Cloudflare WAF proxy first then rules

Lessons · WAF series · Cloudflare WAF

Hero · browser hits the edge, origin stays hidden

Why the WAF is silent

The day-one ticket is always the same: “WAF is enabled on the zone, so the app is protected.” Wrong. Enabling Managed Rules on the zone does nothing for a hostname whose DNS record is DNS-only. The browser never reached the edge. It opened TCP to 192.0.2.10.

Three silent-zero states look identical in Security Events (empty for that hostname):

• Record is DNS-only — Cloudflare answers DNS with the origin IP. No proxy, no WAF.
• Record is proxied, but the client is hitting a different hostname (stale CNAME, mobile app hard-coded to the origin IP, partner still on the old A record).
• Traffic is not HTTP on a proxied port — SSH, SMTP, RDP, game servers. The HTTP proxy does not terminate them; those records must stay DNS-only or the service breaks.

Orange cloud is the attach

Cloudflare is a reverse proxy on anycast. When Proxy status is Proxied, the A/AAAA answer is a Cloudflare anycast address. The client TCP (and TLS) terminates at the nearest PoP. WAF, Bot, cache, and SSL run there. The edge then opens its own connection to 192.0.2.10 and sets CF-Connecting-IP to the original client. When Proxy status is DNS-only, DNS returns 192.0.2.10 and none of that happens.

Only A, AAAA, and CNAME used for HTTP/HTTPS can be proxied. MX and TXT are always DNS-only. Mail, SSH, and FTP records that you orange-cloud will break — that is a DNS mistake, not a WAF bug.

Journey · proxy first, then the rule list matters

Phases — custom before managed

This is the whiteboard question: walk a request through the WAF. L3/L4 DDoS runs on packets before HTTP is parsed. Then the Ruleset Engine security phases run in a fixed order. Account-level rulesets in a phase run before zone-level rulesets in that same phase. A terminating action (Block, Managed Challenge) stops evaluation — later phases never see the request.

OWASP map and rule actions

Interviewers ask which Cloudflare control maps to which OWASP bucket. Injection and known CVEs are Managed Rules. Auth brute is rate limit plus Exposed Credentials Check. Broken access control and insecure design are not a signature problem.

(http.request.uri.path eq "/wp-login.php" and http.request.method eq "POST" and ip.src.country ne "IN")
(ip.src.country in {"KP" "IR" "SY"})
(cf.threat_score gt 14)
(http.request.uri.path eq "/login" and http.request.method eq "POST")
# rate-limit: characteristic ip.src · period 60s · requests 5 · action Block · duration 300s
(http.host eq "api.example.com" and http.request.uri.path eq "/stripe/webhook" and ip.src in {192.0.2.80})
# Skip → Super Bot Fight Mode / Managed Rulesets — payment callbacks

Operators: eq ne in contains matches. Fields: http.request.uri.path, http.request.method, http.host, ip.src, ip.src.country (ISO 3166 alpha-2), http.user_agent, cf.threat_score, cf.client.bot. Enterprise Bot Management adds cf.bot_management.score (1–99). C-style == is not the language.

Runbook Side A / B / C

Lab: origin 192.0.2.10, public host www.example.com Proxied, do not grey-cloud it “to test origin.” Encryption mode Full (strict). Dashboard names below are Security → WAF / Security rules / Security Events as they appear in current docs.

Side A — DNS / client / bypass

1. Proxy the web records

   DNS → Records. A / AAAA / CNAME for www and the apex: Proxy status Proxied. Leave MX, SPF/DKIM TXT, and mail / SSH hosts DNS-only. Source: Cloudflare DNS — Proxy status.

2. Prove the answer is not the origin

   dig +short www.example.com A must not return 192.0.2.10. If it does, the WAF is not in path. Then filter origin so only Cloudflare (or Tunnel) can connect.

3. Encryption mode Full (strict)

   SSL/TLS → Full (strict). Origin presents a valid certificate the edge will verify. Flexible is HTTP to 192.0.2.10.

Side B — product (managed, custom, rate limit)

1. Turn on managed rulesets

   Security → WAF / Security Settings (filter Web application exploits). Enable Cloudflare managed ruleset and OWASP Core. Optional: Sensitive data detection. Source: Deploy a WAF managed ruleset in the dashboard.

