保护你的第一个应用程序

为了确保全面的安全防范，我们建议至少使用两条策略保护每个不同的私有应用程序：

一条带有适当身份和设备姿态值的 Gateway DNS 策略，针对定义你的应用程序的域名列表。策略强制执行发生在请求解析事件时，即在用户的设备向应用程序本身发起连接请求之前；如果在此处被拒绝，任何流量都不会到达你的私有网络。
一条带有与 DNS 策略相同的身份和设备姿态值的 Gateway 网络策略，针对定义你的应用程序的 IP 列表。你可以选择通过匹配 SNI 标头来包含域名列表。然后，你可以包含与应用程序访问相关的任何端口或协议组合。网络策略强制执行发生在用户通过 DNS 策略之后、当用户的设备尝试连接到目标应用程序时。

创建 Gateway 策略

要创建新策略，请打开 Cloudflare 仪表板 ↗ 并转到 Zero Trust > Traffic policies（流量策略） > Firewall policies（防火墙策略）。

示例 DNS 策略

Traffic Selector（流量选择器）	Operator（运算符）	Value（值）
Domain（域名）	in list	`Company Wiki domains`

Identity Selector	Operator	Value
User email（用户电子邮件）	matches regex	`.*@example.com`

Action（操作）
Allow（允许）

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--header "Content-Type: application/json" \
--data '{
  "name": "Company Wiki DNS policy",
  "conditions": [
    {
      "type": "traffic",
      "expression": {
        "any": {
          "in": {
            "lhs": {
              "splat": "dns.domains"
            },
            "rhs": "$<DOMAIN_LIST_ID>"
          }
        }
      }
    },
    {
      "type": "identity",
      "expression": {
        "matches": {
          "lhs": "identity.email",
          "rhs": ".*@example.com"
        }
      }
    }
  ],
  "action": "allow",
  "precedence": 13002,
  "enabled": true,
  "description": "Allow employees to access company wiki domains.",
  "filters": [
    "dns"
  ]
}'

resource "cloudflare_zero_trust_gateway_policy" "dns_allow_wiki_domains" {
	name        = "Company Wiki DNS policy"
	enabled     = true
	account_id  = var.cloudflare_account_id
	description = "Managed by Terraform - Allow employees to access company wiki domains."
	precedence  = 102
	action      = "allow"
	filters     = ["dns"]
	traffic     = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.wiki_domains.id})"
	identity    = "identity.email matches \".*@example.com\""
}

示例网络策略

Traffic Selector（流量选择器）	Operator（运算符）	Value（值）
Destination IP（目标 IP）	in list	`Company Wiki IPs`

Identity Selector	Operator	Value
User Email（用户电子邮件）	matches regex	`.*@example.com`

Action（操作）
Allow（允许）

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--header "Content-Type: application/json" \
--data '{
  "name": "Company Wiki network policy",
  "conditions": [
    {
      "type": "traffic",
      "expression": {
        "in": {
          "lhs": "net.dst.ip",
          "rhs": "$<IP_LIST_ID>"
        }
      }
    },
    {
      "type": "identity",
      "expression": {
        "matches": {
          "lhs": "identity.email",
          "rhs": ".*@example.com"
        }
      }
    }
  ],
  "action": "allow",
  "precedence": 13002,
  "enabled": true,
  "description": "Allow employees to access company wiki IPs.",
  "filters": [
    "l4"
  ]
}'

resource "cloudflare_zero_trust_gateway_policy" "network_allow_wiki_IPs" {
	name        = "Company Wiki Network policy"
	enabled     = true
	account_id  = var.cloudflare_account_id
	description = "Managed by Terraform - Allow employees to access company wiki IPs."
	precedence  = 103
	action      = "allow"
	filters     = ["l4"]
	traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.wiki_IPs.id}"
	identity    = "identity.email matches \".*@example.com\""
}

通配/兜底策略 (Catch-all policy)

我们建议在网络策略列表的最底部添加一条兜底策略。有效的 Zero Trust 模型应优先考虑默认拒绝规则，以避免构建过于宽松的策略。例如：

Traffic Selector（流量选择器）	Operator（运算符）	Value（值）	Logic（逻辑）
Destination IP（目标 IP）	in list	`All private network ranges`	Or（或）
SNI Domain（SNI 域名）	in list	`All private apex domains`

Action（操作）
Block（阻止）

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--header "Content-Type: application/json" \
--data '{
  "name": "Catch-all block policy",
  "conditions": [
    {
      "type": "traffic",
      "expression": {
        "or": [
          {
            "in": {
              "lhs": "net.dst.ip",
              "rhs": "$<IP_LIST_ID>"
            }
          },
          {
            "any": {
              "in": {
                "lhs": {
                  "splat": "net.sni.domains"
                },
                "rhs": "$<DOMAIN_LIST_ID>"
              }
            }
          }
        ]
      }
    }
  ],
  "action": "block",
  "precedence": 14002,
  "enabled": true,
  "description": "Block access to private network.",
  "filters": [
    "l4"
  ]
}'

resource "cloudflare_zero_trust_gateway_policy" "network_catch_all" {
  name        = "Catch-all block policy"
  enabled     = true
  account_id  = var.cloudflare_account_id
  description = "Managed by Terraform - Block access to private network."
  precedence  = 14002
  action      = "block"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.private_IPs.id} or any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.private_domains.id})"
}

网络策略按自上而下的顺序进行评估，因此如果用户不匹配显式定义的应用程序策略，他们将被阻断。要了解多条策略如何相互协同作用，请参阅执行顺序。