Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Fundamentals] Revised how CF works #19997

Open
wants to merge 8 commits into
base: production
Choose a base branch
from
+21 −33
Open

[Fundamentals] Revised how CF works #19997

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6f44e4b
Revised how CF works
dcpena Feb 14, 2025
625c52d
Fixed links
dcpena Feb 14, 2025
eb48d70
Apply suggestions from code review
dcpena Feb 19, 2025
7e7163e
Update src/content/docs/fundamentals/concepts/how-cloudflare-works.mdx
dcpena Feb 19, 2025
ed36f4f
Update src/content/docs/fundamentals/concepts/how-cloudflare-works.mdx
dcpena Feb 19, 2025
fe0a236
Implemented review feedback & added note
dcpena Feb 19, 2025
05b8c70
Apply suggestions from code review
dcpena Feb 19, 2025
17fca67
moved content and note
dcpena Feb 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added src/assets/images/fundamentals/reverse-proxy.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
55 changes: 20 additions & 35 deletions src/content/docs/fundamentals/concepts/how-cloudflare-works.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,61 +1,46 @@
---
pcx_content_type: concept
title: How Cloudflare works
title: How Application Security works
sidebar:
order: 2

---

import { GlossaryTooltip } from "~/components"

The [Cloudflare global network](https://www.cloudflare.com/network/) can improve the security, performance, reliability, and privacy of anything connected to the Internet, such as your website, SaaS application, or corporate network.
To optimize your website or web application, Cloudflare acts as a [DNS provider](https://www.cloudflare.com/learning/dns/what-is-dns/) for your domain and a [reverse proxy](https://www.cloudflare.com/learning/cdn/glossary/reverse-proxy/) for your web traffic.

## Application Services

To optimize your website or web application, Cloudflare acts as a [DNS provider](https://www.cloudflare.com/learning/dns/what-is-dns/) for your domain, and a [reverse proxy](https://www.cloudflare.com/learning/cdn/glossary/reverse-proxy/) for your web traffic.
## DNS explained

### How Cloudflare works as a DNS provider
The Domain Name System (DNS) provider is like the phonebook of the Internet and tells your browser where a website's content lives. Each domain name–such as cloudflare.com–is mapped to an Internet Protocol (IP) address; the IP address is a numerical label assigned to a website that looks like `103.21.244.0`, for example.

We support a few different [setups](/dns/zone-setups/) for using Cloudflare as a DNS provider. A [full DNS setup](/dns/zone-setups/full-setup/) is the most common, where Cloudflare becomes the primary authoritative DNS provider for your domain, after you [connect your domain to Cloudflare](/fundamentals/setup/manage-domains/connect-your-domain/). This means we respond to DNS queries for your domain, and you [manage its DNS records](/dns/manage-dns-records/how-to/create-dns-records/) via the Cloudflare dashboard or API.
If DNS is the phonebook of the Internet, the IP address is like a home address, and the domain name is the human-friendly name.

When Cloudflare receives a DNS query for your domain, our response is determined by the configuration [set in your DNS table](/dns/manage-dns-records/how-to/create-dns-records/), including the value of the record, the record's [proxy eligibility](/dns/proxy-status/limitations/#proxy-eligibility), and its [proxy status](/dns/proxy-status/).
After you add a site to Cloudflare under a full DNS setup, Cloudflare becomes the primary authoritative DNS provider for your domain. As the authoritative DNS provider, Cloudflare responds to DNS queries for your domain, and you manage your domain's DNS records via the Cloudflare dashboard or API.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
After you add a site to Cloudflare under a full DNS setup, Cloudflare becomes the primary authoritative DNS provider for your domain. As the authoritative DNS provider, Cloudflare responds to DNS queries for your domain, and you manage your domain's DNS records via the Cloudflare dashboard or API.
After you add a site to Cloudflare under a full DNS setup, Cloudflare becomes the primary authoritative DNS provider for your domain. As the primary authoritative DNS provider, Cloudflare responds to DNS queries for your domain, and you manage your domain's DNS records via the Cloudflare dashboard or API.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to be super clear, since with secondary setup, CF is authoritative but DNS records are managed on an external provider.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also just realized after reading through that this paragraph sounds more like something that could be under ##Cloudflare as a DNS provider


