Firewall

Source: src/Cloudflare/DNS/Firewall.ts

A Cloudflare DNS Firewall cluster.

DNS Firewall sits in front of your authoritative DNS infrastructure, caching responses on Cloudflare’s anycast network and shielding the upstream nameservers from attack traffic. Creating a cluster assigns a set of Cloudflare anycast IPs (dnsFirewallIps) that you point NS glue records at; queries hitting those IPs are answered from cache or forwarded to your upstreamIps.

DNS Firewall is a paid add-on (typically Enterprise / contract). On accounts without the entitlement, creation fails with the typed DnsFirewallNotEntitled error (Cloudflare error code 10101).

All settings are mutable in place; only name (the cold-state recovery identity) triggers a replacement.

Creating a Cluster

Basic cluster

const cluster = yield* Cloudflare.DNS.Firewall("dns-shield", {
  upstreamIps: ["192.0.2.1", "192.0.2.2"],
});
// Point NS glue records at the assigned anycast IPs:
const ips = cluster.dnsFirewallIps;

Tuned caching and attack mitigation

const cluster = yield* Cloudflare.DNS.Firewall("dns-shield", {
  upstreamIps: ["192.0.2.1"],
  minimumCacheTtl: 120,
  maximumCacheTtl: 3600,
  negativeCacheTtl: 300,
  ratelimit: 600,
  retries: 2,
  attackMitigation: {
    enabled: true,
    onlyWhenUpstreamUnhealthy: true,
  },
});

Reverse DNS

const cluster = yield* Cloudflare.DNS.Firewall("dns-shield", {
  upstreamIps: ["192.0.2.1"],
  reverseDns: {
    "203.0.113.1": "ns1.example.com",
  },
});