Cloudflare防火牆規則使用方法
各分案比較
| 方案 | 規則數量 | 攔截方式 | 是否允許正則 |
|---|---|---|---|
| Free/PRO-plus | 5 | No Log | No |
| PRO | 20 | No Log | No |
| Business | 100 | No Log | Yes |
| Enterprise | 1000 | All | Yes |
部分案例
| 案例 | 說明 |
|---|---|
| (ip.src ne 127.0.0.1) | 全站開啟驗證碼,訪客IP不是127.0.0.1開啟防禦機制 |
| (not cf.client.bot) | 非搜尋引擎的IP進行的訪問進行驗證碼或遮蔽 |
| (not ip.geoip.country in {“CN" “HK" “TW" “MO"} and not cf.client.bot) | 訪客不是大陸，香港，台灣，澳門的並且不是搜尋引擎的進行攔截（加入搜尋引擎判斷，防止Google，BING等國外搜尋引擎被攔截） |
| (not ip.geoip.country in {“CN" “HK" “TW" “MO"} and http.request.full_uri contains “login") | 訪客不是大陸，香港，台灣，澳門的並且訪問的連結裡面帶有login的就進行防火牆動作 |
| (ip.geoip.country in {“CN"} and http.request.full_uri contains “login") or (ip.geoip.country in {“CN"} and http.request.full_uri contains “register") | 大陸訪客的並且訪問的連結裡面帶有login/或者register的就進行防火牆動作 |
| (not http.referer contains “bnxb.com" and not http.referer contains “baidu.com") or (http.referer eq “") | 防盜鏈：來路域名非bnxb.com（含子域名）也非百度下的域名，或者來路為空就觸發防火牆攔截 |
| (http.request.full_uri contains “cdn.bnxb.com" and not ip.geoip.country in {“CN" “HK"}) | cdn.bnxb.com這個子域名只允許大陸，香港訪問，其他遮蔽 |
規則類型及編寫方法
| 規則名稱 | 允許類型 | 說明/範例 |
| http.cookie
字串 |
eq\ne\contains\not contains\matches\not matches | 判斷本地COOKIE是否包含某些特定值支援matches\not matches匹配正則
注意兩端需要用括號括起來，可以用and ,or 連接，類似 (not http.cookie contains “session=8521F670545D7865F79C3D7BED C29CCE;-background=light" and ip.geoip.asnum lt 2000) (http.cookie eq “session=8521F670545D7865F79C3D7BED C29CCE;-background=light") (http.cookie ne “session=8521F670545D7865F79C3D7BED C29CCE;-background=light") (http.cookie contains “session=8521F670545D7865F79C3D7BED C29CCE;-background=light") (not http.cookie contains “session=8521F670545D7865F79C3D7BED C29CCE;-background=light") |
| http.host
字串 |
eq\ne\contains\not contains\in\not in\matches\not matches | 主機名，判斷主機名是否存在設定的值支援正則匹配matches\not matches
(http.host eq “bnxb.com") (http.host ne “bnxb.com") (http.host contains “bnxb.com") (not http.host contains “bnxb.com") (http.host in {“bnxb.com" “cdn.bnxb.com"}) (not http.host in {“bnxb.com" “cdn.bnxb.com"}) |
| http.referer
字串 |
eq\ne\contains\not contains\matches\not matches | 判斷來源是否存在設定的值，正常用cotains(包含)和not contains(不包含)支援正則匹配matches\not matches
(http.referer contains “bnxb.com") (not http.referer contains “bnxb.com") |
| http.request.full_uri
字串 |
eq\ne\contains\not contains\matches\not matches | 設定防火牆的網站的某個完整連結，訪客訪問這個連結就會觸發防禦規則，不能含#，正常可以用contains 來判斷域名中含有某個詞的進行攔截或者放行,支援正則匹配matches\not matches
(http.request.full_uri eq “https://www.bnxb.com/html/123.html") (http.request.full_uri ne “https://www.bnxb.com/html/123.html") (http.request.full_uri contains “123″) (not http.request.full_uri contains “123″) |
| http.request.method
字串 |
eq\ne\in\not in | 訪客請求您網站的方式，可選GET,POST,PURGE,PUT,HEAD,OPTIONS,DELETE,PATCH
(http.request.method eq “GET") (http.request.method ne “GET") (http.request.method in {“GET" “POST" “PUT"}) (not http.request.method in {“GET" “POST" “PUT"}) |
| http.request.uri
字串 |
eq\ne\contains\not contains\matches\not matches | 您域名的URI
(http.request.uri eq “/articles/index?section=539061&expand=comments") (http.request.uri ne “/articles/index?section=539061&expand=comments") (http.request.uri contains “expand=comments") (not http.request.uri contains “expand=comments") |
| http.request.uri.path
字串 |
eq\ne\contains\not contains\in\not in\matches\not matches | 請求路徑
(http.request.uri.path eq “/articles/index") (http.request.uri.path ne “/articles/index") (http.request.uri.path contains “/articles/index") (not http.request.uri.path contains “/articles/index") (http.request.uri.path in {“/articles/index" “/articles/bnxb" “/bnxb/com"}) (not http.request.uri.path in {“/articles/index" “/articles/bnxb" “/bnxb/com"}) |
