From cloudflare-knowledge
Cloudflare セキュリティ機能の完全ガイド。Zero Trust、WAF、DDoS Protection、Bot Management、SSL/TLS、Turnstile の設定と使い方を提供。Use when user asks about Zero Trust, WAF, DDoS, Bot Management, SSL, TLS, Turnstile, Access, Gateway, or security configuration. Also use when user says セキュリティ, ゼロトラスト, WAF, DDoS, ボット対策, SSL, Turnstile.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cloudflare-knowledge:security-featuresThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Cloudflare は包括的なセキュリティプラットフォームを提供。
Cloudflare は包括的なセキュリティプラットフォームを提供。 Zero Trust、WAF、DDoS Protection、SSL/TLS、Turnstile などで多層防御を実現。
VPN を使用せずに内部リソースへの安全なアクセスを提供する ZTNA ソリューション。
resource "cloudflare_zero_trust_access_application" "dashboard" {
account_id = var.account_id
name = "Internal Dashboard"
domain = "dashboard.example.com"
type = "self_hosted"
session_duration = "24h"
auto_redirect_to_identity = true
}
resource "cloudflare_zero_trust_access_policy" "employees" {
account_id = var.account_id
application_id = cloudflare_zero_trust_access_application.dashboard.id
name = "Allow Employees"
decision = "allow"
precedence = 1
include {
email_domain = ["example.com"]
}
require {
geo = ["JP", "US"]
}
}
DNS/HTTP フィルタリングによるセキュア Web ゲートウェイ。
デバイスのトラフィックを Cloudflare Gateway に安全にルーティング。
Web ブラウジングを隔離環境で実行し、マルウェアから保護。
OWASP Top 10 の脅威(SQLi、XSS など)から Web アプリを保護。
Cloudflare が管理する事前定義ルール。ゼロデイ脆弱性にも迅速対応。
resource "cloudflare_ruleset" "managed_waf" {
zone_id = var.zone_id
name = "Managed WAF"
kind = "zone"
phase = "http_request_firewall_managed"
rules {
action = "execute"
action_parameters {
id = "efb7b8c949ac4650a09736fc376e9aee" # Cloudflare Managed Ruleset
}
expression = "true"
description = "Execute Cloudflare Managed Ruleset"
enabled = true
}
}
独自のセキュリティルールを定義。
resource "cloudflare_ruleset" "custom_waf" {
zone_id = var.zone_id
name = "Custom WAF Rules"
kind = "zone"
phase = "http_request_firewall_custom"
# IP ブロック
rules {
action = "block"
expression = "(ip.src in {192.0.2.0/24 198.51.100.0/24})"
description = "Block malicious IPs"
enabled = true
}
# 管理画面保護
rules {
action = "challenge"
expression = "(http.request.uri.path contains \"/admin\")"
description = "Challenge admin access"
enabled = true
}
# 国別ブロック
rules {
action = "block"
expression = "(ip.geoip.country in {\"XX\" \"YY\"})"
description = "Block specific countries"
enabled = true
}
# SQLi 検知
rules {
action = "block"
expression = "(http.request.uri.query contains \"UNION SELECT\")"
description = "Block SQL injection"
enabled = true
}
}
リクエスト頻度に基づくアクセス制御。
resource "cloudflare_ruleset" "rate_limit" {
zone_id = var.zone_id
name = "Rate Limiting"
kind = "zone"
phase = "http_ratelimit"
rules {
action = "block"
ratelimit {
characteristics = ["ip.src"]
period = 60
requests_per_period = 100
mitigation_timeout = 600
}
expression = "(http.request.uri.path contains \"/api\")"
description = "API rate limit: 100 req/min per IP"
enabled = true
}
rules {
action = "challenge"
ratelimit {
characteristics = ["ip.src"]
period = 10
requests_per_period = 50
mitigation_timeout = 60
}
expression = "(http.request.uri.path contains \"/login\")"
description = "Login rate limit"
enabled = true
}
}
分散型サービス拒否攻撃をエッジで吸収・軽減。自動検知、無制限キャパシティ。
デフォルトで有効。追加設定はダッシュボードまたは API で。
悪意のあるボットをブロックし、有用なボット(検索エンジン等)を許可。
