Despliegue y operaciones · SKILL.md

implementing-ddos-mitigation-with-cloudflare

implementing-ddos-mitigation-with-cloudflare

配置 Cloudflare DDoS 防护，包括托管规则集、速率限制、WAF 规则、Bot 管理和源站保护，以缓解容量型、协议型和应用层攻击。

Independent GitHub snapshot · Automated classification · Original documentation governs

Kkillvxk / cybersecurity-skills-zhApache-2.0

Documentación de la Skill

GitHub

name: implementing-ddos-mitigation-with-cloudflare description: 配置 Cloudflare DDoS 防护，包括托管规则集、速率限制、WAF 规则、Bot 管理和源站保护，以缓解容量型、协议型和应用层攻击。 domain: cybersecurity subdomain: network-security tags: [ddos, cloudflare, ddos-mitigation, rate-limiting, waf, bot-management, layer-7, volumetric-attack, network-security] version: "1.0" author: mahipal license: Apache-2.0

使用 Cloudflare 实施 DDoS 缓解

概述

Cloudflare 通过其遍布全球 300 多个数据中心、477+ Tbps 容量的网络提供多层 DDoS（分布式拒绝服务）防护。该平台防护 L3/4 容量型攻击（SYN 洪水、UDP 放大、DNS 反射）、协议攻击（Ping of Death、Smurf）和 L7 应用层攻击（HTTP 洪水、Slowloris、缓存破坏）。Cloudflare 的自主检测系统使用流量分析、机器学习和自适应规则集，在约 3 秒内识别并缓解攻击。本技能涵盖配置 Cloudflare DDoS 防护栈，包括托管规则集、WAF 规则、速率限制、Bot 管理和源站服务器加固。

前置条件

Cloudflare 账户（WAF 最低需要 Pro 计划，高级 DDoS 需要 Enterprise 计划）
已将 DNS 委托给 Cloudflare 名称服务器的域名
源站服务器 IP 地址
了解正常流量模式和峰值
用于自动化的 Cloudflare API 令牌

核心概念

DDoS 攻击类别

层	攻击类型	示例	Cloudflare 防护
L3/4	容量型	SYN 洪水、UDP 洪水、DNS 放大	网络层 DDoS 托管规则
L3/4	协议型	Ping of Death、Smurf、IP 分片	高级 TCP 防护
L7	应用层	HTTP 洪水、Slowloris、缓存破坏	HTTP DDoS 托管规则、WAF、速率限制
DNS	DNS 专项	DNS 查询洪水、NXDOMAIN 攻击	高级 DNS 防护

Cloudflare 防护栈

互联网流量
     │
     ▼
┌─────────────────────────┐
│  Cloudflare 边缘节点（PoP）│
│  ┌───────────────────┐  │
│  │ L3/4 DDoS 托管规则 │  │  ← 容量型/协议型缓解
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ IP 访问规则        │  │  ← 国家/ASN/IP 封锁
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ Bot 管理           │  │  ← Bot 评分、JS 验证
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ WAF 托管规则       │  │  ← OWASP、Cloudflare、自定义
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ 速率限制           │  │  ← 请求速率执行
│  └───────────────────┘  │
│  ┌───────────────────┐  │
│  │ HTTP DDoS 托管规则 │  │  ← L7 洪水检测
│  └───────────────────┘  │
└─────────────────────────┘
     │
     ▼
  源站服务器

步骤

步骤 1：将域名接入 Cloudflare

# 通过 API 添加域名
curl -X POST "https://api.cloudflare.com/client/v4/zones" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "example.com",
    "type": "full",
    "plan": {"id": "enterprise"}
  }'

# 更新 DNS 记录（启用代理以获得 DDoS 防护）
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "A",
    "name": "example.com",
    "content": "203.0.113.50",
    "proxied": true,
    "ttl": 1
  }'

步骤 2：配置 DDoS 托管规则集

HTTP DDoS 攻击防护覆盖：

# 列出 HTTP DDoS 托管规则集
curl -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/ddos_l7/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN"

# 覆盖 HTTP DDoS 灵敏度和动作
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/ddos_l7/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [{
      "action": "execute",
      "action_parameters": {
        "id": "4d21379b4f9f4bb088e0729962c8b3cf",
        "overrides": {
          "rules": [{
            "id": "fdfdac75430c4c47a422bdc024aab531",
            "sensitivity_level": "medium",
            "action": "block"
          }],
          "sensitivity_level": "high"
        }
      },
      "expression": "true"
    }]
  }'

