Cloudflare Network Security cheat sheet

Cloudflare Network Security

• Cloudflare's edge network applies security in a reverse-proxy model: DNS resolution points the hostname to Cloudflare anycast IPs, TLS terminates at the edge, and only filtered traffic reaches the origin.

• WAF Managed Rules run before custom rules in the Cloudflare WAF pipeline; the order is Managed Rules, then custom firewall rules, then rate limiting and other products, so a managed block cannot be overridden by an allow rule unless the rule uses Skip.

• A WAF custom rule expression has three parts: a filter (field, operator, value), an action (Block, Managed Challenge, JS Challenge, Log, Skip), and optional logging; expressions use the Cloudflare Rules language with fields like ip.src, http.request.uri.path, and http.user_agent.

• Rate limiting rules key on characteristics such as IP, JA3 fingerprint, header value, or cookie, and define a threshold (requests), period (10s to 10min in the current product), action, and mitigation timeout; counting is per data-center unless the rule uses the counting expression across the edge.

• Bot Management scores requests 1-99: scores of 1-29 are typically automated, 30-99 likely human; the score is exposed in the rules language as cf.bot_management.score and in logs, and verified bots are flagged separately via cf.bot_management.verified_bot.

• SSL/TLS modes determine origin validation: Off, Flexible (edge HTTPS, origin HTTP), Full (unvalidated origin cert), Full (strict) (valid or Cloudflare Origin CA cert), and Strict (SNI) for custom hostnames; only Full (strict) validates the origin certificate chain.

• Cloudflare Tunnel (cloudflared) creates outbound-only connections from the origin to two or more edge data centers, removing the need for inbound firewall ports; Access policies can then gate the hostname with identity-provider authentication.

• DDoS protection is automatic and unmetered: L3/L4 attacks are mitigated by the edge network's anycast and scrubbing, while L7 attacks are handled by HTTP DDoS Managed Rules with sensitivity levels (High, Medium, Low, Essentially Off) and per-rule actions.

• Logpush exports request, firewall, and DNS logs to destinations such as S3, GCS, Splunk, or Datadog; Logpull retains logs for 7 days for Enterprise zones, and the GraphQL Analytics API provides aggregate firewall and security-event metrics.