WAF lists: Can I explicitly set what gets added?

[arpitgupta]

I am going through the docs and I was not able to figure this out.

What my setup looks like is set root and wild card domains as proxied. Then explicitly add specific subdomain records that I want to allow.

example:

my.domain -> proxied
*.my.domain -> proxied
abc.my.domain -> not proxied
xyz.my.domain -> proxied
one.my.domain -> proxied

I have WAF list that I created which only allows calls through if they are going to xyz.my.domain or one.my.domain.

This way I can get CF to block most of the requests to any subdomain that I do not explicitly allow or the ones that I do not have a non proxied record for them.

So any time I am adding more dns records I want to add specific values to this WAF list. I don't think the we currently support this so was wondering if this is something we could support.

[favonia]

@arpitgupta The WAF list supported by this tool contains IP addresses, not domain names (or host names). At the IP layer, IP packets for different host names will have the same source and target IP addresses. The domain names are reflected as host names in HTTP(S) request headers (several layers above the IP layer), and any host-based filter must inspect HTTP(S) request headers to differentiate network traffic for different domain names. Cloudflare WAF can indeed filter traffic based on those (find "hostname" when creating WAF rules) but that's not done by lists of IP addresses. I hope this helps.

[arpitgupta]

Thanks for the info @favonia , yup currently I had manually setup my WAF list with hostnames so was curious if i could integrate it with this tool, but i think its outside the scope of ddns anyways :).