implementing-ddos-mitigation-with-cloudflare

What this skill does

# Implementing DDoS Mitigation with Cloudflare

## Overview

Cloudflare provides multi-layer DDoS protection across its global network of over 300 data centers with 477+ Tbps of capacity. The platform protects against L3/4 volumetric attacks (SYN floods, UDP amplification, DNS reflection), protocol attacks (Ping of Death, Smurf), and L7 application-layer attacks (HTTP floods, Slowloris, cache-busting). Cloudflare's autonomous detection systems identify and mitigate attacks within approximately 3 seconds using traffic profiling, machine learning, and adaptive rulesets. This skill covers configuring Cloudflare's DDoS protection stack including managed rulesets, WAF rules, rate limiting, Bot Management, and origin server hardening.


## When to Use

- When deploying or configuring implementing ddos mitigation with cloudflare capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation

## Prerequisites

- Cloudflare account (Pro plan minimum for WAF, Enterprise for Advanced DDoS)
- Domain with DNS delegated to Cloudflare nameservers
- Origin server IP address(es)
- Understanding of normal traffic patterns and peak volumes
- Cloudflare API token for automation

## Core Concepts

### DDoS Attack Categories

| Layer | Attack Type | Examples | Cloudflare Protection |
|-------|------------|----------|----------------------|
| L3/4 | Volumetric | SYN flood, UDP flood, DNS amplification | Network-layer DDoS managed rules |
| L3/4 | Protocol | Ping of Death, Smurf, IP fragmentation | Advanced TCP Protection |
| L7 | Application | HTTP flood, Slowloris, cache busting | HTTP DDoS managed rules, WAF, Rate Limiting |
| DNS | DNS-specific | DNS query flood, NXDOMAIN attack | Advanced DNS Protection |

### Cloudflare Protection Stack

```
Internet Traffic
     │
     ▼
┌─────────────────────────┐
│  Cloudflare Edge (PoP)  │
│  ┌───────────────────┐  │
│  │ L3/4 DDoS Mgd Rules│  │  ← Volumetric/Protocol mitigation
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ IP Access Rules    │  │  ← Country/ASN/IP blocks
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ Bot Management     │  │  ← Bot score, JS challenge
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ WAF Managed Rules  │  │  ← OWASP, Cloudflare, Custom
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ Rate Limiting      │  │  ← Request rate enforcement
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ HTTP DDoS Mgd Rules│  │  ← L7 flood detection
│  └───────────────────┘  │
└─────────────────────────┘
     │
     ▼
  Origin Server
```

## Workflow

### Step 1: Onboard Domain to Cloudflare

```bash
# Add domain via API
curl -X POST "https://api.cloudflare.com/client/v4/zones" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "example.com",
    "type": "full",
    "plan": {"id": "enterprise"}
  }'

# Update DNS records (proxy enabled for DDoS protection)
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "A",
    "name": "example.com",
    "content": "203.0.113.50",
    "proxied": true,
    "ttl": 1
  }'
```

### Step 2: Configure DDoS Managed Rulesets

**HTTP DDoS Attack Protection override:**

```bash
# List HTTP DDoS managed ruleset
curl -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/ddos_l7/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN"

# Override HTTP DDoS sensitivity and action
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/ddos_l7/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [{
      "action": "execute",
      "action_parameters": {
        "id": "4d21379b4f9f4bb088e0729962c8b3cf",
        "overrides": {
          "rules": [{
            "id": "fdfdac75430c4c47a422bdc024aab531",
            "sensitivity_level": "medium",
            "action": "block"
          }],
          "sensitivity_level": "high"
        }
      },
      "expression": "true"
    }]
  }'
```

**Network-layer DDoS Protection override:**

```bash
curl -X PUT "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/ddos_l4/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [{
      "action": "execute",
      "action_parameters": {
        "id": "3b64149bfa6e4220bbbc2bd6db7c867e",
        "overrides": {
          "sensitivity_level": "high"
        }
      },
      "expression": "true"
    }]
  }'
```

### Step 3: Configure Rate Limiting Rules

```bash
# Create rate limiting rule for login endpoint
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_ratelimit/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [
      {
        "description": "Rate limit login attempts",
        "expression": "(http.request.uri.path eq \"/api/login\")",
        "action": "block",
        "ratelimit": {
          "characteristics": ["cf.colo.id", "ip.src"],
          "period": 60,
          "requests_per_period": 10,
          "mitigation_timeout": 600
        }
      },
      {
        "description": "Rate limit API endpoints",
        "expression": "(http.request.uri.path matches \"^/api/\")",
        "action": "managed_challenge",
        "ratelimit": {
          "characteristics": ["cf.colo.id", "ip.src"],
          "period": 60,
          "requests_per_period": 100,
          "mitigation_timeout": 300
        }
      },
      {
        "description": "Global rate limit per IP",
        "expression": "true",
        "action": "managed_challenge",
        "ratelimit": {
          "characteristics": ["ip.src"],
          "period": 10,
          "requests_per_period": 50,
          "mitigation_timeout": 60
        }
      }
    ]
  }'
```

### Step 4: Configure WAF Custom Rules

```bash
# Block known attack patterns
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [
      {
        "description": "Block requests from known bad ASNs",
        "expression": "(ip.geoip.asnum in {12345 67890})",
        "action": "block"
      },
      {
        "description": "Challenge requests without User-Agent",
        "expression": "(not http.user_agent ne \"\")",
        "action": "managed_challenge"
      },
      {
        "description": "Block high-risk countries for admin paths",
        "expression": "(http.request.uri.path contains \"/admin\" and not ip.geoip.country in {\"US\" \"CA\" \"GB\"})",
        "action": "block"
      },
      {
        "description": "Block oversized request bodies",
        "expression": "(http.request.body.size gt 10000000)",
        "action": "block"
      }
    ]
  }'
```

### Step 5: Configure Origin Protection

Ensure the origin server only accepts traffic from Cloudflare:

```bash
# Get Cloudflare IP ranges
curl https://api.cloudflare.com/client/v4/ips

# Configure origin server firewall (iptables)
# Allow only Cloudflare IPs
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT
    iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT
done

# Drop all other HTTP/HTTPS traffic
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP

# Enable Authenticated Origin Pulls (mutual TLS)
# Download Cloudflare origin CA certificate
curl -o /etc/ssl/cloudflare-origin-pull.pem \
  htt