Cloudflare Access + WAF (without tunnel)?

Zero Trust Access
1

What is the name of the domain?

mytool.example.com

What is the issue you’re encountering

I’m wanting to understand whether it’s possible to use Cloudflare Access to allow an authenticated user access to a web application, where that web application is otherwise accessible via allowlisted IPs (in Cloudflare WAF).

What steps have you taken to resolve the issue?

Hi, I have an internal web application which is hosted on a subdomain. I currently use a WAF ruleset to allow users to access the application (which has its own auth) via some allowlisted IPs.

If I set up Cloudflare Access with an IdP (such as Okta) and allow users to authenticate, can I then pass this authenticated state to the Cloudflare WAF, so that those users/sessions can access bypass the firewall rules and access the application?

2

Hi @cloudyweather,

Unfortunately, this wouldn’t work as there is no way to pass an authenticated state to the WAF. Do note that if you use Access, the Cloudflare Access login page would block unwanted traffic as unauthenticated users will not be able to access your site.

3

You can remove the WAF IP rules and manage this all through Access policies / IP Access rules.