Cloudflare通用防火墙规则

CF向免费版用户提供了5条防火墙规则，可在防火墙-防火墙规则处进行配置。自定义防火墙规则的目的，就是圈定包含一定特征（如IP、UA、地域、提供商等）的可疑对象，并对其进行验证码质询或阻止访问。充分认识这个目标，后续的所有逻辑都将围绕它来展开。

防火墙规则的触发机制是自上而下触发一次，高优先级的规则要放在上部。在规则设置中需要灵活组合匹配条件，and需要全部满足、or为满足任一条件。下文提供的匹配规则，请通过编辑表达式功能修改并输入。

在开始配置防火墙规则之前，请先前往防火墙-设置下，将Privacy Pass支持关闭，以避免一种绕过质询的可能（尽管如此，免费版的CAPTCHA依然存在可绕过的方式，所以在较严重的情况下应适当选择阻止部分访问）。

一、白名单放行
放在最高优先级的目标是允许已知的正常流量通过防火墙，因为我们后续的配置比如针对机房AS会使得验证施加于GoogleBot之类的搜索引擎爬虫，此外白名单IP可以包括自己的调试IP、已知的善意rss爬虫等。Bot可以直接选用CF提供的合法机器人爬虫，IP白名单选用包含以下各项，选择操作为允许。

(ip.src in {1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4 171.220.224.253 171.220.224.145 101.89.43.238 101.89.45.22 210.51.43.126 112.64.237.248 121.14.77.70 121.14.77.65 61.241.55.180 61.241.55.230 112.53.2.25 112.53.2.52 220.194.117.74 220.194.117.27 111.30.182.61 111.30.182.95 110.249.201.0/24 110.249.202.0/24 111.225.148.0/24 111.225.149.0/24 220.243.135.0/24 220.243.136.0/24 220.243.188.0/24 220.243.189.0/24 60.8.123.0/24 60.8.151.0/24}) or (cf.client.bot) or (http.user_agent contains "DNSPod") or (http.user_agent contains "Baiduspider") or (http.user_agent contains "Googlebot") or (http.user_agent contains "360Spider") or (http.user_agent contains "Sogou web spider") or (http.user_agent contains "bingbot") or (http.user_agent contains "YisouSpider") or (http.user_agent contains "Bytespider") or (http.user_agent contains "Sogou inst spider") or (http.user_agent contains "Sogou spider") or (http.user_agent contains "Sogou wap spider") or (http.user_agent contains "YandexBot") or (http.user_agent contains "GPTBot") or (http.user_agent contains "baiduboxapp") or (http.user_agent contains "BingPreview") or (http.user_agent contains "YandexBot")

二、屏蔽国外

(not ip.geoip.country in {"CN"} and not ip.geoip.country in {"HK"} and not ip.geoip.country in {"OM"} and not ip.geoip.country in {"TW"})

三、ASN验证
利用的是CF对ASN的判断。这里提到的ASN为自治网络的代码，如AS4134为中国电信。以下列表中基本是数据中心服务商的代号，因为对外提供租赁它们也是常见的网络攻击来源，而非海外真实访客常用的家庭宽带ISP。配置为ASN的包含以下各项，选择操作一般为验证码托管质询或者JS质询，在遭受严重攻击选择阻止。

(ip.geoip.asnum in {174 195 209 577 792 793 794 1215 1216 1217 2497 2914 3223 3255 3269 3326 3329 3457 3462 3598 4184 4190 4637 4694 4755 4785 4788 4816 4826 4835 5056 5610 5617 6471 6584 6830 6876 6877 6939 7029 7224 7303 7489 7552 7684 8068 8069 8070 8071 8074 8075 8100 8220 8560 8881 8987 9009 9299 9312 9370 9534 9678 9952 9984 10026 10453 11351 11426 11691 12076 12271 12334 12367 12874 12876 12989 14061 14117 14140 14576 14618 15169 16276 16509 16591 16629 17043 17428 17707 17788 17789 17790 17791 18013 18228 18403 18450 18599 18734 18978 19527 19740 20207 20473 20552 20554 20860 21704 21769 21859 21887 22773 22884 23468 23724 23885 23959 23969 24088 24192 24424 24429 24940 25429 25697 25820 25935 25961 26160 26496 26818 27715 28429 28431 28438 28725 29066 29286 29287 29802 30083 30823 31122 31235 31400 31898 32097 32098 32505 32613 34081 34248 34549 34947 35070 35212 35320 35540 35593 35804 35816 35908 35916 36351 36352 36384 36385 36444 36492 36806 37963 37969 38001 38197 38283 38365 38538 38587 38588 38627 39284 40065 40676 40788 41009 41096 41264 41378 42652 42905 43289 43624 43989 45011 45012 45062 45076 45085 45090 45102 45102 45102 45103 45104 45139 45458 45566 45576 45629 45753 45899 45932 46484 46844 47232 47285 47927 48024 48024 48337 48905 49327 49588 49981 50297 50340 50837 51852 52000 52228 52341 53089 54463 54538 54574 54600 54854 54994 55158 55330 55720 55799 55924 55933 55960 55967 55990 55992 56005 56011 56109 56222 57613 58073 58199 58461 58466 58519 58543 58563 58593 58772 58773 58774 58775 58776 58844 58854 58862 58879 59019 59028 59048 59050 59051 59052 59053 59054 59055 59067 59077 59374 60068 60592 60631 60798 61154 61317 61348 61577 61853 62044 62240 62468 62785 62904 63018 63023 63075 63288 63314 63545 63612 63620 63631 63655 63677 63678 63679 63727 63728 63729 63835 63838 63888 63916 63949 64050 131090 131106 131138 131139 131140 131141 131293 131428 131444 131477 131486 131495 132196 132203 132509 132510 132513 132591 132839 133024 133199 133380 133478 133492 133746 133752 133774 133775 133776 133905 133929 134238 134327 134760 134761 134763 134764 134769 134770 134771 134835 134963 135061 135290 135300 135330 135377 135629 137693 137697 137699 137753 137784 137785 137787 137788 137876 137969 138366 138407 138607 138915 138949 138950 138952 138982 138994 139007 139018 139124 139144 139201 139203 139220 139316 139327 139726 139887 140096 140596 140701 140716 140717 140720 140723 140979 141157 141180 142570 149167 177453 177549 197099 197540 198047 198651 199490 199506 199524 199883 200756 201094 201978 202053 202675 203087 204601 204720 206092 206204 206791 206798 207319 207400 207590 208425 208556 211914 212708 213251 213375 262187 263022 263196 263639 263693 264344 264509 265443 265537 266706 267784 269939 270110 328608 394699 395003 395936 395954 395973 398101 })

