Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ Configure the HTTP DDoS Attack Protection managed ruleset by defining overrides

Each zone has the HTTP DDoS Attack Protection managed ruleset enabled by default. This means that you do not need to deploy the managed ruleset to the `ddos_l7` phase ruleset explicitly. You only have to create a rule in the phase ruleset to deploy the managed ruleset if you need to configure overrides.

If you are using Terraform, refer to [DDoS managed rulesets configuration using Terraform](/terraform/additional-configurations/ddos-managed-rulesets/#example-configure-http-ddos-attack-protection).

## Configure an override for the HTTP DDoS Attack Protection managed ruleset

Use overrides to configure the HTTP DDoS Attack Protection managed ruleset. Overrides allow you to define a different action or sensitivity level from the default values. For more information on the available action and sensitivity level values, refer to [Ruleset parameters](/ddos-protection/managed-rulesets/http/override-parameters/).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,16 @@ sidebar:
head:
- tag: title
content: Configure Network-layer DDoS Attack Protection via API

---

import { Details, Render } from "~/components"
import { Details, Render } from "~/components";

Configure the Cloudflare Network-layer DDoS Attack Protection managed ruleset by defining overrides at the account level using the [Rulesets API](/ruleset-engine/rulesets-api/).

Each account has the Network-layer DDoS Attack Protection managed ruleset enabled by default. This means that you do not need to deploy the managed ruleset to the `ddos_l4` phase entry point ruleset explicitly. You only have to create a rule in the phase entry point to deploy the managed ruleset if you need to configure overrides.

If you are using Terraform, refer to [DDoS managed rulesets configuration using Terraform](/terraform/additional-configurations/ddos-managed-rulesets/#example-configure-network-layer-ddos-attack-protection).

## Configure an override for the Network-layer DDoS Attack Protection managed ruleset

You can define overrides at the ruleset, tag, and rule level for all managed rulesets.
Expand All @@ -26,6 +27,7 @@ When configuring the Network-layer DDoS Attack Protection managed ruleset, use o
- The Network-layer DDoS Attack Protection managed ruleset is always enabled. You cannot disable its rules using an override with `"enabled": false`.
- <Render file="managed-rulesets/read-only-rules-note" />
- You can only define overrides for the Network-layer DDoS Attack Protection managed ruleset at the account level.

:::

## Example
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,11 @@ This page provides examples of configuring [DDoS managed rulesets](/ddos-protect

DDoS managed rulesets are always enabled. Depending on your Cloudflare services, you may be able to adjust their behavior.

If you are using the Cloudflare API, refer to the following resources:

- [Configure HTTP DDoS Attack Protection via API](/ddos-protection/managed-rulesets/http/configure-api/)
- [Configure Network-layer DDoS Attack Protection via API](/ddos-protection/managed-rulesets/network/configure-api/)

For more information on deploying and configuring rulesets using the Rulesets API, refer to [Work with managed rulesets](/ruleset-engine/managed-rulesets/) in the Ruleset Engine documentation.

## Before you start
Expand Down Expand Up @@ -58,14 +63,14 @@ resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
rules {
# Adaptive DDoS Protection based on Locations (Available only to Enterprise zones with Advanced DDoS service)
id = "a8c6333711ff4b0a81371d1c444be2c3"
sensitivity_level = "default"
action = "managed_challenge"
sensitivity_level = "default"
action = "managed_challenge"
}
rules {
# Adaptive DDoS Protection based on User-Agents (Available only to Enterprise zones with Advanced DDoS service)
id = "7709d496081e458899c1e3a6e4fe8e55"
sensitivity_level = "default"
action = "managed_challenge"
sensitivity_level = "default"
action = "managed_challenge"
}
rules {
# HTTP requests causing a high number of origin errors.
Expand Down