Skip to content

[Spectrum, WAF] Add limitation #29718

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pedrosousa wants to merge 2 commits into
base: production
Choose a base branch
from
+8 −3
Open

[Spectrum, WAF] Add limitation #29718

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
870f0c6
[Spectrum, WAF] Add limitation
pedrosousa Apr 9, 2026
605974d
Undo change to aside
pedrosousa Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/content/docs/spectrum/reference/limitations.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
pcx_content_type: reference
title: Limitations
weight: 0

---

The following limitations apply to different protocols supported by Spectrum.
Expand Down Expand Up @@ -45,3 +44,9 @@ By default, Spectrum is configured to listen on all ports, which can raise conce
When a TCP handshake is initiated to any port for a Spectrum IP, the handshake will always be completed. If there is a Spectrum application configured for the port, the connection will be proxied to origin. If no application is configured, the connection is immediately terminated and no origin connection will be opened.

Spectrum will only ever proxy traffic to an origin if there is a Spectrum application configured for that port.

## IP access control

Currently, [custom rules](/waf/custom-rules/) do not work with Spectrum applications. Use [IP Access rules](/waf/tools/ip-access-rules/) to allowlist, block, and challenge traffic for Spectrum applications based on the request's IP address, Autonomous System Number (ASN), or country.

Refer to [Configuration options](/spectrum/reference/configuration-options/#ip-access-rules) for more information.
4 changes: 2 additions & 2 deletions src/content/docs/waf/tools/ip-access-rules/create.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,14 @@ sidebar:

import { TabItem, Tabs, Steps, DashButton } from "~/components";

:::caution[Recommendation: Use custom rules instead]
:::tip[Recommendation: Use custom rules instead]
Cloudflare recommends that you create [custom rules](/waf/custom-rules/) instead of IP Access rules to perform IP-based or geography-based blocking (geoblocking).
:::

<Tabs syncKey="dashNewNav"> <TabItem label="New dashboard" icon="rocket">

:::note
IP Access Rules are only available in the new security dashboard if you have configured at least one IP access rule. Cloudflare recommends that you use [custom rules](/waf/custom-rules/) instead of IP Access Rules.
IP Access Rules are only available in the new security dashboard if you have configured at least one IP access rule.
:::

<Steps>
Expand Down
Loading