源站網幹貨教程 2020-07-19

Cloudflare中firewall的編寫方法

簡單介紹

首先幫商家打個廣告，博客使用的睿數據www.ruidata.net ，他家是阿裏雲代理，通過他家買阿裏雲服務器9折

這篇文章中說到博客一直在使用CloudFlare提供SSL服務和防火牆服務。SSL並沒有什麽好說的，今天簡單介紹一下我是如何寫Cloudflare中的防火牆規則。

firewall，也就是我們所說的防火牆規則。我們可以先看下效果

如圖所示，在2.13號一天，防火牆為我們攔截了上億條的惡意請求。免費套餐有5條的額度，對於一般用戶我覺得已經足夠了，如果你的網站結構過於複雜，還請你升級套餐，以尋求更多規則額度。

我們可以找到的官方文檔如下:https://developers.cloudflare.com/firewall/cf-firewall-rules/，請先觀看此文檔，再看本文。如果你看完文檔的話，你會發現攔截惡意請求其實很簡單（當然需要你對http請求有一定了解）。看不懂也沒關係，本文將大致講解一下常用字段。防火牆支持的字段比一般編程語言更多，基於應用層+網絡層。

基礎字段

AS Num
通常縮寫為asn，指的是某一個IP管理係統所分配到的IP，如果你看到大量惡意請求來自同一個asn，那就可以對這個asn直接做處理，亦或者你想屏蔽某IDC機房，也可以直接查到他的asn號。可以用線上工具來查詢 asn，例如 ipip.net https://tools.ipip.net/as.php；也可以下載一個離線庫來查詢某IP的asn信息，例如 https://iptoasn.com/
Cookie
服務端用來標識用戶身份的手段，如果不了解，就不用做處理。
Country
訪客IP對應的國家，可以用來做訪客區域限製。
Hostname
訪問的主機名，也就是域名。因為CF是域名接入，子域名也會走這一段，如果你需要針對某子域名寫規則，則需要用到這個字段。
IP Address
訪客IP地址。
Referer
頁麵來源，詳情可以看百度百科，可以做防盜鏈，也可以限製API不被濫用。
Request Method
頁麵請求方式，GET、POST、HEAD等這些。我們都知道，POST請求是不被緩存的，所以可能會被壞人利用這一手段來進行CC攻擊。所對應的防禦手段就是在不需要使用其他請求方式的時候隻開啟GET。
SSL/HTTPS
是否啟用SSL。
URI Full
頁麵完整地址。獲取到的是這個 https://www.baidu.com/s?ie=utf-8&wd=%E5%9D%8F%E7%94%B7%E5%AD%A9
URI
頁麵地址。如果上麵的URL，隻能獲取到 /s?ie=utf-8&wd=%E5%9D%8F%E7%94%B7%E5%AD%A9 ，也就是去掉了協議+主機名。
URI PATH
頁麵路徑。上麵基礎再去掉請求參數，獲取到 /s。
URI Query String
請求參數。獲取到的就是 ie=utf-8&wd=%E5%9D%8F%E7%94%B7%E5%AD%A9
HTTP Version
HTTP版本。不常用。
User Agent
用戶代理，縮寫為UA。可以用來屏蔽掉非正常用戶。這裏我用來屏蔽一些程序訪問，例如 (http.user_agent contains "curl") or (http.user_agent contains "requests") or (http.user_agent contains "python") or (http.user_agent contains "php") or (http.user_agent contains "java") or (http.user_agent contains "urllib") or (http.user_agent contains "Java") or (http.user_agent contains "Ruby") or (http.user_agent contains "Go-http-client") or (not http.user_agent contains "/")
X-Forwarded-For
XFF頭，使用了代理或者CDN後常添加到這裏。詳見百度百科
Known Bots
已知爬蟲。這裏是CF已知的搜寻引擎爬蟲，我們可以用它來給搜寻引擎爬蟲加白。
Threat Score
風險指數、安全分數。可選為0-100，0為最低。越大表示該IP風險越高。

基本邏輯

可以看這裏 https://developers.cloudflare.com/firewall/cf-firewall-rules/fields-and-expressions/，基本類同於程序語法。

相應動作

Action	Description
Bypass	Allows user to dynamically disable Cloudflare security features for a requestAvailable to all plansMatching requests exempt from evaluation by a user-defined list containing one or more of the following Cloudflare Firewall products/features:User-agent BlockingBrowser Integrity CheckHotlinking ProtectionSecurity Level (IP Reputation)Rate LimitingZone Lockdown (PRO, BIZ, ENT)WAF Managed Rules (PRO, BIZ, ENT)Requests which match the Bypass action are still subject to evaluation (and thus a challenge or block) within Firewall Rules, based on the order of execution.To stop a bypassed request from further evaluation within Firewall Rules, you must create a new rule using the same expression and the Allow action immediately below the Bypass rule.//讓請求不受某條規則的限製
Allow	Matching requests are exempt from challenge and block actions triggered by other Firewall Rules content.The scope of the Allow action is limited to Firewall Rules; matching requests are not exempt from action by other Cloudflare Firewall products, such as IP Access Rules, WAF, etc.Matched requests will be mitigated if they are part of a DDoS attack.//允許該請求
Challenge (Captcha)	Useful for ensuring that the visitor accessing the site is human, not automatedThe client that made the request must pass a Captcha Challenge.If successful, Cloudflare accepts the matched request; otherwise, it is blocked.//輸入驗證碼
JS Challenge	Useful for ensuring that bots and spam cannot access the requested resource; browsers, however, are free to satisfy the challenge automatically.The client that made the request must pass a Cloudflare Javascript Challenge before proceeding.If successful, Cloudflare accepts the matched request; otherwise, it is blocked.//五秒盾
Block	Matching requests are denied access to the site.//直接阻止訪問

完整可以看這裏 <https://developers.cloudflare.com/firewall/cf-firewall-rules/actions/ >。

開始實戰

下麵介紹我是如何寫的，由於博客是純靜態的，所以我並不擔心會出現服務器被入侵的問題。所以我編寫的規則大部分是針對惡意（非真實）用戶的攔截。

屏蔽掉自動化/程序訪問，這裏我直接選擇block
(http.user_agent contains "curl") or (http.user_agent contains "requests") or (http.user_agent contains "python") or (http.user_agent contains "php") or (http.user_agent contains "java") or (http.user_agent contains "urllib") or (http.user_agent contains "Java") or (http.user_agent contains "Ruby") or (http.user_agent contains "Go-http-client") or (not http.user_agent contains "/")
驗證可能存在風險的請求，選擇Challenge (Captcha)（由於我的博客不需要接收傳參，也不需要其他類型請求。如果你不是純靜態，請加白名單！！！）
(http.request.full_uri contains "?") or (http.request.method ne "GET") or (cf.threat_score gt 10)
放行已知蜘蛛，選擇Allow
(cf.client.bot)