy.
1418
3. Under **Step 4 - Configure policy settings**, select **Edit** next to **Enforce WARP client session duration**.
1519
4. Enter a session expiration time in `1h30m0s` format and save.
1620
5. Save the policy.
1721

22+
</TabItem>
23+
<TabItem label="Terraform (v5)">
24+
25+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
26+
- `Zero Trust Write`
27+
28+
2. Choose a Network (`l4`) or HTTP (`http`) policy with an Allow action.
29+
30+
3. In the policy's [`rule_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_gateway_policy), use the `check_session` argument to enable and configure a session timeout:
31+
32+
```tf
33+
resource "cloudflare_zero_trust_gateway_policy" "network_allow_wiki_IPs" {
34+
name = "Company Wiki Network policy"
35+
enabled = true
36+
account_id = var.cloudflare_account_id
37+
description = "Managed by Terraform - Allow employees to access company wiki IPs."
38+
precedence = 103
39+
action = "allow"
40+
filters = ["l4"]
41+
traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.wiki_IPs.id}"
42+
identity = "identity.email matches \".*@example.com\""
43+
44+
rule_settings = {
45+
check_session = {
46+
enforce = true
47+
duration = "1h30m0s"
48+
}
49+
}
50+
}
51+
```
52+
</TabItem>
53+
</Tabs>
54+
1855
Session checks are now enabled for the application protected by this policy. Users can continue to reach applications outside of the policy definition.

0 commit comments

Comments
 (0)