If the [domain's status](/dns/zone-setups/reference/domain-status/) is active and the queried DNS record is set to `proxied`, then Cloudflare responds with an [anycast IP address](/fundamentals/concepts/cloudflare-ip-addresses/), **instead of** the value defined in your DNS table. This effectively re-routes the `HTTP/HTTPS` requests to the Cloudflare network, instead of directly reaching the targeted the [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server/).
A DNS query is like asking for directions to a place, and the DNS records are instructions that live in authoritative [DNS servers](https://www.cloudflare.com/learning/dns/dns-server-types/) and provide information about a domain. The DNS record contains information such as the [IP address](https://www.cloudflare.com/learning/dns/glossary/what-is-my-ip-address/) associated with a domain and how to handle requests for the domain.

In contrast, if the queried DNS record is set to `DNS only`, meaning the proxy is off, then Cloudflare responds with the value defined in your DNS table (that is, an IP address or CNAME record). This means `HTTP/HTTPS` requests route directly to the origin server and are not processed or protected by Cloudflare.

### How Cloudflare works as a reverse proxy
## Cloudflare as a DNS provider

All DNS records in your DNS table have a [proxy status](/dns/proxy-status/), indicating whether or not `HTTP/HTTPS` traffic for that record will route through Cloudflare on its way between the client and the origin server. If the [domain's status](/dns/zone-setups/reference/domain-status/) is active, all `HTTP/HTTPS` requests for [proxied DNS records](/dns/proxy-status/) route through Cloudflare.
When Cloudflare receives a DNS query for your domain, the response is determined by the configuration [set in your DNS table](/dns/manage-dns-records/how-to/create-dns-records/), including the [type of the record](/dns/manage-dns-records/reference/dns-record-types/), the record's [proxy eligibility](/dns/proxy-status/limitations/#proxy-eligibility), and its [proxy status](/dns/manage-dns-records/reference/proxied-dns-records/).

As these requests pass through our network, they are processed according to your [configuration](/fundamentals/setup/manage-domains/connect-your-domain/#domain-configurations). Subsequently, legitimate requests are forwarded to the origin server.
If your [domain's status](/dns/zone-setups/reference/domain-status/) is active and the queried DNS record is set to `proxied`, Cloudflare responds with an [anycast IP address](m/fundamentals/concepts/cloudflare-ip-addresses/), instead of the origin server defined in your DNS table.

Refer to our [Load Balancing reference architecture](/reference-architecture/architectures/load-balancing/) to learn more about advanced ways to forward traffic to your origins (or other <GlossaryTooltip term="endpoint" link="/glossary/?term=endpoint">endpoints</GlossaryTooltip>), as well as our [CDN reference architecture](/reference-architecture/architectures/cdn/) to learn more about how Cloudflare processes and optimizes your web traffic.
Your domain status is active when your nameservers are updated to point to Cloudflare and have been authenticated. The proxy status defines how Cloudflare treats queries for that record. The anycast IP address is used to distribute traffic amongst Cloudflare's network, which protects your origin server from DDos attacks and can help optimize, cache, and protect requests to your application.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Your domain status is active when your nameservers are updated to point to Cloudflare and have been authenticated. The proxy status defines how Cloudflare treats queries for that record. The anycast IP address is used to distribute traffic amongst Cloudflare's network, which protects your origin server from DDos attacks and can help optimize, cache, and protect requests to your application.
Your domain status is active when your [nameservers are updated](/dns/nameservers/update-nameservers/) to point to Cloudflare and have been authenticated. The proxy status defines how Cloudflare treats queries for that record. The anycast IP address is used to distribute traffic amongst Cloudflare's network, which protects your origin server from DDos attacks and can help optimize, cache, and protect requests to your application.