四、风险IP验证
利用威胁分数和IP列表的判断。前者是Cloudflare用来确定IP信誉的分数，范围由好到差评为0-100；后者由蜜罐等方式抓取，可以结合自己实际表现进行增减。
由于提供的IP列表数量较大，直接配置超过了防火墙规则的字符上限，因此需要通过管理账户-配置-列表-创建新列表创建一个包含高风险IP的列表（供导入的csv在下方），再在防火墙中直接匹配此列表。配置为IP源地址、在列表中以及威胁分数大于30。这一条由于覆盖范围较大误伤概率远高于上一条，选择操作建议为JS质询，在遭受攻击时再选择托管质询或阻止。

(ip.src in $badip) or (cf.threat_score gt 30)

风险IP CSV：点击下载

五、主机名细则
前面提到了通过and和or组合规则，对于一些杂项，可以通过主机名and去限定区间，这里推荐一些常用的匹配方式。

前三条内容与以上四个的组合可以很灵活地圈定范围，比如主机名+URL路径可以实现对特定目录、特定文件（比如登录页等）设置更高的验证要求。举个博主自己的例子，博主的静态资源所在目录会同步至海外源站，如下配置，就可以圈定php文件及不符合两个静态文件所在目录的访问，并阻止他们。类似的应用还有很多，可以多去思考和尝试~

这里也有前人总结的一些不友好的UA，对于阻止常见的扫描器等有一定的作用。这里没把它单独拿出来设置是博主觉得这是个防君子不防小人的做法，很容易绕过。在设置时，建议通过and组合主机名、http访问方式匹配，对全局开放的个人觉得意义不如前几个大，请自行结合实际去考量。

风险UA基础规则：

(http.user_agent contains "fuck") or (http.user_agent contains "lient" and http.user_agent contains "ttp") or (http.user_agent contains "java") or (http.user_agent contains "Joomla") or (http.user_agent contains "libweb") or (http.user_agent contains "libwww") or (http.user_agent contains "PHPCrawl") or (http.user_agent contains "PyCurl") or (http.user_agent contains "python") or (http.user_agent contains "wrk") or (http.user_agent contains "hey/") or (http.user_agent contains "Acunetix") or (http.user_agent contains "apache") or (http.user_agent contains "BackDoorBot") or (http.user_agent contains "cobion") or (http.user_agent contains "masscan") or (http.user_agent contains "FHscan") or (http.user_agent contains "scanbot") or (http.user_agent contains "Gscan") or (http.user_agent contains "Researchscan") or (http.user_agent contains "WPScan") or (http.user_agent contains "ScanAlert") or (http.user_agent contains "Wprecon") or (http.user_agent contains "virusdie") or (http.user_agent contains "VoidEYE") or (http.user_agent contains "WebShag") or (http.user_agent contains "Zeus") or (http.user_agent contains "zgrab") or (http.user_agent contains "zmap") or (http.user_agent contains "nmap") or (http.user_agent contains "fimap") or (http.user_agent contains "ZmEu") or (http.user_agent contains "ZumBot") or (http.user_agent contains "Zyborg") or (http.user_agent contains "attachment") or (http.user_agent eq "undefined") or (http.user_agent eq "")

