How we made Firewall Rules
Mar 4, 2019David Kitchen
Summary
This post details the technical evolution leading to the creation of Cloudflare's Firewall Rules. It describes the limitations of previous single-attribute firewall features (IP Access Rules, ASN matching, CIDR blocking, GeoIP matching, Page Rules) and the challenges of combining them. The post introduces a new, unified matching engine implemented in Rust, designed to handle complex expressions with multiple attributes. It highlights the inspiration drawn from Wireshark's display filter syntax for creating a human-readable and machine-parseable DSL for defining firewall rules. The post also details the internal data structures used to represent HTTP request properties for matching.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack