2

how does the order of Cloudflare rules work? I read the documentation but doesn't explain it (it's self explanatory apparently) but is it?

For example if i want to block a ASN but allow an IP inside of it, what order should i use?

ORDER A:

Rule 1: Block ASN
Rule 2: Allow IP

ORDER B:

Rule 1: Allow IP
Rule 2: Block ASN
  • Does it stop after the first matching rule? So solution is B.

Or

  • Does it check all rules and THEN blocks? If so, solution is A.

I think this is very vital information to know.

Michael Rogers
  • 60
  • 1
  • 3
  • 16

1 Answers1

3

It depends ...

By default, Cloudflare evaluates firewall rules in list order, where rules are evaluated in the order they appear in the Rules List.
…
Once there are more than 200 total rules (including inactive rules), you must manage evaluation using priority ordering, in which Cloudflare evaluates firewall rules in order of their priority number, starting with the lowest.
…

Source: https://developers.cloudflare.com/firewall/cf-dashboard/create-edit-delete-rules/

When a http request gets evaluated in list order and the request matches an expression the associated action determines what happens next.

Most actions are an exit and no further firewall rules will be evaluated for that request. You would describe this also as ”first match”

When ”priority ordering” is used there can be multiple expressions with the same priority, they will all be evaluated and a http request can match several expressions concurrently.
Then the precedence of the action determines what will happen. The allow action has precedence over the block action.

Again after a match most actions are an exit and no further firewall rules of lower priority will be evaluated for that request.

https://developers.cloudflare.com/firewall/cf-firewall-rules/actions/

———

In list ordering

Rule 1: Block ASN
Rule 2: Allow IP

The request from IP will match rule 1 and the request will be blocked. Rule 2 will not be evaluated.
To exempt the IP the rule order needs to be reversed.

On the other hand in priority ordering:

Priority 2 : Rule 1: Block ASN
Priority 2 : Rule 2: Allow IP

The request from IP matches both rules. The Allow action has greater precedence than the Block action and thus the request will be allowed.

Bob
  • 5,805
  • 7
  • 25
  • Thanks i'm using list order. – Michael Rogers Apr 02 '21 at 09:15
  • Yes, I can confirm. Using Cloudflare free there are 5 rules available and they can be ordered. I was blocking all countries except a few with a firewall rule. Then I wanted to allow the IPs of my uptime monitoring service (which doesn't operate from one of my allowed countries). Having that *Allow* rule above the *Block* rule, ensured the uptime monitoring continued to work, while blocking all traffic from outside the few countries I wanted to. – Dvaeer Dec 09 '21 at 15:22