Cloudflare Gateway allows you to create custom rules to filter HTTP, DNS, and network traffic based on your firewall policies. This is a collection of scripts that can be used to get a similar experience as if you were using Pi-hole, but with Cloudflare Gateway - so no servers to maintain or need to buy a Raspberry Pi!
cf_list_delete.js
- Deletes all lists created by CGPS from Cloudflare Gateway. This is useful for subsequent runs.cf_list_create.js
- Takes a blocklist.txt file containing domains and creates lists in Cloudflare Gatewaycf_gateway_rule_create.js
- Creates a Cloudflare Gateway rule to block all traffic if it matches the lists created by CGPS.cf_gateway_rule_delete.js
- Deletes the Cloudflare Gateway rule created by CGPS. Useful for subsequent runs.download_lists.js
- Initiates blocklist and whitelist download.blocklist.txt
. Mullvad provides awesome DNS blocklists that work well with this project. A script that downloads recommended blocklists, download_lists.js
, is included.allowlist.txt
. You can also use the get_recomended_whitelist.sh
Bash script to get the recommended whitelists.npm install
to install dependencies..env.example
to .env
and fill in the values.node cf_gateway_rule_delete.js
and node cf_list_delete.js
(in order) to delete old data.node download_lists.js
command to download recommended filter lists (about 250 000 domains).node cf_list_create.js
to create the lists in Cloudflare Gateway. This will take a while.node cf_gateway_rule_create.js
to create the firewall rule in Cloudflare Gateway.These scripts can be run using GitHub Actions so your filters will be automatically updated and pushed to Cloudflare Gateway. This is useful if you are using a frequently updated malware blocklist.
Please note that the GitHub Action downloads the recommended blocklists and whitelist by default. You can change this behavior by setting Actions variables.
CLOUDFLARE_API_TOKEN
: Your Cloudflare API Token with Zero Trust read and edit permissionsCLOUDFLARE_ACCOUNT_ID
: Your Cloudflare account IDCLOUDFLARE_LIST_ITEM_LIMIT
: The maximum number of blocked domains allowed for your Cloudflare Zero Trust plan. Default to 300,000. Optional if you are using the free plan.PING_URL
: /Optional/ The HTTP(S) URL to ping (using curl) after the GitHub Action has successfully updated your filters. Useful for monitoring.DISCORD_WEBHOOK_URL
: /Optional/ The Discord (or similar) webhook URL to send notifications to. Good for monitoring as well.FAST_MODE
: Enable the scripts to send the requests simultaneously. Beware that there's a rate limit of 1200 requests per five minutes (https://developers.cloudflare.com/fundamentals/api/reference/limits/) so make sure you know what you are doing.ALLOWLIST_URLS
: Uses your own allowlists. One URL per line. Recommended allowlists will be used if this variable is not provided.BLOCKLIST_URLS
: Uses your own blocklists. One URL per line. Recommended blocklists will be used if this variable is not provided.BLOCK_PAGE_ENABLED
: Enable showing block page if host is blocked..github/workflows/main.yml
with the contents of auto_update_github_action.yml
found in this repository. The default settings will update your filters every week at 3 AM UTC. You can change this by editing the schedule
property.Alternatively, you can install the Cloudflare WARP client and log in to Zero Trust. This method proxies your traffic over Cloudflare servers, meaning it works similarly to a commercial VPN. You need to do this if you want to use the SNI-based filtering feature, as it requires Cloudflare to inspect your raw traffic (HTTPS remains encrypted if "TLS decryption" is disabled).
To see if e.g. your filter lists are valid without actually changing anything in your Cloudflare account, you can set the DRY_RUN
environment variable to 1, either in .env
or the regular way. This will only print info such as the lists that would be created or the amount of duplicate domains to the console.
Warning: This currently only works for cf_list_create.js
.
MIT License. See LICENSE
for more information.