网络层 DDoS 防护覆盖：

curl -X PUT "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/ddos_l4/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [{
      "action": "execute",
      "action_parameters": {
        "id": "3b64149bfa6e4220bbbc2bd6db7c867e",
        "overrides": {
          "sensitivity_level": "high"
        }
      },
      "expression": "true"
    }]
  }'

步骤 3：配置速率限制规则

# 为登录端点创建速率限制规则
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_ratelimit/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [
      {
        "description": "Rate limit login attempts",
        "expression": "(http.request.uri.path eq \"/api/login\")",
        "action": "block",
        "ratelimit": {
          "characteristics": ["cf.colo.id", "ip.src"],
          "period": 60,
          "requests_per_period": 10,
          "mitigation_timeout": 600
        }
      },
      {
        "description": "Rate limit API endpoints",
        "expression": "(http.request.uri.path matches \"^/api/\")",
        "action": "managed_challenge",
        "ratelimit": {
          "characteristics": ["cf.colo.id", "ip.src"],
          "period": 60,
          "requests_per_period": 100,
          "mitigation_timeout": 300
        }
      },
      {
        "description": "Global rate limit per IP",
        "expression": "true",
        "action": "managed_challenge",
        "ratelimit": {
          "characteristics": ["ip.src"],
          "period": 10,
          "requests_per_period": 50,
          "mitigation_timeout": 60
        }
      }
    ]
  }'

步骤 4：配置 WAF 自定义规则

# 阻止已知攻击模式
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "rules": [
      {
        "description": "Block requests from known bad ASNs",
        "expression": "(ip.geoip.asnum in {12345 67890})",
        "action": "block"
      },
      {
        "description": "Challenge requests without User-Agent",
        "expression": "(not http.user_agent ne \"\")",
        "action": "managed_challenge"
      },
      {
        "description": "Block high-risk countries for admin paths",
        "expression": "(http.request.uri.path contains \"/admin\" and not ip.geoip.country in {\"US\" \"CA\" \"GB\"})",
        "action": "block"
      },
      {
        "description": "Block oversized request bodies",
        "expression": "(http.request.body.size gt 10000000)",
        "action": "block"
      }
    ]
  }'

步骤 5：配置源站保护

确保源站服务器只接受来自 Cloudflare 的流量：

# 获取 Cloudflare IP 范围
curl https://api.cloudflare.com/client/v4/ips

# 配置源站服务器防火墙（iptables）
# 只允许 Cloudflare IP
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
    iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT
    iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT
done

# 丢弃所有其他 HTTP/HTTPS 流量
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP

# 启用认证源站拉取（双向 TLS）
# 下载 Cloudflare 源站 CA 证书
curl -o /etc/ssl/cloudflare-origin-pull.pem \
  https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem

# Nginx 认证源站拉取配置
# ssl_client_certificate /etc/ssl/cloudflare-origin-pull.pem;
# ssl_verify_client on;

步骤 6：启用攻击模式自动化

#!/usr/bin/env python3
"""根据流量异常自动启用 Cloudflare 攻击模式。"""

import requests
import time
import sys

CF_API_TOKEN = "your-api-token"
ZONE_ID = "your-zone-id"
HEADERS = {
    "Authorization": f"Bearer {CF_API_TOKEN}",
    "Content-Type": "application/json",
}
BASE_URL = f"https://api.cloudflare.com/client/v4/zones/{ZONE_ID}"

NORMAL_RPS_THRESHOLD = 5000  # 每秒请求数阈值
CHECK_INTERVAL = 30  # 检查间隔秒数


def get_current_security_level():
    """获取当前安全级别设置。"""
    resp = requests.get(
        f"{BASE_URL}/settings/security_level",
        headers=HEADERS
    )
    return resp.json()["result"]["value"]


def set_security_level(level: str):
    """设置安全级别（off/essentially_off/low/medium/high/under_attack）。"""
    resp = requests.patch(
        f"{BASE_URL}/settings/security_level",
        headers=HEADERS,
        json={"value": level}
    )
    result = resp.json()
    if result["success"]:
        print(f"[+] 安全级别已设置为：{level}")
    else:
        print(f"[-] 设置安全级别失败：{result['errors']}")
    return result["success"]