:::note
## Cloudflare as a reverse proxy

Proxying is on by default for records that serve `HTTP/HTTPS` traffic (`A`, `AAAA`, and `CNAME` records). To proxy `HTTP/HTTPS` traffic on [non-standard ports](/fundamentals/reference/network-ports/) or to proxy a `TCP-` or `UDP-` based application, use [Cloudflare Spectrum](/spectrum/).
:::
A reverse proxy is a server that sits in front of web servers and forwards client (for example, web browser) requests to those web servers. Reverse proxies are typically implemented to help increase security, performance, and reliability.

In the Cloudflare dashboard, find out which DNS records are proxied by selecting your domain and navigating to the **DNS records** tab.
![The flow of a request from a server through Cloudflare to the origin server when Cloudflare is a reverse proxy.](~/assets/images/fundamentals/reverse-proxy.png)

#### Example DNS table
When DNS records in your DNS table have a `proxied` status, the record's HTTP/HTTPS traffic will route through Cloudflare on its way between the client and the origin server. If the domain's status is active, all HTTP/HTTPS requests for proxied DNS records route through Cloudflare.

| Type | Name | Content | Proxy status | TTL | Actions |
| :--: | :----: | :---------: | :----------: | :----: | ------: |
| `A` | `blog` | `192.0.2.1` | `Proxied` | `Auto` | `Edit` |
| `A` | `shop` | `192.0.2.2` | `DNS only` | `Auto` | `Edit` |
Using Cloudflare as a reverse proxy has several benefits, including:

In the example DNS table above, there are two DNS records. The record with the name `blog` has the proxy on, while the record named `shop` has the proxy off (that is, `DNS only`).

#### Proxied DNS record example

When the browser initiates a `HTTP/HTTPS` request to `blog.example.com`, a DNS resolver will convert the hostname into an IP address. Since this domain is using Cloudflare as its Authoritative DNS provider, the DNS query will be routed to Cloudflare; and because the proxy is on, Cloudflare will answer with an anycast IP address. Subsequently, the browser initiates a `HTTP/HTTPS` request back to Cloudflare. When Cloudflare receives this request, it performs a lookup to find the matching domain and account configuration and processes the request accordingly. Cloudflare forwards it to the configured origin server, which is `192.0.2.1`.

#### DNS only record example

When the browser initiates a `HTTP/HTTPS` request to `shop.example.com`, a DNS resolver will convert the hostname into an IP address. Since this domain is using Cloudflare as its Authoritative DNS provider, the DNS query will be routed to Cloudflare; but since the proxy is off (that is, `DNS only`), Cloudflare will answer with `192.0.2.2`. Finally, the browser initiates a `HTTP/HTTPS` request to the server hosted at `192.0.2.2`.

#### HTTP methods Cloudflare supports

Cloudflare supports all standard HTTP methods, with the exception of `CONNECT`, `TRACE`, and `PURGE`, which are restricted.
- **Load balancing** A reverse proxy can provide a load balancing solution which will distribute the incoming traffic evenly among the different servers to prevent any single server from becoming overloaded. In the event that a server fails completely, other servers can step up to handle the traffic.
- **Protection from attacks.** With a reverse proxy in place, a web site or service never needs to reveal the IP address of their origin servers, which makes it much harder for attackers to leverage a targeted attack against them, such as a DDoS attack. Instead the attackers will only be able to target the reverse proxy, such as Cloudflare's CDN, which will have tighter security and more resources to fend off a cyber attack.
- **Caching.** A reverse proxy can also cache content, resulting in faster performance. For example, if a user in Paris visits a reverse-proxied website with web servers in Los Angeles, the user might actually connect to a local reverse proxy server in Paris, which will then have to communicate with an origin server in L.A. The proxy server can then cache (or temporarily save) the response data. Subsequent Parisian users who browse the site will then get the locally cached version from the Parisian reverse proxy server, resulting in much faster performance.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may be worth appending with a sentence quickly introducing what SSL/TLS is? Something along the lines of SSL/TLS is essential. Without an SSL/TLS certificate, your visitors will find a warning on their browser stating that your website or application is not secure. However, encrypting...

- **SSL encryption.** Encrypting and decrypting SSL (or TLS) communications for each client can be computationally expensive for an origin server. A reverse proxy can be configured to decrypt all incoming requests and encrypt all outgoing responses, freeing up valuable resources on the origin server.
Loading