diff --git a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx index 2fb9c4b5517bf2..838bdddefd610a 100644 --- a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx +++ b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-list.mdx @@ -3,10 +3,9 @@ title: Create an allowlist or blocklist pcx_content_type: learning-unit sidebar: order: 2 - --- -import { Tabs, TabItem } from "~/components" +import { Tabs, TabItem } from "~/components"; In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications. @@ -15,35 +14,42 @@ Gateway supports creating [lists](/cloudflare-one/policies/gateway/lists/) of UR ## Example list policy + + The following DNS policy will allow access to all approved corporate domains included in a list called **Corporate Domains**. | Selector | Operator | Value | Action | | -------- | -------- | ------------------- | ------ | -| Domain | in list | *Corporate Domains* | Allow | +| Domain | in list | _Corporate Domains_ | Allow | + + - ```sh -curl --request POST \ - --URL https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \ + +```sh +curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \ --header 'Content-Type: application/JSON' \ - --header "Authorization: Bearer " \ + --header "Authorization: Bearer " \ --data '{ "name": "All-DNS-CorporateDomain-AllowList", "description": "Allow access to the corporate domains defined under the Corporate Domains list", "precedence": 1, - "enabled": false, + "enabled": true, "action": "allow", "filters": [ "dns" ], - "traffic": "any(dns.domains[*] in $)" + "traffic": "any(dns.domains[*] in $)" }' +``` - ``` + + To create a new DNS policy using **Terraform** to allow access to all approved corporate domains included in a list called **Corporate Domains**. + ```tf resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" { account_id = var.account_id @@ -56,5 +62,7 @@ resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" traffic = "any(dns.domains[*] in $)" } ``` + - \ No newline at end of file + + diff --git a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx index f28b5b5da63784..5e93f1f9dcdf24 100644 --- a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx +++ b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx @@ -5,7 +5,7 @@ sidebar: order: 1 --- -import { Tabs, TabItem, Render } from "~/components" +import { Render, Tabs, TabItem } from "~/components"; DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP. @@ -14,7 +14,9 @@ You can filter DNS traffic based on query or response parameters (such as domain To create a new DNS policy: + + 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**. 2. In the **DNS** tab, select **Add a policy**. 3. Name the policy. @@ -27,48 +29,57 @@ To create a new DNS policy: 6. Select **Create policy**. For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/). + + -To create a new DNS policy using **cURL**: - ```sh - curl --request POST \ - --url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \ - --header 'Content-Type: application/JSON' \ - --header "Authorization: Bearer " \ - --data '{ + +To create a new DNS policy using cURL: + +```sh +curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \ + --header 'Content-Type: application/JSON' \ + --header "Authorization: Bearer " \ + --data '{ "name": "All-DNS-SecurityCategories-Blocklist", - "description": "Block known security risks based on Cloudflare's threat intelligence", - "precedence": 0, - "enabled": false, - "action": "block", - "filters": [ - "dns" - ], - "traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})", - "rule_settings": { - "block_page_enabled": true, - "block_reason": "This domain was blocked due to being classified as a security risk to the organisation" - } - }' - ``` + "description": "Block known security risks based on Cloudflare's threat intelligence", + "precedence": 0, + "enabled": true, + "action": "block", + "filters": [ + "dns" + ], + "traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})", + "rule_settings": { + "block_page_enabled": true, + "block_reason": "This domain was blocked due to being classified as a security risk to your organization" + } + }' +``` + + + To create a new DNS policy using **Terraform**: + ```tf resource "cloudflare_zero_trust_gateway_policy" "security_risks_dns_policy" { account_id = var.account_id name = "All-DNS-SecurityCategories-Blocklist" description = "Block known security risks based on Cloudflare's threat intelligence" precedence = 0 - enabled = false + enabled = true action = "block" filters = ["dns"] traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})" rule_settings { block_page_enabled = true - block_page_reason = "This domain was blocked due to being classified as a security risk to the organisation" + block_page_reason = "This domain was blocked due to being classified as a security risk to your organization" } } ``` + + diff --git a/src/content/partials/cloudflare-one/gateway/lists.mdx b/src/content/partials/cloudflare-one/gateway/lists.mdx index 0e49c4f5f44da2..f410291bb0639f 100644 --- a/src/content/partials/cloudflare-one/gateway/lists.mdx +++ b/src/content/partials/cloudflare-one/gateway/lists.mdx @@ -38,9 +38,8 @@ You can now use this list in the policy builder by choosing the _in list_ operat ```bash curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/lists \ ---header "X-Auth-Email: " \ ---header "X-Auth-Key: " \ --header "Content-Type: application/json" \ +--header "Authorization: Bearer " \ --data '{ "description": "Private application IPs", "items": [{"value": "10.226.0.177/32"},{"value": "10.226.1.177/32"}],