Cloudflare WAF

Cloudflare Managed Ruleset — proprietary, curated by Cloudflare's security team. Updated weekly + emergency releases for zero-days

OWASP CRS v3.x — newer standard with paranoia levels (PL1–PL4), transparent scoring, lower false positive rates

WAF Attack Score (ML) — machine learning scores every request for SQLi, XSS, and RCE independently of signatures

Per-rule overrides, tag-based overrides, and granular rule customisation via dashboard or API

 Cloudflare WAF

Native ASN blocking via IP Access Rules or Custom Rules — no scripting required, available in the dashboard

Compound expressions — combine ASN with country, URI path, bot score, rate, and more in a single rule

Example: (ip.src.asnum in {12345 67890}) and not cf.verified_bot

Account-scope application — one IP Access Rule can block an ASN across all zones in the account simultaneously

 Cloudflare

Managed Challenge — available as an action on any WAF rule, DDoS override, or bot rule. No separate product required

No CAPTCHA — Cloudflare has moved entirely to non-interactive challenges: invisible JS proofs, Private Access Tokens (Apple), button-click fallback

Under Attack Mode — one-click site-wide JS challenge during an active attack. Disableable instantly once attack subsides

Turnstile — embeddable CAPTCHA alternative for forms/logins. Works independently, no architectural dependency

 Cloudflare Enterprise WAF

Account-level WAF — define custom rules, rate limiting rules, and managed ruleset deployments once at the account level; apply to all zones

Account-level custom rulesets — a single ruleset deployed globally with per-zone expression overrides for site-specific customisations

Account-level rate limiting — define rate limits once and push to all Enterprise zones simultaneously

IP Access Rules (account scope) — one click to apply an ASN or IP block across every zone in the account

 One Global Anycast Network

Cloudflare operates 330+ cities across 120+ countries. Unlike traditional vendors with centralised scrubbing centres, every Cloudflare location runs every product simultaneously — WAF, DDoS mitigation, CDN, bot management, and more.

 Traffic Inspected Closest to the Source

Attack traffic is identified and absorbed at the PoP nearest to the attacker — never backhauled to a remote scrubbing centre. This eliminates the latency penalty that traditional DDoS mitigation services impose during an active attack.

 No Specialised Hardware — Software-Defined

Every capability — WAF rules, rate limiting, bot scoring, DDoS mitigation — is delivered as software running on commodity servers. New rules and mitigations propagate globally in seconds, not hours.

Under Attack Mode

One-click site-wide JS challenge. Activatable immediately from the dashboard or API during an active attack. Disable instantly when the attack subsides.

 Cloudflare Managed Ruleset

Proprietary rules written by Cloudflare's security team. Covers known attack techniques, CVEs, and zero-day vulnerabilities. Updated weekly with emergency releases for critical threats. This is not CRS — it is informed by traffic across millions of zones.

 Cloudflare OWASP Core Ruleset (v3.x)

Cloudflare's implementation of OWASP CRS v3.x (vs Azure's v2.x). Features paranoia levels PL1–PL4 and a transparent threat scoring model. Tune sensitivity without blanket disables.

 WAF Attack Score (ML)

Machine learning model that scores every request for SQLi, XSS, and RCE independently of signature matching. Catches novel attack patterns that no signature can anticipate. Combine with custom rules for surgical policies.

 Full Customisability

Per-rule overrides, tag-based overrides (e.g. disable all WordPress rules on a non-WP site), WAF exceptions, and custom rules — all configurable via dashboard or API with full Terraform support.

 IP Access Rules — ASN Blocking

Block, allow, or challenge traffic by IP, IP range, country, or ASN — natively in the Cloudflare dashboard. Apply to a single zone or to all zones in the account with one rule.

 Custom Rules — Expression Language

Full expression syntax. Combine any request signal — ASN, country, URI, headers, bot score, rate — in a single rule. Actions: Block, Managed Challenge, JS Challenge, Log, Skip.

