Cloudflare.DdosProtection reference

DdosAllowlistEntry

Source: src/Cloudflare/DdosProtection/AllowlistEntry.ts

An Advanced TCP Protection allowlist entry (Magic Transit).

Traffic from an allowlisted prefix bypasses Advanced TCP Protection entirely. An entry’s identity is its prefix — only comment and enabled are mutable in place; changing the prefix triggers a replacement.

Requires the Magic Transit / Advanced TCP Protection entitlement; on accounts without it every API call fails with the typed AdvancedTcpProtectionNotEntitled error.

Safety: allowlist entries carry no ownership markers. When there is no prior state, read scans for an existing entry with the same prefix and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

DdosAllowlistEntry: Creating an allowlist entry

Allowlist a trusted prefix

const entry = yield* Cloudflare.DdosProtection.DdosAllowlistEntry("OfficeEgress", {
  prefix: "192.0.2.0/24",
  enabled: true,
});

Staged entry with an explicit comment

// `enabled: false` keeps the entry inert until you flip it on.
yield* Cloudflare.DdosProtection.DdosAllowlistEntry("PartnerRange", {
  prefix: "198.51.100.0/24",
  comment: "partner NAT range — enable during migration",
  enabled: false,
});

SynProtectionFilter

Source: src/Cloudflare/DdosProtection/SynProtectionFilter.ts

An Advanced TCP Protection SYN Protection filter (Magic Transit).

Filters gate which traffic the SYN Protection rules see, per mode: an enabled filter scopes mitigation, a monitoring filter scopes observe-only analysis, and a disabled filter excludes traffic. Both expression and mode are mutable in place.

Requires the Magic Transit / Advanced TCP Protection entitlement; on accounts without it every API call fails with the typed AdvancedTcpProtectionNotEntitled error.

Safety: filters carry no ownership markers. When there is no prior state, read scans for an existing filter with the same expression and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

SynProtectionFilter: Creating a filter

Scope SYN mitigation to HTTPS traffic

const filter = yield* Cloudflare.DdosProtection.SynProtectionFilter("HttpsOnly", {
  expression: "tcp.dstport in {443}",
  mode: "enabled",
});

Monitor a port range without mitigating

yield* Cloudflare.DdosProtection.SynProtectionFilter("WatchHighPorts", {
  expression: "tcp.dstport in {8000..8999}",
  mode: "monitoring",
});

SynProtectionRule

Source: src/Cloudflare/DdosProtection/SynProtectionRule.ts

An Advanced TCP Protection SYN flood rule (Magic Transit).

Rules tune how Cloudflare mitigates SYN floods on Magic Transit prefixes, per scope (global, a region, or a data center). The rule’s identity is its scope + name pair — only mode, sensitivities, and mitigationType are mutable in place.

Requires the Magic Transit / Advanced TCP Protection entitlement; on accounts without it every API call fails with the typed AdvancedTcpProtectionNotEntitled error.

Safety: rules carry no ownership markers. When there is no prior state, read scans for an existing rule with the same scope + name and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

SynProtectionRule: Creating a rule

Global SYN protection in monitoring mode

const rule = yield* Cloudflare.DdosProtection.SynProtectionRule("GlobalSyn", {
  scope: "global",
  mode: "monitoring",
  burstSensitivity: "medium",
  rateSensitivity: "medium",
});

Data-center scoped rule with retransmit mitigation

yield* Cloudflare.DdosProtection.SynProtectionRule("SjcSyn", {
  scope: "datacenter",
  name: "SJC",
  mode: "enabled",
  burstSensitivity: "high",
  rateSensitivity: "high",
  mitigationType: "retransmit",
});

TcpFlowProtectionFilter

Source: src/Cloudflare/DdosProtection/TcpFlowProtectionFilter.ts

An Advanced TCP Protection TCP Flow Protection filter (Magic Transit).

Filters gate which traffic the TCP Flow Protection rules see, per mode: an enabled filter scopes mitigation, a monitoring filter scopes observe-only analysis, and a disabled filter excludes traffic. Both expression and mode are mutable in place.

Requires the Magic Transit / Advanced TCP Protection entitlement; on accounts without it every API call fails with the typed AdvancedTcpProtectionNotEntitled error.

TcpFlowProtectionFilter: Creating a filter

Scope flow mitigation to HTTPS traffic

const filter = yield* Cloudflare.DdosProtection.TcpFlowProtectionFilter("HttpsOnly", {
  expression: "tcp.dstport in {443}",
  mode: "enabled",
});

Exclude a trusted source port

yield* Cloudflare.DdosProtection.TcpFlowProtectionFilter("SkipBgp", {
  expression: "tcp.srcport in {179}",
  mode: "disabled",
});

TcpFlowProtectionRule

Source: src/Cloudflare/DdosProtection/TcpFlowProtectionRule.ts

An Advanced TCP Protection out-of-state TCP flow rule (Magic Transit).

Rules tune how Cloudflare mitigates out-of-state TCP packet floods (ACK, RST, …) on Magic Transit prefixes, per scope (global, a region, or a data center). The rule’s identity is its scope + name pair — only mode and the sensitivities are mutable in place.

Requires the Magic Transit / Advanced TCP Protection entitlement; on accounts without it every API call fails with the typed AdvancedTcpProtectionNotEntitled error.

TcpFlowProtectionRule: Creating a rule

Global TCP flow protection in monitoring mode

const rule = yield* Cloudflare.DdosProtection.TcpFlowProtectionRule("GlobalFlow", {
  scope: "global",
  mode: "monitoring",
  burstSensitivity: "medium",
  rateSensitivity: "medium",
});

Region-scoped rule

yield* Cloudflare.DdosProtection.TcpFlowProtectionRule("WeurFlow", {
  scope: "region",
  name: "WEUR",
  mode: "enabled",
  burstSensitivity: "high",
  rateSensitivity: "low",
});