2. One Custom rule

   Security rules → Create rule → Custom rules. Rule name block_high_threat. When incoming requests match: (cf.threat_score gt 14). Then take action: Managed Challenge (or Block). Deploy. Keep IP bans here; do not use this phase to “also catch SQLi” if you still want managed rule IDs in Security Events.

3. Rate limit /login

   Create rule → Rate limiting rules. Expression (http.request.uri.path eq "/login" and http.request.method eq "POST"). Characteristic ip.src. Period 60 seconds, 5 requests, action Block, duration 300s. Behind corporate NAT, ip.src alone punishes a whole office — add a cookie/session characteristic if you have one.

4. Do not skip managed for convenience

   Skip is for known-good callbacks (payment webhooks with a tight ip.src list). Skip-all-managed on / is turning the WAF off with extra steps.

Side C — proof (Security Events / Logpush)

1. Synthetic request

   From a test client that resolves through the proxied name: curl -sS -D- "https://www.example.com/product?id=1'+OR+'1'='1". Expect 403 (or challenge) if managed SQLi is in Block. If you get the app 200, first re-check Proxy status — then whether the managed rule action is actually Block.

2. Security Events

   Dashboard: Analytics → Events (Security Events). Filter the hostname and last 24 hours. You want a row: Service = Managed rules (or Custom rules / Rate limiting rules), Action = Block (or Managed Challenge), Rule ID, Ray ID, Client IP. Source: Cloudflare WAF — Security Events.

3. False-positive ladder

   Marketing says /api/upload multipart is blocked. Open the event, read the payload, take the rule ID (OWASP often 949110 / related anomaly rules). If it is a real attack, keep the block. If it is a false positive: Security rules → Create → Managed rules exception. When incoming requests match: path /api/upload. Then skip those rule IDs only. Re-test. Do not disable OWASP Core for the zone.

4. Logpush (optional SIEM)

   Logpush job, dataset http_requests, fields at least RayID, ClientIP, ClientCountry, WAFAction, WAFRuleID. Destination is your SIEM or R2. Plan availability is account-specific — confirm on the Logpush page rather than assuming Free includes it.

curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE/logpush/jobs" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "destination_conf": "r2://lab-bucket/cf-waf?account-id=$ACCT",
    "dataset": "http_requests",
    "logpull_options": "fields=RayID,ClientIP,ClientCountry,WAFAction,WAFRuleID×tamps=rfc3339"
  }'

One request after go-live

After the record is Proxied and rules are Deployed, GET /product?id=1' OR '1'='1 from 203.0.113.45 does this:

1. Resolver returns an anycast edge IP. Client TLS to the PoP. Origin IP stays unpublished.
2. L3/L4 DDoS, then ddos_l7. A single SQLi GET is not a flood — it continues.
3. http_request_firewall_custom — if cf.threat_score is low and no IP rule matches, continue. If a custom Block matches, stop; Managed never runs.
4. http_ratelimit — /product is not the login rule; continue.
5. http_request_firewall_managed — OWASP / Cloudflare Managed SQLi rule Blocks. 403 to the client. Security Events writes Service, Rule ID, Ray ID. Origin is not fetched.
6. SBFM, cache, Workers, origin — skipped because the action terminated the pipeline.

Traps + proof

Proof · a quiet origin log is success if Events has the Block

Sources

• Cloudflare DNS — Proxy status (Proxied / DNS-only; WAF applies only when proxied)
• Cloudflare DNS — Proxy status use cases (non-HTTP must stay DNS-only)
• Cloudflare WAF — WAF phases (http_request_firewall_custom, http_ratelimit, http_request_firewall_managed; account then zone)
• Cloudflare WAF — Security features interoperability (execution order; terminating actions; Skip vs Bot Fight Mode)
• Cloudflare Ruleset Engine — Phases list
• Cloudflare WAF — Custom rules (availability table; Log action Enterprise)
• Cloudflare WAF — Create a custom rule in the dashboard (Security rules → Create rule → Custom rules)
• Cloudflare WAF — Managed Rules (Cloudflare Managed Ruleset, OWASP Core Ruleset)
• Cloudflare WAF — Deploy a managed ruleset (Security Settings)
• Cloudflare WAF — Add a WAF exception
• Cloudflare WAF — Security Events (Analytics → Events)
• Cloudflare SSL/TLS — encryption mode Full (strict) vs Flexible

Related: F5 ASM architecture · F5 WAF interview