Cloudflare WAF 实战模式指南托管规则集、自定义规则与速率限制的 Rulesets API 编排【免费下载链接】skillsSkills Catalog for Codex项目地址: https://gitcode.com/GitHub_Trending/skills4/skills本篇技术指南以 Cloudflare WAF 的六大高频实战模式为核心部署托管规则集Managed Rulesets、覆盖Override托管规则、编写自定义规则、配置速率限制、使用跳过规则Skip Rules以及三阶段组合的完整防护方案。文章基于仓库中 patterns.md 的示例并结合 api.md、configuration.md 与 gotchas.md 展开读者学完后可直接用 Cloudflare 官方 TypeScript SDK 落地一套从检测到缓解再到速率限制的完整 WAF 配置。前置准备凭证与运行环境在编写任何规则集代码之前先完成三件事创建 API Token在 Cloudflare Dashboard 的 Profile → API Tokens 页面创建权限至少包含Zone.WAF Edit或Zone.Firewall Services EditZone Resources 选择指定 Zone 或 All Zones。获取 Zone IDDashboard → Overview → API 区右侧边栏可找到当前域名对应的 Zone ID。安装 SDK 并设置环境变量npm install cloudflare export CF_API_TOKENyour_api_token_here export ZONE_IDyour_zone_id_hereSDK 初始化与规则集创建的统一入口如下完整初始化方式见 configuration.mdimport Cloudflare from cloudflare; const client new Cloudflare({ apiToken: process.env.CF_API_TOKEN });理解相位Phase与执行顺序一切模式的地基WAF 规则并非在单一管道中执行而是分属不同「相位」且相位执行顺序固定不可调整顺序相位用途1http_request_firewall_custom自定义规则第一道防线2http_request_firewall_managed托管规则集预配置防护3http_ratelimit速率限制请求节流4http_request_sbfmSuper Bot Fight ModePro 套餐相位内规则按从上到下顺序执行先匹配先命中first match wins除非命中skip动作。这一顺序决定了后续每个模式的编排逻辑——例如自定义相位中的 skip 规则可以跳过托管与速率限制相位反之则不行。关于相位与动作的兼容矩阵详见 api.md。模式一部署托管规则集Deploy Managed Rulesets托管规则集由 Cloudflare 维护覆盖 OWASP Top 10 与 CVE 类攻击。部署时使用action: execute通过action_parameters.id指定规则集 ID。三大内置托管规则集规则集名称ID覆盖范围Cloudflare Managedefb7b8c949ac4650a09736fc376e9aeeOWASP Top 10、CVEsOWASP Core Ruleset4814384a9e5d4991b9815dcfc25d2f1fOWASP ModSecurity CRSExposed Credentials Checkc2e184081120413c86c3ab7e14069605撞库Credential stuffing检测// Deploy Cloudflare Managed Ruleset (default) await client.rulesets.create({ zone_id: zone_id, kind: zone, phase: http_request_firewall_managed, name: Cloudflare Managed Ruleset, rules: [{ action: execute, action_parameters: { id: efb7b8c949ac4650a09736fc376e9aee, // Cloudflare Managed // Or: 4814384a9e5d4991b9815dcfc25d2f1f for OWASP CRS // Or: c2e184081120413c86c3ab7e14069605 for Exposed Credentials }, expression: true, // All requests // Or: http.request.uri.path starts_with /api for specific paths enabled: true, }], });关键参数说明expression: true表示命中所有请求如需只保护/api路径可替换为http.request.uri.path starts_with /api。kind: zone表示 Zone 级规则集而非账户级。从源码结构看该模式正是 README.md Quick Start 中「Deploy Cloudflare Managed Ruleset」示例的完整形态execute动作只能出现在http_request_firewall_managed相位。模式二覆盖托管规则集Override Managed Ruleset托管规则集默认动作可能过严或过松覆盖Override允许在execute时按**单条规则rules或类别categories**调整行为无需改动托管规则集本身await client.rulesets.create({ zone_id: zone_id, phase: http_request_firewall_managed, rules: [{ action: execute, action_parameters: { id: efb7b8c949ac4650a09736fc376e9aee, overrides: { // Override specific rules rules: [ { id: 5de7edfa648c4d6891dc3e7f84534ffa, action: log }, { id: 75a0060762034b9dad4e883afc121b4c, enabled: false }, ], // Override categories: wordpress, sqli, xss, rce, etc. categories: [ { category: wordpress, enabled: false }, { category: sqli, action: log }, ], }, }, expression: true, }], });两点实战提示规则 ID 从哪来可通过client.rulesets.get({ zone_id, ruleset_id: efb7b8c949ac4650a09736fc376e9aee })拉取托管规则集全部规则再映射出id与description避免覆盖到不存在的规则对应 gotchas.md 中「Override Conflicts」一节。