Cloud firewall automation: Cloudflare

Reach adds a zone-level IP Access Rule with action Allow for each of your team's gateway IPs, so traffic from Reach skips the challenges and IP-based blocks you apply to everyone else on that zone. You authenticate with a scoped API token — no Global API key.

What Reach manages

For each gateway IP, one IP Access Rule on the zone:

  • mode Allow (the API calls it whitelist), target ip, value = the gateway IP
  • note TYO Reach gateway — <target label>

Removing the target lists the zone's allow rules and deletes only those whose IP is a Reach gateway. Rules for other addresses are never touched. Reach ignores "rule already exists" so re-syncs are safe.

1. Create the API token

  1. dash.cloudflare.com → My Profile → API Tokens → Create Token → Custom token.
  2. Permissions: Zone → Firewall Services → Edit.
  3. Zone Resources: Include → Specific zone → the zone Reach should manage.
  4. Create and copy the token.

IP Access Rules are part of "Firewall Services"; the token needs no other permission. Reach verifies the token with GET /user/tokens/verify when you connect.

2. Connect the zone

Cloud connections → Add connection → Cloudflare, paste the API token and the Zone ID (shown on the zone's Overview page, right-hand column).

3. Add a target

  1. Add target on the connection.
  2. Give it a label — it's written into the rule's note so you can find it later.
  3. Save. Port and protocol don't apply to Cloudflare; the rule is per IP.

Verify in the dashboard

Security → WAF → Tools → IP Access Rules: you should see one Allow entry per gateway IP with the TYO Reach gateway note.

Revoke

Delete the target (Reach removes its rules), then roll the API token from My Profile → API Tokens.

Common questions

Will the allow rule bypass my WAF custom rules?

Allow IP Access Rules take effect before WAF custom rules and managed rules, so yes — the gateway IP is exempt from them on that zone. Traffic still has to come through Reach, where each member is MFA-authenticated.

Can I use this to restrict an origin to Reach only?

Not with an allow rule alone. Combine it with a WAF custom rule that blocks everything not matching your gateway IPs, or put the origin behind Cloudflare Access — Reach's allow rule then keeps your team from being challenged.

One token for several zones?

Yes if you scope the token to multiple zones, but the connection stores one zone ID per target. Add one target per zone.