Cloudflare IP Access rules / Custom rules / Zone Lockdown の違い

# まとめ

- 基本は Custom rules が推奨で事足りる。
- [Cloudflare Spectrum](https://developers.cloudflare.com/spectrum/) に適用したい場合は IP Access rules を使う
- Custom rules で Zone Lockdown 用のルールテンプレートも用意されており、同等の設定が可能
    - https://dash.cloudflare.com/?to=/:account/:zone/security/waf/custom-rules/new?template=Zone%20lockdown

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/101361/f097a46d-6934-70d0-a625-c8ed619a53ae.png)


|                                                              | [IP Access rules](https://developers.cloudflare.com/waf/tools/ip-access-rules/) | [Custom rules](https://developers.cloudflare.com/waf/custom-rules/) | [Zone Lockdown](https://developers.cloudflare.com/waf/tools/zone-lockdown/) |
| ------------------------------------------------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |
| IP Address                                                   | :white_check_mark:                                           | :white_check_mark: `ip.src`                                  | :white_check_mark:                                           |
| IP Range                                                     | :white_check_mark:                                           | :white_check_mark: `ip.src`                                  | :white_check_mark:                                           |
| Country                                                      | :white_check_mark: (Enterprise only)                         | :white_check_mark: `ip.src.country`                          | No                                                           |
| ASN                                                          | :white_check_mark:                                           | :white_check_mark: `ip.src.asnum`                            | No                                                           |
| URL                                                          | No                                                           | :white_check_mark: `http.request.uri`                        | :white_check_mark:                                           |
| Actions                                                      | • [IP Access rules actions](https://developers.cloudflare.com/waf/tools/ip-access-rules/actions/)<br />Allow (Excludes visitors from all security checks)<br />Block<br />Managed Challenge<br />JavaScript Challenge<br />Interactive Challenge | • [Actions reference](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/)<br />Skip ([Available skip options](https://developers.cloudflare.com/waf/custom-rules/skip/options/))<br />Block (will stop the evaluation of other rules)<br />Log<br />Managed Challenge<br />JS Challenge<br />Interactive Challenge | All IP addresses not specified in the Zone Lockdown rule will not have access to the specified resources. |
| [Lists](https://developers.cloudflare.com/waf/tools/lists/) Feature Availability | No                                                           | :white_check_mark:                                           | No                                                           |
| Applicable to L4 (Spectrum)?                                 | :white_check_mark: [Configuration options](https://developers.cloudflare.com/spectrum/reference/configuration-options/#ip-access-rules) | No                                                           | No                                                           |