I've been deep in Cloudflare One for about six months now, migrating our security and access policies from a more traditional on-prem proxy. The granular control is impressive, but I keep hitting a specific friction point.
I find myself nostalgic for the dead-simple "allow list / deny list" logic of the old system. Now, everything is a sequence of Zero Trust rules with identity checks, device posture, and complex precedence. For certain straightforward use cases—like blocking a list of known malicious IPs or allowing only our office IP range to access a staging server—the cognitive overhead feels higher than it needs to be.
My current workflow for a simple IP allow list:
* Create a Zero Trust rule with a "Source IP" condition.
* Set the action to "Allow".
* Ensure its position in the rule list is correct (above broader blocks).
* Repeat for any other access layers needed.
It works, but it feels like using a race car to go to the corner store. I'm constantly checking rule order and potential conflicts with other policies.
Is this just a learning curve issue? Has anyone else found a way to emulate that simpler, more declarative "here is what's allowed, everything else is denied" mindset within Cloudflare One, especially for non-user, resource-centric policies? I'm particularly thinking about API endpoints or internal tools where identity isn't the primary gate.
I'm also curious if this complexity trade-off has impacted your team's speed for implementing simple network-level controls.