Cloudflare 管理者ログインの送信元IPの制限

# 目的

Cloudflare ダッシュボードへのアクセスに対してかけられる「送信元IPの制限」について確認します。

```mermaid:
%%{init: {'themeCSS': 'img {width: 48px; height:48px;}'}}%%
graph BT

Dash[<img src='https://cf-icons.pages.dev/internet-browser.svg' width='48' height='48'/><br>Cloudflare Dashboard]:::transparent

subgraph APIToken [API Token]
AccountOwned[<img src='https://cf-icons.pages.dev/api.svg' width='48' height='48'/><br>Account Owned Token]:::transparent
UserOwned[<img src='https://cf-icons.pages.dev/api.svg' width='48' height='48'/><br>User Owned Token]:::transparent
end

subgraph Access [Cloudflare Access]
subgraph SSO["Application - SSO App"]
Policy[<img src='https://cf-icons.pages.dev/cloudflare-access.svg' width='48' height='48'/><br>Allow Policy<br>• Include - Emails ending in @company.email<br>• Require - IP List / IP ranges]
end
end

APIToken ---> |Client IP Address Filtering|Dash

User[<img src='https://cf-icons.pages.dev/user.svg' width='48' height='48'/><br>User]

User --> SSO --> Dash

classDef hidden display: none;
classDef transparent fill-opacity:0,stroke-opacity:0;
style Access fill-opacity:0,stroke-opacity:0;
style SSO fill-opacity:0,stroke-opacity:0;
```

# API トークン
API トークン には、 `Client IP address range filtering` 設定によって、送信元IPの制限を実現できます。

https://developers.cloudflare.com/fundamentals/api/how-to/restrict-tokens/

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/101361/e80bf6fa-c8d9-329b-c8dd-c75af7686358.png)


# Dashboard SSO App ポリシー
Cloudflare Dashboard では、Enterprise 契約プランにおいて、SSO を構成できます。

https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/dash-sso-apps/

https://qiita.com/khayama/items/5676cb87402862345457

https://qiita.com/khayama/items/abf0076c5d7514f2a45e

SSO 構成後にポリシーに `Require - IP List / IP ranges` の条件を追加して、送信元IPの制限を実現できます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/101361/c3c96284-9818-4a5e-27b4-a5cc57226cd0.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/101361/f8279597-60bb-ac5a-9a83-1f964b1533a0.png)

## 参考 : Allow / Block ログ

Dashboard SSO App の、送信元IPの制限ポリシーのログは以下のように確認できます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/101361/245597a9-50ec-c377-12a7-f01c4f824240.png)

以下のログでは `Allowed` フィールドの `true` / `false` で Allow / Block を確認できます。

```json:allow_log.json
{
  "Action": "login",
  "Allowed": true,
  "AppDomain": "xxx.cloudflareaccess.com/cdn-cgi/access/sso/saml/xxx",
  "AppUUID": "b46bb9e4-16bc-4b2a-814b-a0bc2accaa36",
  "Connection": "okta",
  "Country": "jp",
  "CreatedAt": "2024-12-18T04:15:30Z",
  "Email": "xxx@xxx.company",
  "IPAddress": "x.x.x.x",
  "PurposeJustificationPrompt": "",
  "PurposeJustificationResponse": "",
  "RayID": "8f3c54fa2815f6e5",
  "TemporaryAccessApprovers": [],
  "TemporaryAccessDuration": 0,
  "UserUID": "b833f41e-c58a-4a53-b89b-74ee79409589"
}
```

```json:block_log.json
{
  "Action": "login",
  "Allowed": false,
  "AppDomain": "xxx.cloudflareaccess.com/cdn-cgi/access/sso/saml/xxx",
  "AppUUID": "b46bb9e4-16bc-4b2a-814b-a0bc2accaa36",
  "Connection": "okta",
  "Country": "jp",
  "CreatedAt": "2024-12-18T04:13:00Z",
  "Email": "xxx@xxx.company",
  "IPAddress": "y.y.y.y",
  "PurposeJustificationPrompt": "",
  "PurposeJustificationResponse": "",
  "RayID": "8f3c514d4821d50c",
  "TemporaryAccessApprovers": [],
  "TemporaryAccessDuration": 0,
  "UserUID": "b833f41e-c58a-4a53-b89b-74ee79409589"
}
```

# まとめ

Cloudflare 管理者ログインについて、以下を対象に「送信元IPの制限」ができることを確認しました。

- API トークン
- SSO ユーザ