Cloudflare高级防御规则看看我的网站如何用防御的

news2024/11/16 20:39:43

网站已趋于稳定，并且经过nginx调优。我想先分享一下Cloudflare的WAF规则，因为这是最有效的防御之一，可以抵御大量恶意攻击流量，我已经验证了数月。

对于海外独立站电商网站，Cloudflare的CDN服务是首选，它强大无比，毫无疑问。对于中小型需求，直接免费使用就可以了，接入后网站的加速和防护都交给CF处理，这是最稳妥的选择。

让我们开始吧！

进入WAF配置页

进入CF的后台，选择你要防御的站点域名。

记得在DNS选项，开启小云朵。这就开启CDN了，后续防御规则才会生效。

选择安全性–WAF

四个WAF规则

添加完规则后请使用鼠标拖拽方式把四个规则的排序按照下面顺序排列,最上面的优先执行:

选择正则表达式添加规则，复制规则保存即可。

防御规则配置

以下列出四个规则的正则表达式

放行原站IP

IPV4和IPV6地址改成自己

(ip.src eq 192.168.7.17) or (ip.src eq 2901:c080:1110:4c91:5400:4ff:feb8:130a)

没有ipv6

(ip.src eq 192.168.7.17)

选择操作: 跳过

要跳过的 WAF 组件: 所有其余自定义规则

阻止垃圾蜘蛛

(http.user_agent contains "YandexBot") or (http.user_agent contains "DotBot") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "AhrefsBot") or (http.user_agent contains "BLEXBot") or (http.user_agent contains "YaK") or (http.user_agent contains "PetalBot") or (http.user_agent contains "MJ12bot") or (http.user_agent contains "MauiBot") or (http.user_agent contains "MegaIndex.ru")

选择操作: 阻止

放行SEO爬虫

无脑复制即可，无需修改，

(cf.client.bot) or (http.user_agent contains "duckduckgo") or (http.user_agent contains "facebookexternalhit") or (http.user_agent contains "Feedfetcher-Google") or (http.user_agent contains "LinkedInBot") or (http.user_agent contains "Mediapartners-Google") or (http.user_agent contains "msnbot") or (http.user_agent contains "Slackbot") or (http.user_agent contains "TwitterBot") or (http.user_agent contains "ia_archive") or (http.user_agent contains "yahoo")

选择操作: 跳过

阻止恶意流量

(cf.threat_score ge 5 and not cf.client.bot) or (not http.request.version in {"HTTP/2" "HTTP/3" "HTTP/1.1"}) or (not ip.geoip.country in {"AU" "CA" "FR" "DE" "HK" "IR" "JP" "KR" "MY" "SG" "TW" "GB" "US" "CN"})