I have the following rule (ip.src in {91.209.196.32/28 199.66.200.32/28 178.255.82.64/27 64.39.96.0/20})
and the action is allow
at the moment I am receiving a lot of request from 64.39.111.243
and everything should pass regarding this part of the rule 64.39.96.0/20
.
But from time to time, the exact same ip 64.39.111.243
is blocked from Browser integrity check
or Validation
service, seems that my firewall rule is not taken into account but for very few requests, 0.1% approx
In Cloudflare, the Allow
action in the Firewall Rule does not exclude the request from being evaluated by other security mechanisms. This is documented here (quoted below)
Matching requests are exempt from challenge and block actions triggered by other Firewall Rules content. The scope of the Allow action is limited to Firewall Rules; matching requests are not exempt from action by other Cloudflare Firewall products, such as IP Access Rules, WAF, etc. Matched requests will be mitigated if they are part of a DDoS attack.
In your case, you might want to also add a Bypass
rule turning off specific security features (also documented at the above link). Of course when adding this kind of exceptions it is important to be careful on the expression used to evaluate the rule.