FRESH

Hacker News

Why Cloudflare rule order matters?

66 points by redfr0g

by flarite

2 subcomments

Interesting, I never really knew setting Action to "Managed challenge" would be equivalent to skipping all the remaining rules and this is coming from someone who is managing multiple Enterprise Cloudflare accounts for the past couple of years. Thanks.

by yellow_lead

1 subcomments

It's a failing on the part of Cloudflare to have used rules so many times and not realize this important detail.
It's not expressed anywhere in the UI, so at some point someone really just said "well the user will figure it out."

by bivlked

0 subcomment

ran into this with UFW + Cloudflare on a VPS. had a rule in UFW that should have been denying a range, but Cloudflare was proxying the request so UFW saw Cloudflare's IP instead of the client's. took me way too long to figure out.
the "first match wins" vs "most specific wins" difference between systems is brutal when you're debugging at 2am.

0 subcomment

by weird-eye-issue

2 subcomments

> In other way this seems to be intended behavior even though Cloudflare dashboard is straight lying to you by saying that Block rule will execute after Challenge action:
> Above statement is not true, as the rule will never be evaluated after “Force bot detection” rule.
Actually what you are saying is not true because the rule is evaluated after your previous rule just like it says, only as long as it was not a terminating action which is documented. Just because you created two conflicting rules in the incorrect order does not mean that their UI text is incorrect or lying to you.