推荐的 HTTP 策略

我们建议你添加以下 HTTP 策略，为你的组织构建互联网和 SaaS 应用程序安全策略。

有关其他常用的 HTTP 策略示例，请参阅常用 HTTP 策略。有关构建 HTTP 策略的更多信息，请参阅 HTTP 策略。

All-HTTP-Application-InspectBypass（全部 HTTP：应用程序检查绕过）

为使用嵌入式证书的应用程序绕过 HTTP 检查。这将有助于避免首次推出时可能产生的任何证书固定 (Certificate pinning) 错误。

选择器	运算符	值	操作
应用程序 (Application)	in	不检测 (Do Not Inspect)	不检测 (Do Not Inspect)

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Application-InspectBypass",
		"description": "绕过使用嵌入式证书的应用程序的 HTTP 检查",
		"precedence": 0,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(app.type.ids[*] in {16})"
	}'

resource "cloudflare_zero_trust_gateway_policy" "all_http_application_inspect_bypass" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-Application-InspectBypass"
  description = "绕过使用嵌入式证书的应用程序的 HTTP 检查"
  precedence  = 0
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "any(app.type.ids[*] in {16})"
}

Android-HTTP-Application-InspectionBypass（Android HTTP：应用程序检查绕过）

为使用证书固定的 Android 应用程序（如 Google Drive）绕过 HTTPS 检查，这与 Gateway 检查不兼容。

选择器	运算符	值	逻辑	操作
Application（应用程序）	in	Google Drive	And（且）	Do Not Inspect（不检测）
Passed Device Posture Checks（已通过的设备状况检查）	in	OS Version Android (OS version)

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Android-HTTP-Application-InspectionBypass",
		"description": "绕过启用证书固定的 Android 应用程序的 HTTPS 检查",
		"precedence": 10,
		"enabled": true,
		"action": "off",
		"filters": [
				"http"
		],
		"traffic": "any(app.ids[] in {554})",
		"device_posture": "any(device_posture.checks.passed[] in {\"<ANDROID_VERSION_POSTURE_CHECK_UUID >\"})"
	}'

resource "cloudflare_zero_trust_gateway_policy" "android_http_application_inspection_bypass" {
  account_id  = var.cloudflare_account_id
  name        = "Android-HTTP-Application-InspectionBypass"
  description = "绕过启用证书固定的 Android 应用程序的 HTTPS 检查"
  precedence  = 10
  enabled     = true
  action      = "off"
  filters     = ["http"]
  traffic     = "any(app.ids[*] in {554})"
  device_posture = "any(device_posture.checks.passed[*] in {\"${"$"}{cloudflare_zero_trust_list.android_version_posture_check.id}\"})"
}

All-HTTP-Domain-Inspection-Bypass（全部 HTTP：域名检查绕过）

为被确定与 TLS 检查不兼容的自定义域名列表绕过 HTTP 检查。

选择器	运算符	值	逻辑	操作
Domain（域名）	in list（在列表中）	DomainInspectionBypass	Or（或）	Do Not Inspect（不检测）
Domain（域名）	in list（在列表中）	Known Domains

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Domain-Inspection-Bypass",
		"description": "绕过已识别为与 TLS 检查不兼容的自定义域名列表的 HTTP 检查",
		"precedence": 20,
		"enabled": true,
		"action": "off",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.domains[*] in $<DOMAIN_INSPECTION_BYPASS_LIST_UUID>) or any(http.request.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>)"
	}'

resource "cloudflare_zero_trust_gateway_policy" "android_http_application_inspection_bypass" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-Domain-Inspection-Bypass"
  description = "绕过已识别为与 TLS 检查不兼容的自定义域名列表的 HTTP 检查"
  precedence  = 20
  enabled     = true
  action      = "off"
  filters     = ["http"]
  traffic     = "any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_inspection_bypass_list.id}) or any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.known_domains_list.id})"
}