def get_traffic_analytics():
    """从 Cloudflare 分析获取近期流量数据。"""
    query = """
    query {
      viewer {
        zones(filter: {zoneTag: "%s"}) {
          httpRequests1mGroups(limit: 1, orderBy: [datetime_DESC]) {
            sum {
              requests
              threats
            }
            dimensions {
              datetime
            }
          }
        }
      }
    }
    """ % ZONE_ID

    resp = requests.post(
        "https://api.cloudflare.com/client/v4/graphql",
        headers=HEADERS,
        json={"query": query}
    )
    return resp.json()


def monitor_and_respond():
    """监控流量并自动启用攻击模式。"""
    current_level = get_current_security_level()
    print(f"[*] 当前安全级别：{current_level}")
    print(f"[*] 监控流量（阈值：{NORMAL_RPS_THRESHOLD} RPS）...")

    attack_mode_active = False
    consecutive_normal = 0

    while True:
        try:
            analytics = get_traffic_analytics()
            zones = analytics.get("data", {}).get("viewer", {}).get("zones", [])

            if zones and zones[0].get("httpRequests1mGroups"):
                data = zones[0]["httpRequests1mGroups"][0]["sum"]
                rps = data["requests"] / 60
                threats = data["threats"]

                print(f"[*] 当前 RPS：{rps:.0f}，威胁数：{threats}")

                if rps > NORMAL_RPS_THRESHOLD and not attack_mode_active:
                    print(f"[!] 检测到流量峰值：{rps:.0f} RPS")
                    set_security_level("under_attack")
                    attack_mode_active = True
                    consecutive_normal = 0

                elif rps <= NORMAL_RPS_THRESHOLD and attack_mode_active:
                    consecutive_normal += 1
                    if consecutive_normal >= 5:
                        print("[+] 流量已恢复正常，禁用攻击模式")
                        set_security_level("high")
                        attack_mode_active = False
                        consecutive_normal = 0

        except Exception as e:
            print(f"[-] 错误：{e}")

        time.sleep(CHECK_INTERVAL)


if __name__ == "__main__":
    monitor_and_respond()

监控与告警

Cloudflare 控制台指标

防火墙事件——查看被封锁的请求、受挑战的请求、速率受限的请求
DDoS 分析——攻击规模、持续时间、类型和缓解状态
流量分析——按时间的请求量、带宽、错误率
Bot 分析——Bot 评分分布、已验证 Bot 与自动化威胁对比

告警配置

# 为 DDoS 攻击创建通知策略
curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/alerting/v3/policies" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "DDoS Attack Alert",
    "alert_type": "dos_attack_l7",
    "enabled": true,
    "mechanisms": {
      "email": [{"id": "soc@example.com"}],
      "webhooks": [{"id": "webhook-id"}]
    },
    "filters": {
      "zones": ["'$ZONE_ID'"]
    }
  }'

最佳实践

代理所有 DNS 记录——确保所有指向源站的 A/AAAA/CNAME 记录均已代理（橙色云朵图标）
隐藏源站 IP——绝不暴露源站服务器 IP；使用 Cloudflare Tunnel 或仅限 Cloudflare IP 访问
先以日志模式开始——在切换到"阻止"之前，先以"日志"动作测试 DDoS 规则覆盖
分层防御——结合托管规则集、速率限制、WAF 规则和 Bot 管理
调整灵敏度——根据流量中的误报率调整 DDoS 规则灵敏度
缓存策略——最大化缓存命中率，在攻击期间降低源站负载
等候室——为关键页面在流量激增时配置 Cloudflare 等候室（Waiting Room）
认证源站——启用认证源站拉取，防止直接攻击源站

参考资料

MAKE IT PART OF YOUR WORKFLOW

Instalar Skill

TERMINAL

npx skills add killvxk/cybersecurity-skills-zh --skill implementing-ddos-mitigation-with-cloudflare

Ejecuta el comando en tu terminal. Revisa el código y la licencia antes de instalar.

ZIP · Complete skill directory with resources and licenses

SKILL.md · Instructions file only

Estrellas del repositorio: Not synced
Licencia: Apache-2.0
Versión / rama: HEAD · 27418b6c
Repositorio actualizado: Not synced

Revisa los scripts y los permisos antes de instalar.

Código fuente