跳转到内容
搜索文档
↵选择
↑↓导航
ESC关闭

推荐的 DNS 策略

最后更新 查看 MarkdownAgent 设置

我们建议你添加以下 DNS 策略，为你的组织构建互联网和 SaaS 应用程序安全策略。

有关其他常用的 DNS 策略示例，请参阅常用 DNS 策略。有关构建 DNS 策略的更多信息，请参阅 DNS 策略。

All-DNS-Domain-Allowlist（全部 DNS：域名允许列表）

允许列表化任何已知的域名和主机名。借助此策略，你可以确保用户能够访问你组织的域名，即使这些域名属于被拦截的类别（如 Newly Seen Domains（新出现的域名） 或 Login Screens（登录屏幕））。

选择器 运算符 值 逻辑 操作
Domain（域名） in list（在列表中） Known Domains Or（或） Allow（允许）
Host（主机） in list（在列表中） Known Domains
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-Domain-Allowlist",
		"description": "将任何已知域名和主机名加入允许列表",
		"precedence": 0,
		"enabled": true,
		"action": "allow",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>) or dns.fqdn in $<KNOWN_DOMAINS_LIST_UUID>"
	}'
resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-Domain-Allowlist"
  description = "将任何已知域名和主机名加入允许列表"
  precedence  = 0
  enabled     = true
  action      = "allow"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}) or dns.fqdn in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}"
}

Quarantined-Users-DNS-Restricted-Access（隔离用户：DNS 受限访问）

为包含在风险用户身份提供商（IdP）用户组中的用户限制访问。该策略可确保您的安全团队能够限制被检测到存在恶意或可疑活动的用户流量。

选择器 运算符 值 逻辑 操作
Domain（域名） not in list（不在列表中） Allowed Remediation Domains Or（或） Block（阻止）
Host（主机） not in list（不在列表中） Allowed Remediation Domains And（且）
User Group Names（用户组名称） in Quarantined Users
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Quarantined-Users-DNS-Restricted-Access",
		"description": "限制 IdP 风险用户组中包含的用户的访问权限",
		"precedence": 10,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "not(any(dns.domains[] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>)) or not(any(dns.domains[] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>))",
		"identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" {
  account_id  = var.cloudflare_account_id
  name        = "Quarantined-Users-DNS-Restricted-Access"
  description = "限制 IdP 风险用户组中包含的用户的访问权限"
  precedence  = 10
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id})) or not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id}))"
	identity		=	"any(identity.groups.name[*] in {\"Quarantined Users\"})"
}

All-DNS-SecurityCategories-Blocklist（全部 DNS：安全类别阻止列表）

根据 Cloudflare 的威胁情报，拦截安全类别，例如 Command and Control & Botnet 和 Malware。

选择器 运算符 值 操作
安全类别 (Security Categories) in 所有安全风险 (All security risks) 阻止 (Block)
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-SecurityCategories-Blocklist",
		"description": "Block security categories based on Cloudflare'\''s threat intelligence",
		"precedence": 20,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
		"identity": ""
	}'
resource "cloudflare_zero_trust_gateway_policy" "block_security_threats" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-SecurityCategories-Blocklist"
  description = "Block security categories based on Cloudflare's threat intelligence"
  precedence  = 20
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
}

All-DNS-ContentCategories-Blocklist（全部 DNS：内容类别阻止列表）

安全风险内容子类别中的条目（例如 New Domains）并不总是构成安全威胁。我们建议您首先创建一条 Allow 策略以跟踪策略匹配情况并识别任何误报。您可以将误报添加到在 All-DNS-Domain-Allowlist 中使用的 Trusted Domains 列表中。

测试完成后，我们建议您将操作更改为 Block，以最大程度地降低您组织的风险。

选择器 运算符 值 操作
内容类别 (Content Categories) in（属于） 可疑内容 (Questionable Content)、安全风险 (Security Risks)、杂项 (Miscellaneous) 阻止 (Block)
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-ContentCategories-Blocklist",
		"description": "Block common content categories that may pose a risk",
		"precedence": 30,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})",
		"identity": ""
	}'
resource "cloudflare_zero_trust_gateway_policy" "block_content_categories" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-ContentCategories-Blocklist"
  description = "Block common content categories that may pose a risk"
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})"
  identity    = ""
}

All-DNS-Application-Blocklist（全部 DNS：应用程序阻止列表）

阻止未授权的应用程序，以限制用户对某些基于 Web 的工具的访问，并尽量降低 影子 IT（shadow IT）的风险。例如，以下策略会阻止已知的 AI 工具：

选择器 运算符 值 操作
应用程序 (Application) in（属于） 人工智能 (Artificial Intelligence) 阻止 (Block)
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-Application-Blocklist",
		"description": "Block access to unauthorized AI applications",
		"precedence": 40,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(app.type.ids[*] in {25})",
		"identity": ""
	}'
resource "cloudflare_zero_trust_gateway_policy" "block_unauthorized_apps" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-Application-Blocklist"
  description = "Block access to unauthorized AI applications"
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(app.type.ids[*] in {25})"
  identity    = ""
}

All-DNS-GeoCountryIP-Blocklist（全部 DNS：国家/地区 IP 阻止列表）

阻断在被归类为高风险国家/地区托管的网站。此类国家/地区的分类可能是由于你组织的用户情况，或者通过实施包括 EAR ↗、OFAC ↗ 和 ITAR ↗ 在内的法规所致。