 Managed Challenge

Cloudflare's non-interactive challenge selects the appropriate verification method dynamically — invisible JS proof, Private Access Tokens (Apple devices), or a button click as a last resort. Available as an action on any WAF rule, DDoS override, or bot rule. No separate product. No Azure Front Door equivalent required.

 Turnstile

Cloudflare's embeddable CAPTCHA alternative. Drop a widget into any login or form page. Visitors are challenged invisibly — no image puzzles. Works via client-side JS + server-side token validation. No routing through Cloudflare required for deployment.

 Under Attack Mode

Activatable in seconds from the Cloudflare dashboard, API, or Terraform. Applies a JS Challenge to all HTTP traffic site-wide. The most effective immediate-response tool during an active HTTP DDoS flood — no architectural change needed.

 Bot Management Integration

Combine challenges with Cloudflare Bot Management — challenge only traffic below a bot score threshold, whitelist verified crawlers, and build fine-grained rules using ML-derived signals alongside ASN, country, and URI conditions.

 Account-Level Custom Rulesets

Define a set of custom rules once at the account level and deploy them across all zones. Use scope expressions to target all zones or specific subsets. Site-specific overrides layer on top without disrupting the global baseline.

 Account-Level Rate Limiting

Create rate limiting rules once and deploy to all Enterprise zones simultaneously. A single update during an active attack propagates instantly to every protected site — no per-zone scripting.

 Account-Level Managed Ruleset Deployment

Deploy the Cloudflare Managed Ruleset and OWASP Core Ruleset at account level with per-zone expression overrides. Different OWASP paranoia levels per application, different actions per hostname — all managed from a single place.

 Terraform & API-First

Every account-level WAF configuration is fully manageable via the Cloudflare API and official Terraform provider. Enables GitOps workflows — WAF policy changes reviewed, version-controlled, and deployed like code.

 Traffic Baseline Learning

Cloudflare builds a unique traffic profile for your zone over 7 days — measuring normal request rates by country/region, User-Agent distribution, and origin error rates. During an attack, Adaptive DDoS detects deviations from this baseline and automatically tightens mitigation thresholds.

 Effective Against Sophisticated Attacks

Particularly effective against low-and-slow application layer attacks that fall below static threshold rules but deviate significantly from the zone's normal traffic pattern. The profile self-updates as legitimate traffic evolves.

 IRAP Assessed

Active IRAP assessment at OFFICIAL and PROTECTED classification levels — assessed against the ISM. The mandatory credential for government procurement. Agencies can issue an ATO using Cloudflare's IRAP report.

 Data Sovereignty

PoPs in Perth · Sydney · Melbourne · Brisbane · Adelaide. Data Localisation Suite pins inspection, logs & keys to Australian nodes. Logpush to Australian storage (S3 Sydney / Azure Australia East). Supports 12–72 hour SOCI Act incident reporting to ASD/ACSC.

 Certifications

 SOCI Act Compliance

Mandatory incident reporting within 12–72 hours to ASD/ACSC. No dependency on adversarial nation infrastructure. Detailed log retention via Logpush supports all audit requirements.

 What is Cloudflare Tunnel?

A lightweight daemon (cloudflared) installed inside your Azure environment. It creates outbound-only, post-quantum encrypted connections to Cloudflare's global network — no inbound firewall rules, no open ports, no public IP required on your origin.

 How It Deploys in Azure

Install cloudflared as a container in AKS, an Azure Container Instance, or directly on an Azure VM. Maintains 4 connections across 2+ Cloudflare data centres for automatic failover. No changes to existing Azure network routing required.

 The Result: A Dark Origin

Once the Tunnel is active, your Azure NSG inbound rules can be set to deny all internet traffic. The AppGW public IP still exists but has no open ports — any attacker who discovers it hits nothing. There is no IP, no port, no attack surface to target.