Adding DNS API calls to secure-internet-traffic learning path #18388
+452
−30
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,34 +6,115 @@ sidebar: | |
|
|
||
| --- | ||
|
|
||
| import { Details, Render, Tabs, TabItem } from "~/components" | ||
|
|
||
| We recommend you add the following DNS policies to build an Internet and SaaS app security strategy for your organization. | ||
|
|
||
|
|
||
| <Details header="All-DNS-Domain-Allowlist"> | ||
| <Tabs syncKey="dashPlusAPI"> | ||
| Allowlist any known domains and hostnames. With this policy, you ensure that your users can access your organization's domains even if the domains fall under a blocked category, such as **Newly Seen Domains** or **Login Screens**. | ||
| <TabItem label="Dashboard"> | ||
| | Selector | Operator | Value | Logic | Action | | ||
| | -------- | -------- | --------------- | ----- | ------ | | ||
| | Domain | in list | *Known Domains* | Or | Allow | | ||
| | Host | in list | *Known Domains* | | | | ||
| </TabItem> | ||
| <TabItem label="API"> | ||
| ```sh | ||
| curl --request POST \ | ||
| --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \ | ||
| --header 'Content-Type: application/JSON' \ | ||
| --header "Authorization: Bearer <API TOKEN>" \ | ||
| --data '{ | ||
| "name": "All-DNS-Domain-Allowlist", | ||
| "description": "Organization-wide whitelist. Explicitly allow resolution of these DNS domains", | ||
| "precedence": 0, | ||
| "enabled": false, | ||
| "action": "allow", | ||
| "filters": [ | ||
| "dns" | ||
| ], | ||
| "traffic": "any(dns.domains[*] in $<Global Whitelist UUID>) or dns.fqdn in $<Global Whitelist UUID>" | ||
| }' | ||
| ``` | ||
| </TabItem> | ||
| <TabItem label="Terraform"> | ||
| ```tf | ||
| resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" { | ||
| account_id = var.account_id | ||
| name = "All-DNS-Domain-Allowlist" | ||
| description = "Organization-wide whitelist. Explicitly allow resolution of these DNS domains" | ||
| precedence = 0 | ||
| enabled = false | ||
| action = "allow" | ||
| filters = ["dns"] | ||
| traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}) or dns.fqdn in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}" | ||
| } | ||
| ``` | ||
| </TabItem> | ||
| </Tabs> | ||
| </Details> | ||
|
|
||
|
|
||
| <Details header="Quarantined-Users-DNS-Restricted-Access"> | ||
|
|
||
| <Render file="zero-trust/blocklist-restricted-users" /> | ||
|
There was a problem hiding this comment. @maxvp I'm not 100% sure I understood this mock rule. From what I understood from the description of this rule, it appears that you are attempting to restrict Quarantined users to specific domains for remediation, is this correct? If so, this wouldn't work because it would block the domains allowed for remediation. I proposed a change to this, and from a policy standpoint it should work. Let me know if my reasoning is correct. It also came to mind that this policy was meant to block quarantined users from accessing known malicious domains, but that wouldn't make much sense, as if the domains/hosts are known to be malicious, you would want that to be blocked organisation-wide Let me know your thoughts on this. |
||
| <Tabs> | ||
| <TabItem label="Dashboard"> | ||
| | Selector | Operator | Value | Logic | Action | | ||
| | ---------------- | ------------ | --------------------------------- | ----- | ------ | | ||
| | Domain | not in list | *Allowed Remediation Domains* | Or | Block | | ||
| | Host | not in list | *Allowed Remediation Domains* | And | | | ||
| | User Group Names | in | *Quarantined Users* | | | | ||
| </TabItem> | ||
| <TabItem label="API"> | ||
| ```sh | ||
| curl --request POST \ | ||
| --URL https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \ | ||
| --header 'Content-Type: application/JSON' \ | ||
| --header "Authorization: Bearer <API TOKEN>" \ | ||
| --data '{ | ||
| "name": "Quarantined-Users-DNS-Restricted-Access", | ||
| "description": "Restrict quarantined users traffic to corporate policy remediation domains, so that quarantined users can obtain help and/or remediate their security posture", | ||
| "precedence": 10, | ||
| "enabled": false, | ||
| "action": "block", | ||
| "filters": [ | ||
| "dns" | ||
| ], | ||
| "traffic": "not(any(dns.domains[*] in $<Allowed Remediation Domains list UUID>)) or not(any(dns.domains[*] in $<Allowed Remediation Domains list UUID>))", | ||
| "identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})", | ||
| "rule_settings": { | ||
| "block_page_enabled": true, | ||
| "notification_settings": { | ||
| "enabled": true | ||
| } | ||
| }' | ||
| ``` | ||
| </TabItem> | ||
| <TabItem label="Terraform"> | ||
| ```tf | ||
| resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" { | ||
| account_id = var.account_id | ||
| name = "Quarantined-Users-DNS-Restricted-Access" | ||
| description = "Restrict quarantined users traffic to corporate policy remediation domains, so that quarantined users can obtain help and/or remediate their security posture" | ||
| precedence = 10 | ||
| enabled = false | ||
| action = "block" | ||
| filters = ["dns"] | ||
| traffic = "not(any(dns.domains[*] in $<Allowed Remediation Domains list UUID>)) or not(any(dns.domains[*] in $<Allowed Remediation Domains list UUID>))" | ||
| identity = "any(identity.groups.name[*] in {\"Quarantined Users\"})" | ||
| rule_settings { | ||
| block_page_enabled = true | ||
| notification_settings { | ||
| enabled = true | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| </TabItem> | ||
| </Tabs> | ||
|
|
||
| </Details> | ||
|
|
||
|
|
@@ -120,4 +201,4 @@ Block specific IP addresses that are malicious or pose a threat to your organiza | |
| <Render file="zero-trust/blocklist-domain-host" params={{ one: "DNS" }} /> | ||
|
|
||
|
|
||
| </Details> | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I investigated if it was possible to add this to the partial referenced for the dashboard (gateway/policies/block-security-categories), however, this partial is being re-used for HTTP and DNS policies. Considering that in the API/Terraform you need different wirefilter expressions for HTTP and DNS, I would love to know if there's a way to modify the partial so that it also contains the API and Terraform code when it's inserted.
Following up on this note, on the DNS policies, the selector is in fact "Security Categories", while in the HTTP tab, the selector is "Security Risks". I'm not sure if this alone warrants for splitting this partial into one that is applied to DNS and another that is applied to HTTP, to which it would then make sense to add the API and TF code for the respective traffic type
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Files that reference the mentioned partial:
src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx
src/content/docs/cloudflare-one/policies/gateway/initial-setup/dns.mdx
src/content/docs/learning-paths/cybersafe/gateway-onboarding/gateway-create-test-policy.mdx
src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx
src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/test-policy.mdx
src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx
src/content/partials/cloudflare-one/gateway/policies/recommended-dns-policies.mdx
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can create flexible partials that accept parameters for different use cases (e.g. if a selector is used in both DNS and HTTP policies, you can use either
dnsorhttp.connin the API value depending on the page). Since the API sections are much longer than a string, it may be easier to break them out into their own partials.