| http.request.uri.query
字串 |
eq\ne\contains\not contains\matches\not matches | query請求參數，也就是?後面的一串
(http.request.uri.query eq “section=539061&expand=comments") (http.request.uri.query ne “section=539061&expand=comments") (http.request.uri.query contains “expand=comments") (not http.request.uri.query contains “expand=comments") |
| http.request.version
字串 |
eq\ne\contains\not contains | HTTP請求協議的版本，有以下選項
HTTP/1.0 HTTP/1.1 HTTP/1.2 HTTP/2 HTTP/3 SPDY/3.1 (http.request.version eq “SPDY/3.1″) (http.request.version ne “SPDY/3.1″) (http.request.version in {“SPDY/3.1″ “HTTP/1.1″ “HTTP/2″}) (not http.request.version in {“SPDY/3.1″ “HTTP/1.1″ “HTTP/2″}) |
| http.user_agent
字串 |
eq\ne\contains\not contain\matches\not matches | 使用者瀏覽器標識，推薦使用contains/not contains
(http.user_agent eq “Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36″) (http.user_agent ne “Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36″) (http.user_agent contains “Chrome/65.0.3325.181″) (not http.user_agent contains “Chrome/65.0.3325.181″) |
| http.x_forwarded_for
字串 |
eq\ne\contains\not contain\matches\not matches | x-forwarded-for標頭 支援matches\not matches匹配正規表示式
(http.x_forwarded_for eq “111.111.11.11″) (http.x_forwarded_for ne “111.111.11.11″) (http.x_forwarded_for contains “11.11″) (not http.x_forwarded_for contains “11.11″) |
| ip.src
IP位址 |
eq\ne\in\not in | 客戶端IP地址
(ip.src eq 192.0.2.0) (ip.src ne 192.0.2.0) (ip.src in {192.0.2.0 192.0.3.0 192.168.1.1}) (not ip.src in {192.0.2.0 192.0.3.0 192.168.1.1}) |
| ip.geoip.asnum
數字 |
eq\ne\gt\lt\ge\le\in\not in | 訪客IP所屬的AS號,gt-大於，lt-小於，ge-大於等於,le-小於等於
(ip.geoip.asnum eq 13335) (ip.geoip.asnum ne 13335) (ip.geoip.asnum gt 13335) (ip.geoip.asnum lt 13335) (ip.geoip.asnum ge 13335) (ip.geoip.asnum le 13335) (ip.geoip.asnum in {13335 13332 11112}) (not ip.geoip.asnum in {13335 13332 11112}) |
| ip.geoip.continent
字串 |
eq\ne\in\not in | 訪客所屬的洲(7大洲)，洲程式碼如下:
( 或者 T1 代表 Tor網路) (ip.geoip.continent eq “AS") (ip.geoip.continent ne “AS") (ip.geoip.continent in {“AS" “AF" “EU" “OC"}) (not ip.geoip.continent in {“AS" “AF" “EU" “OC"}) |
| ip.geoip.country
字串 |
eq\ne\in\not in | 訪客所屬國家，使用二位英文字母標識國別，詳見http://tool.bnxb.com/domainname.html
(ip.geoip.country eq “CN") (ip.geoip.country ne “CN") (ip.geoip.country in {“CN" “HK" “TW" “MO"}) (not ip.geoip.country in {“CN" “HK" “TW" “MO"}) |
| ip.geoip.subdivision_1_iso_code
字串 |
If known, the ISO 3166-2 code for the first level region associated with the IP address. 1 If not known, this is an empty string.
GB-ENG |
|
| ip.geoip.subdivision_2_iso_code
字串 |
If known, the ISO 3166-2 code for the second level region associated with the IP address. If not known, this is an empty string.
GB-SWK |
|
| ip.geoip.is_in_european_union
布林 |
True if this is an EU country
true |
|
| Ssl
布林 |
是否使用HTTPS | |
| cf.client.bot
布林 |
基於各家搜尋引擎IP段判斷是否放行(支援Google,yahoo,yandex,apple,archive,bing,feedbin,grapeshot,linkedin,mail.ru,naver,pingdom,pinterest,seznam,uptimerobot)
(cf.client.bot) (not cf.client.bot) |
|
| cf.threat_score
數字 |
eq\ne\gt\lt\ge\le\in\not in | 訪客IP的威脅評分等級，越大說明CF對這個IP視為越危險，10分以上均屬於較不安全的IP，40分以上屬於對網際網路有過攻擊行為的IP，因此可以設定10分以上顯示驗證碼，50分以上攔截。（這個設定與防禦等級設定是使用同一套評分系統，防禦等級高-分值>0,防禦等級中-分值>14,防禦等級低-分值>24,防禦等級半關閉-分值>49）
(cf.threat_score eq 2) (cf.threat_score ne 2) (cf.threat_score gt 2) (cf.threat_score lt 2) (cf.threat_score ge 2) (cf.threat_score le 2) (cf.threat_score in {2 5 8}) (not cf.threat_score in {2 5 8}) |
| cf.tls_client_auth.cert_verified
布林 |
已驗證客戶端證書
(cf.tls_client_auth.cert_verified) (not cf.tls_client_auth.cert_verified) |