resource "cloudflare_ruleset" "bot_management" {
zone_id = var.zone_id
name = "Bot Management"
kind = "zone"
phase = "http_request_firewall_custom"
rules {
action = "block"
expression = "(cf.bot_management.score lt 30)"
description = "Block likely bots"
enabled = true
}
rules {
action = "challenge"
expression = "(cf.bot_management.score lt 50 and not cf.bot_management.verified_bot)"
description = "Challenge suspicious traffic"
enabled = true
}
}
API エンドポイントの保護。mTLS、Schema Validation、レート制限。
resource "cloudflare_mtls_certificate" "client_cert" {
account_id = var.account_id
certificates = file("client-ca.pem")
name = "Client CA"
}
resource "cloudflare_access_mutual_tls_certificate" "api" {
account_id = var.account_id
associated_hostnames = ["api.example.com"]
certificate = cloudflare_mtls_certificate.client_cert.certificates
name = "API mTLS"
}
全ユーザーに無料提供。自動発行・更新。
| 設定 | 説明 |
|---|---|
| Off | SSL なし |
| Flexible | クライアント↔CF のみ暗号化 |
| Full | CF↔オリジンも暗号化(自己署名可) |
| Full (Strict) | CF↔オリジンも暗号化(有効証明書必須) |
クライアント証明書による認証。
resource "cloudflare_zone_settings_override" "tls" {
zone_id = var.zone_id
settings {
min_tls_version = "1.2"
automatic_https_rewrites = "on"
always_use_https = "on"
}
}
プライバシー重視の人間検証。パズルなしでボットを検出。
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" defer></script>
<div id="turnstile-container"></div>
<script>
window.onload = function() {
turnstile.render('#turnstile-container', {
sitekey: 'YOUR_SITE_KEY',
callback: function(token) {
console.log('Token:', token);
// フォーム送信時にトークンを含める
},
'error-callback': function() {
console.error('Turnstile error');
},
theme: 'light', // 'light', 'dark', 'auto'
size: 'normal', // 'normal', 'compact'
});
};
</script>
// Workers での検証
export default {
async fetch(request: Request, env: Env) {
const formData = await request.formData();
const token = formData.get("cf-turnstile-response");
const result = await fetch(
"https://challenges.cloudflare.com/turnstile/v0/siteverify",
{
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
secret: env.TURNSTILE_SECRET,
response: token,
remoteip: request.headers.get("CF-Connecting-IP"),
}),
}
);
const outcome = await result.json();
if (!outcome.success) {
return new Response("Verification failed", { status: 403 });
}
// 検証成功
return new Response("OK");
},
};
{
"success": true,
"challenge_ts": "2024-01-01T00:00:00Z",
"hostname": "example.com",
"error-codes": [],
"action": "login",
"cdata": "customer-data"
}
オンプレミス/クラウドインフラの DDoS 保護とトラフィック最適化。
クラウドベースのネットワークファイアウォール(FWaaS)。
TCP/UDP ベースのアプリケーション向け DDoS 保護。
| 機能 | 主な用途 | プラン |
|---|---|---|
| WAF | Web アプリ保護 | Pro+ |
| DDoS Protection | 攻撃軽減 | 全プラン |
| Bot Management | ボット対策 | Enterprise |
| Access | ZTNA | 有料 |
| Gateway | SWG | 有料 |
| Turnstile | 人間検証 | 無料+ |
| API Shield | API 保護 | Enterprise |
npx claudepluginhub biwakonbu/cc-plugins --plugin cloudflare-knowledgeConfigures Cloudflare DDoS protection including managed rulesets, rate limiting, WAF rules, Bot Management, and origin hardening to mitigate L3/4 and L7 attacks.
Configures Cloudflare DDoS protection including managed rulesets, rate limiting, WAF rules, Bot Management, and origin hardening to mitigate L3/4 and L7 attacks.
Configures Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.