误报治理的标准流程先用overrides: { action: log }全量观察 → 在 Security Events 中甄别误报 → 再对具体规则/类别做精准覆盖。模式三自定义规则Custom Rules自定义规则位于http_request_firewall_custom相位是攻击评分散发与地理封锁的主战场。表达式采用 Wirefilter 语法可组合攻击评分、攻击类型子分数与地理位置await client.rulesets.create({ zone_id: zone_id, kind: zone, phase: http_request_firewall_custom, name: Custom WAF Rules, rules: [ // Attack score-based { action: block, expression: cf.waf.score gt 50, enabled: true }, { action: challenge, expression: cf.waf.score gt 20, enabled: true }, // Specific attack types { action: block, expression: cf.waf.score.sqli gt 30 or cf.waf.score.xss gt 30, enabled: true }, // Geographic blocking { action: block, expression: ip.geoip.country in {CN RU}, enabled: true }, ], });常用字段速查详见 api.md字段含义cf.waf.score0–100 综合攻击评分cf.waf.score.sqli/cf.waf.score.xssSQL 注入 / XSS 子评分ip.src/ip.geoip.country/ip.geoip.continent来源 IP / 国家 / 大洲http.request.uri.path/http.request.method请求路径 / 方法注意in集合语法中字符串必须加引号如{CN RU}比较运算符使用gt、lt而非、。自定义相位支持的动作包括block、challenge、js_challenge、managed_challenge、log、skip其中managed_challenge是推荐的智能挑战。模式四速率限制Rate Limiting速率限制在http_ratelimit相位配置核心在action_parameters.ratelimit的四个维度特征characteristics、窗口period、阈值requests_per_period、封禁时长mitigation_timeoutawait client.rulesets.create({ zone_id: zone_id, kind: zone, phase: http_ratelimit, name: Rate Limits, rules: [ // Per-IP global limit { action: block, expression: true, action_parameters: { ratelimit: { characteristics: [cf.colo.id, ip.src], period: 60, requests_per_period: 100, mitigation_timeout: 600, }, }, }, // Login endpoint (stricter) { action: block, expression: http.request.uri.path eq /api/login, action_parameters: { ratelimit: { characteristics: [ip.src], period: 60, requests_per_period: 5, mitigation_timeout: 600, }, }, }, // API writes only (using counting_expression) { action: block, expression: http.request.uri.path starts_with /api, action_parameters: { ratelimit: { characteristics: [cf.colo.id, ip.src], period: 60, requests_per_period: 50, counting_expression: http.request.method ne GET, }, }, }, ], });参数深入说明characteristics定义「唯一性」维度推荐[cf.colo.id, ip.src]按数据中心 IP 计数还可使用http.request.headers[key][0]、http.request.cookies[session][0]等自定义特征。counting_expression可选只对符合条件的请求计数如示例中仅统计非 GET 请求让读操作不受限、写操作受限。若用户处于 NAT 后共享同一 IP容易被误伤可加入 User-Agent、session cookie 或 authorization header 作为额外特征。速率限制的计数发生在缓解动作之前见 gotchas.md「Rate Limiting NAT Issues」。模式五跳过规则Skip Rules跳过规则用于豁免某些流量有两种作用域务必区分await client.rulesets.create({ zone_id: zone_id, kind: zone, phase: http_request_firewall_custom, name: Skip Rules, rules: [ // Skip static assets (current ruleset only) { action: skip, action_parameters: { ruleset: current }, expression: http.request.uri.path matches \\.(jpg|css|js|woff2?)$, }, // Skip all WAF phases for trusted IPs { action: skip, action_parameters: { phases: [http_request_firewall_managed, http_ratelimit], }, expression: ip.src in {192.0.2.0/24}, }, ], });ruleset: current仅跳过当前规则集内剩余的规则。一个常见误区是「在自定义相位用ruleset: current试图跳过托管规则」这不会生效——它只跳过当前规则集自身的剩余规则。phases: [...]完整跳过指定相位。如上例中可信 IP 网段192.0.2.0/24将跳过托管规则集与速率限制相位。跳过规则受相位顺序约束自定义相位中的 skip 可以跳过托管/速率限制相位反之则不行。完整组合示例三阶段分层防护将三个阶段按执行顺序组合即可获得完整防护。自定义规则先执行放行可信 IP、拦截高分攻击、挑战中等分数随后托管规则集兜底禁用 wordpress 类别减少误报最后速率限制收尾const client new Cloudflare({ apiToken: process.env.CF_API_TOKEN }); const zoneId process.env.ZONE_ID; // 1. Custom rules (execute first) await client.rulesets.create({ zone_id: zoneId, phase: http_request_firewall_custom, rules: [ { action: skip, action_parameters: { phases: [http_request_firewall_managed, http_ratelimit] }, expression: ip.src in {192.0.2.0/24} }, { action: block, expression: cf.waf.score gt 50 }, { action: managed_challenge, expression: cf.waf.score gt 20 }, ], }); // 2. Managed ruleset (execute second) await client.rulesets.create({ zone_id: zoneId, phase: http_request_firewall_managed, rules: [{ action: execute, action_parameters: { id: efb7b8c949ac4650a09736fc376e9aee, overrides: { categories: [{ category: wordpress, enabled: false }] } }, expression: true, }], }); // 3. Rate limiting (execute third) await client.rulesets.create({ zone_id: zoneId, phase: http_ratelimit, rules: [ { action: block, expression: true, action_parameters: { ratelimit: { characteristics: [cf.colo.id, ip.src], period: 60, requests_per_period: 100, mitigation_timeout: 600 } } }, { action: block, expression: http.request.uri.path eq /api/login, action_parameters: { ratelimit: { characteristics: [ip.src], period: 60, requests_per_period: 5, mitigation_timeout: 600 } } }, ], });分层设计要点skip 规则必须排在自定义规则集最前否则可信 IP 会被后续的 block 规则拦截managed_challenge介于 block 与放行之间适合用于评分中等20–50的灰色流量。高频陷阱与调优建议以下问题与对策提炼自 gotchas.md是上述模式落地时最常踩的坑更新即整体替换client.rulesets.update()会用传入的rules数组整体替换原规则列表。正确做法是先get现有规则再合并新规则后update否则会静默删除其他规则。表达式常见错误http.request.path→ 应为http.request.uri.pathip.geoip.country eq US→ 字符串必须加引号US大小写敏感场景用lower(http.user_agent) contains mozilla而非eq Mozilla正则须合法且转义如matches .*\\.jpg$。动作与相位不匹配execute只允许在托管相位skip不允许在http_ratelimit相位速率限制配置只属于http_ratelimit。混用会触发 Action not supported 或 Invalid phase。性能优化优先对静态资源使用 skip托管规则集按路径裁剪如仅/api、/admin禁用无用类别如wordpress用starts_with/contains等字符串算子替代matches正则算子。配额与套餐限制参考资源FreeProBusinessEnterprise自定义规则数5201001000速率限制规则数11025100规则表达式长度4096409640964096每规则集规则数75754001000托管规则集支持支持支持支持速率限制特征数2355上述限制来自 gotchas.md「Limits Quotas」一节规划规则数量时应按目标套餐预留余量。进一步阅读waf/README.mdWAF 能力总览与快速上手waf/api.mdSDK 方法、动作/相位矩阵、完整表达式语法waf/configuration.mdTerraform、Pulumi、Dashboard 与 Wrangler 的等价配置方式waf/gotchas.md执行顺序、跳过作用域、更新语义与 API 报错排查SKILL.mdcloudflare-deploy 技能的整体定位与产品决策树安全场景入口为 waf/【免费下载链接】skillsSkills Catalog for Codex项目地址: https://gitcode.com/GitHub_Trending/skills4/skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考