Cloudflare Zero Trust DNS Filtering

Log in to the Cloudflare Dashboard and select Zero Trust from the left-hand navigation.

Click Get started and select the $0 plan.

To add IPs, you need to be using the WAN IP.

Go to Traffic controls -> Resolvers & Proxies. Click on the Add a location button in the top right. Give a location name, turn on IPv4 DNS and for the first location, select Set as Default DNS Location.

To make the DNS policies, go to Traffic controls -> Firewall policies -> Add DNS policy. 

For a CIPA filter:

If traffic type is DNS

And traffic matches Content Categories in (CIPA Filter, Ads, Trackers/Analytics, Deceptive Ads, Lingerie & Bikini, Sexuality)

Then Block

To force Safe search:

If traffic type is DNS

And traffic matches location in all locations

Then Safe search

To force Youtube restricted:

If traffic type is DNS

And traffic matches location in all locations

Then Safe search

You also need to block outbound DNS requests to other DNS servers.

You also need to block outbound DoH (DNS over HTTPS) and DoT (DNS over TLS).

In a Unifi firewall:

Settings -> Internet -> WAN1 -> Set DNS servers to the ones from Cloudflare

Settings -> CyberSecure -> Threat Management and turn off Encrypted DNS

Settings -> CyberSecure -> Content Filter -> Remove the filter

Settings -> Policy Table -> Create New Policy

• NAT
• Type: Destination NAT
• Interface: Default (Make a rule for each LAN network)
• Translated IP: 172.64.36.1 (or whatever Cloudflare gave)
• IP Version: IPv4
• Protocol: TCP/UDP
• Destination: Any
• Destination Port: 53
• For the VLANs that need to communicate to AD, but are different than the AD network:
  • Destination: IP
  • Specific List: (LAN IP of AD DNS)
  • Match opposite

Settings -> CyberSecure -> Threat Management -> Simple App Blocking -> Create a new rule, select the LAN networks and select DNS over HTTPS and DNS over TLS applications