Allowlisting External Scans in Cloudflare

Cloudflare's Web Application Firewall (WAF) provides a strong layer of security for internet-facing applications and sites, but it is recommended to allow external scanners to bypass the WAF in order to get complete visibility into the assets underneath. This ensures that any issues are addressed that could be exposed if the WAF fails or an attacker finds a way to bypass the protections.

Adding a Custom Rule to the WAF

1. From the Security menu on the left, select WAF
2. Click on the Custom Rules tab
3. Click Create a Firewall Rule, and enter a name (e.g. Nodeware Scanning Bypass)
4. In the Field dropdown under If incoming requests match... select IP Source Address
5. Change the Operator dropdown to is in
6. In the Value field, enter the address blocks specified on the Sites & Interfaces view under Manage Customer in the Nodeware dashboard
7. Under the Then take action... header, select Skip in the dropdown
8. Select all of the check boxes in the WAF components to skip list
9. Click More components to skip, select all check boxes
10. When finished, click Deploy

This will allow the Nodeware External scanners to fully scan the Cloudflare protected hosts without interference. For more information, reference Cloudflare documentation here.