风险UA其他规则：

(http.user_agent contains "Abonti") or (http.user_agent contains "admantx") or (http.user_agent contains "aipbot") or (http.user_agent contains "AllSubmitter") or (http.user_agent contains "Backlink") or (http.user_agent contains "backlink") or (http.user_agent contains "Badass") or (http.user_agent contains "Bigfoot") or (http.user_agent contains "blexbot") or (http.user_agent contains "Buddy") or (http.user_agent contains "CherryPicker") or (http.user_agent contains "cloudsystemnetwork") or (http.user_agent contains "cognitiveseo") or (http.user_agent contains "Collector") or (http.user_agent contains "cosmos") or (http.user_agent contains "CrazyWebCrawler") or (http.user_agent contains "Crescent") or (http.user_agent contains "Devil") or (http.user_agent contains "domain" and http.user_agent contains "spider") or (http.user_agent contains "domain" and http.user_agent contains "stat") or (http.user_agent contains "domain" and http.user_agent contains "Appender") or (http.user_agent contains "domain" and http.user_agent contains "Crawler") or (http.user_agent contains "DittoSpyder") or (http.user_agent contains "Konqueror") or (http.user_agent contains "Easou") or (http.user_agent contains "Yisou") or (http.user_agent contains "Etao") or (http.user_agent contains "mail" and http.user_agent contains "olf") or (http.user_agent contains "mail" and http.user_agent contains "spider") or (http.user_agent contains "exabot.com") or (http.user_agent contains "getintent") or (http.user_agent contains "Grabber") or (http.user_agent contains "GrabNet") or (http.user_agent contains "HEADMasterSEO") or (http.user_agent contains "heritrix") or (http.user_agent contains "htmlparser") or (http.user_agent contains "hubspot") or (http.user_agent contains "Jyxobot") or (http.user_agent contains "kraken") or (http.user_agent contains "larbin") or (http.user_agent contains "ltx71") or (http.user_agent contains "leiki") or (http.user_agent contains "LinkScan") or (http.user_agent contains "Magnet") or (http.user_agent contains "Mag-Net") or (http.user_agent contains "Mechanize") or (http.user_agent contains "MegaIndex") or (http.user_agent contains "Metasearch") or (http.user_agent contains "MJ12bot") or (http.user_agent contains "moz.com") or (http.user_agent contains "Navroad") or (http.user_agent contains "Netcraft") or (http.user_agent contains "niki-bot") or (http.user_agent contains "NimbleCrawler") or (http.user_agent contains "Nimbostratus") or (http.user_agent contains "Ninja") or (http.user_agent contains "Openfind") or (http.user_agent contains "Page" and http.user_agent contains "Analyzer") or (http.user_agent contains "Pixray") or (http.user_agent contains "probethenet") or (http.user_agent contains "proximic") or (http.user_agent contains "psbot") or (http.user_agent contains "RankActive") or (http.user_agent contains "RankingBot") or (http.user_agent contains "RankurBot") or (http.user_agent contains "Reaper") or (http.user_agent contains "SalesIntelligent") or (http.user_agent contains "Semrush") or (http.user_agent contains "SEOkicks") or (http.user_agent contains "spbot") or (http.user_agent contains "SEOstats") or (http.user_agent contains "Snapbot") or (http.user_agent contains "Stripper") or (http.user_agent contains "Siteimprove") or (http.user_agent contains "sitesell") or (http.user_agent contains "Siphon") or (http.user_agent contains "Sucker") or (http.user_agent contains "TenFourFox") or (http.user_agent contains "TurnitinBot") or (http.user_agent contains "trendiction") or (http.user_agent contains "twingly") or (http.user_agent contains "VidibleScraper") or (http.user_agent contains "WebLeacher") or (http.user_agent contains "WebmasterWorldForum") or (http.user_agent contains "webmeup") or (http.user_agent contains "Webster") or (http.user_agent contains "Widow") or (http.user_agent contains "Xaldon") or (http.user_agent contains "Xenu") or (http.user_agent contains "xtractor") or (http.user_agent contains "Zermelo") or (http.user_agent contains "Go-http-cilent")

六、速率限制
安全性→WAF→速率限制规则，创建一条速率限制规则，规则如下：

(http.request.uri.path contains "/")

则...
选择操作：阻止
收费版可以选择 托管质询

对于…
持续时间 （必需） 10秒
当速率超过…
请求 （必需）100
期间 （必需）10秒钟

七、其它设置
安全性→设置→安全级别设置为：高（这里不要打开I'm Under Attack!我受到攻击。）
质询通过期设置成：15分钟或者30分钟，严重可以设置5分钟
浏览器完整性检查：打开

安全性→DDOS→HTTP DDoS 攻击防护，点右边的配置进入
规则集操作（必填）设置为：托管质询或者直接阻止（建议在受到攻击时直接阻止）
规则集敏感度（必填）设置为：高

安全性→自动程序：打开自动程序攻击模式

★本文参考自以下项目，在此致谢~
Hostloc：@t9913085的规则分享和@欧阳逍遥的高风险IP列表
GitHub：Cloudflare Block Bad Bot Ruleset