选择器 运算符 值 操作
Resolved Country IP Geolocation in Afghanistan, Belarus, Congo (Kinshasa), Cuba, Iran, Iraq, Korea (North), Myanmar, Russian Federation, Sudan, Syria, Ukraine, Zimbabwe Block（阻止）
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-GeoCountryIP-Blocklist",
		"description": "阻止托管在被归类为高安全风险国家/地区的流量",
		"precedence": 50,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "dns_geolocation_block_policy" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-GeoCountryIP-Blocklist"
  description = "阻止托管在被归类为高安全风险国家/地区的流量"
  precedence  = 50
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})"
}

All-DNS-DomainTopLevel-Blocklist（全部 DNS：顶级域阻止列表）

阻断频繁被滥用的顶级域名 (TLD) 以减少安全风险，特别是当允许访问无法带来可察觉的好处时。类似地，可能需要限制对特定国家/地区级 TLD 的访问，以符合 OFAC ↗ 和 ITAR ↗ 等法规。

选择器 运算符 值 操作
Domain（域名） matches regex（匹配正则） [.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$ Block（阻止）
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-DomainTopLevel-Blocklist",
		"description": "阻止已知风险 TLD 的 DNS 查询",
		"precedence": 60,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.domains[*] matches \".$ or .$ or .$\")"
	}'
resource "cloudflare_zero_trust_gateway_policy" "dns_blacklist_policy" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-DomainTopLevel-Blocklist"
  description = "阻止已知风险 TLD 的 DNS 查询"
  precedence  = 60
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")"
}

All-DNS-DomainPhishing-Blocklist（全部 DNS：钓鱼域名阻止列表）

阻断被滥用的域名，以保护你的用户免受复杂的钓鱼攻击，例如专门针对你组织的域名。例如，以下策略阻断与组织或其身份验证服务关联的特定关键字（如 okta、2fa、cloudflare 和 sso），同时仍然允许访问已知域名。

选择器 运算符 值 逻辑 操作
Domain（域名） not in list Known Domains And（且） Block（阻止）
Domain（域名） matches regex（匹配正则） .*okta.*|.*cloudflare.*|.*mfa.*|.sso.*
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-DomainPhishing-Blocklist",
		"description": "阻止钓鱼活动中滥用的域名",
		"precedence": 70,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.domains[] matches \".okta.|.cloudflare.|.mfa.|.sso.\") and not(any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>))"
	}'
resource "cloudflare_zero_trust_gateway_policy" "dns_phishing_domains_block" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-DomainPhishing-Blocklist"
  description = "阻止钓鱼活动中滥用的域名"
  precedence  = 70
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.known_phishing_domains_list.id}))"
}

All-DNS-ResolvedIP-Blocklist（全部 DNS：已解析 IP 阻止列表）

阻断属于恶意或对你的组织构成威胁的特定 IP 地址。

您可以通过创建自定义阻止列表，或使用威胁情报合作伙伴或区域计算机应急响应小组（CERT）提供的阻止列表来实现此策略。理想情况下，您的 CERT 可以通过 API 自动化来更新阻止列表，以提供实时威胁防护。

选择器 运算符 值 操作
Resolved IP（已解析 IP） in list（在列表中） IP Blocklist Block（阻止）
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-ResolvedIP-Blocklist",
		"description": "阻止被视为对组织有风险的特定 IP 地址",
		"precedence": 80,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.resolved_ips[*] in $<IP_BLOCKLIST_UUID>)"
	}'
resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-ResolvedIP-Blocklist"
  description = "阻止被视为对组织有风险的特定 IP 地址"
  precedence  = 80
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.resolved_ips[*] in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id}"
}

All-DNS-DomainHost-Blocklist（全部 DNS：域名/主机阻止列表）

阻止恶意或对您的组织构成威胁的特定域或主机。与 All-DNS-ResolvedIP-Blocklist 类似，此阻止列表可以手动更新，也可以通过 API 自动化进行更新。

选择器 运算符 值 逻辑 操作
Domain（域名） in list Domain Blocklist Or（或） Block（阻止）
Host（主机） in list Host Blocklist Or（或）
Host（主机） matches regex（匹配正则） .*example\.com
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-DNS-DomainHost-Blocklist",
		"description": "阻止对你的组织具有恶意或构成威胁的特定域名或主机。",
		"precedence": 90,
		"enabled": true,
		"action": "block",
		"filters": [
				"dns"
		],
		"traffic": "any(dns.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) and dns.fqdn in $<HOST_BLOCKLIST_UUID> and dns.fqdn matches \".*example.com\""
	}'
resource "cloudflare_zero_trust_gateway_policy" "block_dns_domain_host" {
  account_id  = var.cloudflare_account_id
  name        = "All-DNS-DomainHost-Blocklist"
  description = "阻止对你的组织具有恶意或构成威胁的特定域名或主机。"
  precedence  = 90
  enabled     = true
  action      = "block"
  filters     = ["dns"]
  traffic     = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_blocklist.id}) and dns.fqdn in ${"$"}${cloudflare_zero_trust_list.host_blocklist.id} and dns.fqdn matches \".*example\\.com\""
}

这篇文档对您有帮助吗？