JA EN
shiichan

Country rules land in Unified Routing on Cloudflare!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#infrastructure

Hey everyone, it's me, Shii-chan! Today I dug up a nice little networking update. It feels a bit like picking a country off a map to steer your traffic.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Straight from the Cloudflare Changelog, this one spans Cloudflare Network Firewall, Magic Transit, and Cloudflare WAN. The country rules feature of Advanced Network Firewall is now supported for accounts using Unified Routing mode.

Using this feature requires a Cloudflare Advanced Network Firewall subscription.

The story so far

Country rules let you match traffic based on source or destination country so you can enforce geographic access policies across your whole network. Until now, though, accounts on Unified Routing mode couldn't use them. With this change, you can finally build country-based rules while running Unified Routing.

What changes

You can now write geographic access control as firewall rules while using Unified Routing, like "only allow traffic from this country" or "block that country as a destination". If you want regional policies to apply across your network, your options just opened up a lot.

Dive Deep

The key point here is that this is the first of the Advanced Network Firewall features to arrive in Unified Routing. According to the post, these capabilities are planned to follow:

  • IP Lists
  • ASN Lists
  • Threat Intel Lists
  • IDS
  • Rate Limiting
  • SIP
  • Managed Rulesets

Keep in mind Unified Routing itself is still in beta. What you can and can't do is documented in Traffic steering beta limitations, so it's worth a look before you roll it out.

Wrap-up

  • Advanced Network Firewall country rules now work in Unified Routing mode
  • Match traffic by source or destination country to enforce regional access policies
  • Requires an Advanced Network Firewall subscription
  • This is the first feature; IP Lists, Rate Limiting, and more are planned
  • Unified Routing is still beta, so check the limitations first

This one hits home if you protect large networks with Magic Transit or Cloudflare WAN and want to bring country-level traffic control into Unified Routing!

Related posts