Skip to content

Commit fcb43d5

Browse files
committed
Add common policy to page
1 parent 08164a5 commit fcb43d5

File tree

3 files changed

+45
-55
lines changed

3 files changed

+45
-55
lines changed

src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,50 @@ The categories included in this policy are not always a security threat, but blo
7272

7373
Block a set of categories sent in the EDNS section of the request. The integer category list to block on, can be sent to the gateway DNS as JSON(`{"categories": [<category-int-codes..>]}`) via OPT code 65050. This is useful to filter by categories, that are not known at the time of creating a rule. Whenever a DNS request is blocked because of the request context categories, gateway will reply with an EDE Blocked(15) field containing an array of matched categories.
7474

75-
<Render
76-
file="gateway/policies/dash-plus-api/dns/block-dynamic-categories"
77-
product="cloudflare-one"
78-
/>
75+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
76+
77+
| Selector | Operator | Value | Action |
78+
| ------------------------ | -------- | ------- | ------ |
79+
| Request Context Category | is | Present | Block |
80+
81+
</TabItem>
82+
<TabItem label="API">
83+
84+
```bash
85+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
86+
--header "Content-Type: application/json" \
87+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
88+
--data '{
89+
"name": "All-DNS-Bock-Category-Matches-In-Request",
90+
"description": "Block all category matches in the requet edns context",
91+
"precedence": 30,
92+
"enabled": true,
93+
"action": "block",
94+
"filters": [
95+
"dns"
96+
],
97+
"traffic": "dns.categories_in_request_context_matches",
98+
"identity": ""
99+
}'
100+
```
101+
102+
</TabItem>
103+
<TabItem label="Terraform">
104+
105+
```tf
106+
resource "cloudflare_zero_trust_gateway_policy" "block_content_categories" {
107+
account_id = var.cloudflare_account_id
108+
name = "All-DNS-Bock-Category-Matches-In-Request"
109+
description = "Block all category matches in the requet edns context"
110+
enabled = true
111+
action = "block"
112+
filters = ["dns"]
113+
traffic = "dns.categories_in_request_context_matches"
114+
identity = ""
115+
}
116+
```
117+
118+
</TabItem> </Tabs>
79119

80120
## Block unauthorized applications
81121

src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,7 @@ Use this selector to filter based on the IP addresses that the query resolves to
394394

395395
### Request Context Categories
396396

397-
Use this selector to match a dynamic list of [category IDs](/cloudflare-one/policies/gateway/domain-categories/#category-and-subcategory-ids) sent in the EDNS portion of a DNS query. Cloudflare includes request context in the OPT code `65050`.
397+
Use this selector to match a dynamic list of [category IDs](/cloudflare-one/policies/gateway/domain-categories/#category-and-subcategory-ids) sent in the EDNS portion of a DNS query. Gateway includes request context with the OPT code `65050`.
398398

399399
| UI name | API example | Evaluation phase |
400400
| -------------------------- | --------------------------------------------------------------------- | --------------------- |

src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/dns/block-dynamic-categories.mdx

Lines changed: 0 additions & 50 deletions
This file was deleted.

0 commit comments

Comments
 (0)