Centralized Network Restrictions, Without the Appliances

Application-layer authentication and zero trust controls have become the norm for securing access to web properties. Yet there are still plenty of reasons to enforce restrictions lower in the stack, based on where traffic originates. Sanctions may prohibit business with certain countries, or a zone may need to block a set of known-bad IPs that have been hammering it. Those policies are typically enforced with hardware or virtualized appliances, which add cost and complexity at centralized chokepoints. The alternative is to perform the checks at the edge, close to the visitor, using data structures that group the offending addresses.

Cloudflare now offers IP Lists for exactly this purpose. A list is a named collection of IP addresses, IPv6 prefixes, or other identifiers that can be stored at the edge and replicated across the network's data centers in 200+ cities. Because lists plug directly into the Firewall Rules engine, they can be combined with other request attributes to trigger any of the available actions. The primary win is for operators who need to manage tens of thousands of entries across many zones; previously, that meant maintaining a sprawling set of rigid, zone-scoped rules designed one by one.

Updating the Legacy IP Controls

The old tools for network-level enforcement, IP Access and Zone Lockdown, work but they have structural limits that IP Lists remove:

  • Prefix flexibility. Legacy IP Access rules only accept a small set of prefix lengths: /16 and /24 for IPv4, and /32, /48, and /64 for IPv6. Blocking a /20 required 16 separate /24 entries. IP Lists accept any prefix from /8 through /32 for IPv4 and /4 through /64 for IPv6, and a list may also contain single IPv4 addresses. IPv6 prefixes beyond /64 are intentionally not offered, since the lower 64 bits of an address can often be changed by the host.
  • Evaluation order. IP Access rules run before Firewall Rules, and they can only either block/challenge the request or let it bypass all downstream L7 mitigations. Since IP Lists are just another type of data the Firewall Rules engine can inspect, you can write far more nuanced logic. A rule can combine a list membership check with a bot score, request header contents, or any other filter the language supports. For example, a rule could block POSTs to /login with a bot score below 30 unless the request originates from Pingdom's probe servers, which you've organized into a list.
  • Account-level scope. Zone Lockdown rules live and die with an individual zone. Reusing the same allow-list across 100 zones meant recreating it 100 times. IP Lists are stored once at the account level, so the same collection is referenced from Firewall Rules in any zone, and a single update refreshes everywhere. Account-wide Firewall Rules are on the roadmap as a follow-up.
  • Bulk management. There is no longer a need to click through a form for every individual IP. Lists support uploading an entire CSV file or pasting multiple lines into the UI, and each entry is timestamped. The list itself and individual entries can carry descriptions for clarity.

All standard Firewall Rules actions are available with IP lists. Work is also underway to migrate features currently under Firewall → Tools—including Rate Limiting—into the Firewall Rules engine. In addition, a new Custom Response action will allow rules to specify the exact status code, content type, and payload returned to the visitor.

Near-Term Roadmap

IP Lists are rolling out with modest quotas: one list per account with 1,000 entries as of July 22, 2020. That ceiling will rise in short order, and several enhancements are already in development.

  • New list types. IP Lists are the first available type. Country and ASN lists are planned, with other types to follow based on customer interest.
  • Expiring entries. Testers have asked for entries that automatically drop off a list after a defined time window, say 24 hours after insertion. Cloudflare is collecting feedback on specific use cases.
  • Managed lists. Beyond user-created lists, Cloudflare plans to curate subscriptions that can be referenced in rules. Initial candidates include intelligence derived from traffic crossing its edge—for example, a list of known open proxies—as well as convenience collections, such as the probe IP ranges for third-party performance monitoring services. Cloudflare is soliciting suggestions for lists operators currently maintain by hand.

IP Lists are available today for all Cloudflare accounts.