Search code examples
cloudflare

Cloudflare Firewall ip rule not 100% whitelisted


I have the following rule (ip.src in {91.209.196.32/28 199.66.200.32/28 178.255.82.64/27 64.39.96.0/20}) and the action is allow at the moment I am receiving a lot of request from 64.39.111.243 and everything should pass regarding this part of the rule 64.39.96.0/20.

But from time to time, the exact same ip 64.39.111.243 is blocked from Browser integrity check or Validation service, seems that my firewall rule is not taken into account but for very few requests, 0.1% approx


Solution

  • In Cloudflare, the Allow action in the Firewall Rule does not exclude the request from being evaluated by other security mechanisms. This is documented here (quoted below)

    Matching requests are exempt from challenge and block actions triggered by other Firewall Rules content. The scope of the Allow action is limited to Firewall Rules; matching requests are not exempt from action by other Cloudflare Firewall products, such as IP Access Rules, WAF, etc. Matched requests will be mitigated if they are part of a DDoS attack.

    In your case, you might want to also add a Bypass rule turning off specific security features (also documented at the above link). Of course when adding this kind of exceptions it is important to be careful on the expression used to evaluate the rule.