All-HTTP-SecurityRisks-Blocklist（全部 HTTP：安全风险阻止列表）

根据 Cloudflare 的威胁情报，拦截安全类别，例如 Command and Control & Botnet 和 Malware。

选择器	运算符	值	操作
Security Categories（安全类别）	in	All security risks	Block（阻止）

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-SecurityRisks-Blocklist",
		"description": "基于 Cloudflare 威胁情报阻止安全类别",
		"precedence": 30,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
	}'

resource "cloudflare_zero_trust_gateway_policy" "all_http_security_risks_blocklist" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-SecurityRisks-Blocklist"
  description = "基于 Cloudflare 威胁情报阻止安全类别"
  precedence  = 30
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
}

All-HTTP-ContentCategories-Blocklist（全部 HTTP：内容类别阻止列表）

安全风险内容子类别中的条目（例如 New Domains）并不总是构成安全威胁。我们建议您首先创建一条 Allow 策略以跟踪策略匹配情况并识别任何误报。您可以将误报添加到在 All-HTTP-Domain-Allowlist 中使用的 Trusted Domains 列表中。

测试完成后，我们建议您将操作更改为 Block，以最大程度地降低您组织的风险。

选择器	运算符	值	操作
内容类别 (Content Categories)	in（属于）	可疑内容 (Questionable Content)、安全风险 (Security Risks)、杂项 (Miscellaneous)、成人主题 (Adult Themes)、赌博 (Gambling)	阻止 (Block)

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-ContentCategories-Blocklist",
		"description": "Block access to questionable content and potential security risks",
		"precedence": 40,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})",
		"identity": "",
		"device_posture": ""
	}'

resource "cloudflare_zero_trust_gateway_policy" "block_unauthorized_apps" {
  account_id     = var.cloudflare_account_id
  name           = "All-HTTP-ContentCategories-Blocklist"
  description    = "Block access to questionable content and potential security risks"
  precedence     = 40
  enabled        = true
  action         = "block"
  filters        = ["http"]
  traffic        = "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})"
  identity       = ""
  device_posture = ""
}

All-HTTP-DomainHost-Blocklist（全部 HTTP：域名/主机阻止列表）

阻止恶意或对您的组织构成威胁的特定域或主机。与 All-HTTP-ResolvedIP-Blocklist 类似，此阻止列表可以手动更新，也可以通过 API 自动化进行更新。

选择器	运算符	值	逻辑	操作
Domain（域名）	in list	Domain Blocklist	Or（或）	Block（阻止）
Host（主机）	in list	Host Blocklist	Or（或）
Host（主机）	matches regex（匹配正则）	`.*example\.com`

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-DomainHost-Blocklist",
		"description": "阻止对你的组织具有恶意或构成威胁的特定域名或主机",
		"precedence": 50,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) or http.request.host in $<HOST_BLOCKLIST_UUID> or http.request.host matches \".*example.com\""
	}'

resource "cloudflare_zero_trust_gateway_policy" "all_http_domainhost_blocklist" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-DomainHost-Blocklist"
  description = "阻止对你的组织具有恶意或构成威胁的特定域名或主机"
  precedence  = 50
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_blocklist.id}) or http.request.host in ${"$"}{cloudflare_zero_trust_list.host_blocklist.id} or http.request.host matches \".*example\\.com\""
}

All-HTTP-Application-Blocklist（全部 HTTP：应用程序阻止列表）

阻止未授权的应用程序，以限制用户对某些基于 Web 的工具的访问，并尽量降低影子 IT（shadow IT）的风险。例如，以下策略会阻止已知的 AI 工具：

选择器	运算符	值	操作
应用程序 (Application)	in（属于）	人工智能 (Artificial Intelligence)	阻止 (Block)

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Application-Blocklist",
		"description": "Limit access to shadow IT by blocking web-based tools and applications",
		"precedence": 60,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(app.type.ids[*] in {25})",
		"identity": "",
		"device_posture": ""
	}'

resource "cloudflare_zero_trust_gateway_policy" "all_http_application_blocklist" {
  account_id     = var.cloudflare_account_id
  name           = "All-HTTP-Application-Blocklist"
  description    = "Limit access to shadow IT by blocking web-based tools and applications"
  precedence     = 60
  enabled        = true
  action         = "block"
  filters        = ["http"]
  traffic        = "any(app.type.ids[*] in {25})"
  identity       = ""
  device_posture = ""
}

