源站网干货教程 2020-07-19

Cloudflare中firewall的编写方法

简单介绍

首先帮商家打个广告，博客使用的睿数据www.ruidata.net ，他家是阿里云代理，通过他家买阿里云服务器9折

这篇文章中说到博客一直在使用CloudFlare提供SSL服务和防火墙服务。SSL并没有什么好说的，今天简单介绍一下我是如何写Cloudflare中的防火墙规则。

firewall，也就是我们所说的防火墙规则。我们可以先看下效果

如图所示，在2.13号一天，防火墙为我们拦截了上亿条的恶意请求。免费套餐有5条的额度，对于一般用户我觉得已经足够了，如果你的网站结构过于复杂，还请你升级套餐，以寻求更多规则额度。

我们可以找到的官方文档如下:https://developers.cloudflare.com/firewall/cf-firewall-rules/，请先观看此文档，再看本文。如果你看完文档的话，你会发现拦截恶意请求其实很简单（当然需要你对http请求有一定了解）。看不懂也没关系，本文将大致讲解一下常用字段。防火墙支持的字段比一般编程语言更多，基于应用层+网络层。

基础字段

AS Num
通常缩写为asn，指的是某一个IP管理系统所分配到的IP，如果你看到大量恶意请求来自同一个asn，那就可以对这个asn直接做处理，亦或者你想屏蔽某IDC机房，也可以直接查到他的asn号。可以用在线工具来查询 asn，例如 ipip.net https://tools.ipip.net/as.php；也可以下载一个离线库来查询某IP的asn信息，例如 https://iptoasn.com/
Cookie
服务端用来标识用户身份的手段，如果不了解，就不用做处理。
Country
访客IP对应的国家，可以用来做访客区域限制。
Hostname
访问的主机名，也就是域名。因为CF是域名接入，子域名也会走这一段，如果你需要针对某子域名写规则，则需要用到这个字段。
IP Address
访客IP地址。
Referer
页面来源，详情可以看百度百科，可以做防盗链，也可以限制API不被滥用。
Request Method
页面请求方式，GET、POST、HEAD等这些。我们都知道，POST请求是不被缓存的，所以可能会被坏人利用这一手段来进行CC攻击。所对应的防御手段就是在不需要使用其他请求方式的时候只开启GET。
SSL/HTTPS
是否启用SSL。
URI Full
页面完整地址。获取到的是这个 https://www.baidu.com/s?ie=utf-8&wd=%E5%9D%8F%E7%94%B7%E5%AD%A9
URI
页面地址。如果上面的URL，只能获取到 /s?ie=utf-8&wd=%E5%9D%8F%E7%94%B7%E5%AD%A9 ，也就是去掉了协议+主机名。
URI PATH
页面路径。上面基础再去掉请求参数，获取到 /s。
URI Query String
请求参数。获取到的就是 ie=utf-8&wd=%E5%9D%8F%E7%94%B7%E5%AD%A9
HTTP Version
HTTP版本。不常用。
User Agent
用户代理，缩写为UA。可以用来屏蔽掉非正常用户。这里我用来屏蔽一些程序访问，例如 (http.user_agent contains "curl") or (http.user_agent contains "requests") or (http.user_agent contains "python") or (http.user_agent contains "php") or (http.user_agent contains "java") or (http.user_agent contains "urllib") or (http.user_agent contains "Java") or (http.user_agent contains "Ruby") or (http.user_agent contains "Go-http-client") or (not http.user_agent contains "/")
X-Forwarded-For
XFF头，使用了代理或者CDN后常添加到这里。详见百度百科
Known Bots
已知爬虫。这里是CF已知的搜索引擎爬虫，我们可以用它来给搜索引擎爬虫加白。
Threat Score
风险指数、安全分数。可选为0-100，0为最低。越大表示该IP风险越高。

基本逻辑

可以看这里 https://developers.cloudflare.com/firewall/cf-firewall-rules/fields-and-expressions/，基本类同于程序语法。

相应动作

Action	Description
Bypass	Allows user to dynamically disable Cloudflare security features for a requestAvailable to all plansMatching requests exempt from evaluation by a user-defined list containing one or more of the following Cloudflare Firewall products/features:User-agent BlockingBrowser Integrity CheckHotlinking ProtectionSecurity Level (IP Reputation)Rate LimitingZone Lockdown (PRO, BIZ, ENT)WAF Managed Rules (PRO, BIZ, ENT)Requests which match the Bypass action are still subject to evaluation (and thus a challenge or block) within Firewall Rules, based on the order of execution.To stop a bypassed request from further evaluation within Firewall Rules, you must create a new rule using the same expression and the Allow action immediately below the Bypass rule.//让请求不受某条规则的限制
Allow	Matching requests are exempt from challenge and block actions triggered by other Firewall Rules content.The scope of the Allow action is limited to Firewall Rules; matching requests are not exempt from action by other Cloudflare Firewall products, such as IP Access Rules, WAF, etc.Matched requests will be mitigated if they are part of a DDoS attack.//允许该请求
Challenge (Captcha)	Useful for ensuring that the visitor accessing the site is human, not automatedThe client that made the request must pass a Captcha Challenge.If successful, Cloudflare accepts the matched request; otherwise, it is blocked.//输入验证码
JS Challenge	Useful for ensuring that bots and spam cannot access the requested resource; browsers, however, are free to satisfy the challenge automatically.The client that made the request must pass a Cloudflare Javascript Challenge before proceeding.If successful, Cloudflare accepts the matched request; otherwise, it is blocked.//五秒盾
Block	Matching requests are denied access to the site.//直接阻止访问

完整可以看这里 <https://developers.cloudflare.com/firewall/cf-firewall-rules/actions/ >。

开始实战

下面介绍我是如何写的，由于博客是纯静态的，所以我并不担心会出现服务器被入侵的问题。所以我编写的规则大部分是针对恶意（非真实）用户的拦截。

屏蔽掉自动化/程序访问，这里我直接选择block
(http.user_agent contains "curl") or (http.user_agent contains "requests") or (http.user_agent contains "python") or (http.user_agent contains "php") or (http.user_agent contains "java") or (http.user_agent contains "urllib") or (http.user_agent contains "Java") or (http.user_agent contains "Ruby") or (http.user_agent contains "Go-http-client") or (not http.user_agent contains "/")
验证可能存在风险的请求，选择Challenge (Captcha)（由于我的博客不需要接收传参，也不需要其他类型请求。如果你不是纯静态，请加白名单！！！）
(http.request.full_uri contains "?") or (http.request.method ne "GET") or (cf.threat_score gt 10)
放行已知蜘蛛，选择Allow
(cf.client.bot)