PrivilegedUsers-HTTP-Any-Isolate（特权用户：HTTP 隔离）

为定期访问关键系统或执行威胁分析和恶意软件测试等操作的特权用户隔离流量。

安全团队经常需要执行可能触发恶意软件检测的威胁分析或恶意软件测试。同样，特权用户可能是尝试获取关键系统访问权限的攻击者的目标。

选择器	运算符	值	操作
User Group Names（用户组名称）	in	Privileged Users	Isolate（隔离）

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "PrivilegedUsers-HTTP-Any-Isolate",
		"description": "隔离经常访问关键或测试系统的特权用户的流量",
		"precedence": 70,
		"enabled": true,
		"action": "isolate",
		"filters": [
				"http"
		],
		"identity": "any(identity.groups.name[*] in {\"Privileged Users\"})"
	}'

resource "cloudflare_zero_trust_gateway_policy" "privileged_users_http_any_isolate" {
  account_id  = var.cloudflare_account_id
  name        = "PrivilegedUsers-HTTP-Any-Isolate"
  description = "隔离经常访问关键或测试系统的特权用户的流量"
  precedence  = 70
  enabled     = true
  action      = "isolate"
  filters     = ["http"]
  identity    = "any(identity.groups.name[*] in {\"Privileged Users\"})"
}

Quarantined-Users-HTTP-Restricted-Access（隔离用户：HTTP 受限访问）

为包含在风险用户身份提供商（IdP）用户组中的用户限制访问。该策略可确保您的安全团队能够限制被检测到存在恶意或可疑活动的用户流量。

选择器	运算符	值	逻辑	操作
Destination IP（目标 IP）	not in list（不在列表中）	Quarantined-Users-IPAllowlist	And（且）	Block（阻止）
User Group Names（用户组名称）	in	Quarantined Users

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Quarantined-Users-HTTP-Restricted-Access",
		"description": "限制 IdP 风险用户组中包含的用户的访问权限",
		"precedence": 80,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "not(any(http.conn.dst_ip[] in $<QUARANTINED_USERS_IP_ALLOWLIST_UUID>))",
		"identity": "any(identity.groups.name[] in {\"Quarantined Users\"})"
	}'

resource "cloudflare_zero_trust_gateway_policy" "quarantined_users_http_restricted_access" {
  account_id  = var.cloudflare_account_id
  name        = "Quarantined-Users-HTTP-Restricted-Access"
  description = "限制 IdP 风险用户组中包含的用户的访问权限"
  precedence  = 80
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "not(any(http.conn.dst_ip[*] in ${"$"}{cloudflare_zero_trust_list.quarantined_users_ip_allowlist.id}))"
  identity    = "any(identity.groups.name[*] in {\"Quarantined Users\"})"
}

All-HTTP-Domain-Isolate（全部 HTTP：域名隔离）

隔离高风险域名或创建已知有风险域名的自定义列表，以避免数据外泄或恶意软件感染。理想情况下，你的事件响应团队可以使用自动化 API 更新拦截列表，以提供实时威胁防护。

选择器	运算符	值	逻辑	操作
Content Categories（内容类别）	in	New Domains, Newly Seen Domains	Or（或）	Isolate（隔离）
Domain（域名）	in list	Domain Isolation

Create a Zero Trust Gateway rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Domain-Isolate",
		"description": "隔离高风险域名，或创建已知风险域名的自定义列表，以避免数据泄露或恶意软件感染",
		"precedence": 90,
		"enabled": true,
		"action": "isolate",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.uri.content_category[*] in {169 177}) or any(http.request.domains[*] in $<DOMAIN_ISOLATE_LIST_UUID>)"
	}'

resource "cloudflare_zero_trust_gateway_policy" "all_http_domain_isolate" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-Domain-Isolate"
  description = "隔离高风险域名，或创建已知风险域名的自定义列表，以避免数据泄露或恶意软件感染"
  precedence  = 90
  enabled     = true
  action      = "isolate"
  filters     = ["http"]
  traffic     = "any(http.request.uri.content_category[*] in {169 177}) or any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_isolate_list.id})"
}