Firewall change review board for IP block and allow requests

Build me a firewall change review board that replaces the spreadsheet my team uses for block and allowlist requests. Anyone on the team submits a request, the app vets it against threat intelligence straight away, and a second person has to approve before anything is applied to Cloudflare.

The main view is a board with four columns: Requested, Under review, Applied, and Rejected. Each card shows the target address or range, the direction (block or allow), who requested it, the AbuseIPDB abuse confidence score, the VirusTotal detection counts, and the expiry date if the rule is temporary. Cards move across the columns as the request progresses, and clicking one opens a detail view with the full justification, the vetting results, and the timeline.

The submit form is a fixed request template so reviewers never have to chase missing information. Capture: the target (single IP, CIDR range, ASN, or country), the direction (block, allow, or challenge), a required business justification, the affected systems, a risk level, the Cloudflare zone the rule applies to, and whether the rule is permanent or temporary with an expiry date. Populate the zone picker using Cloudflare List Zones.

When a request is submitted, vet it immediately. Call AbuseIPDB Check IP Reputation for the target and show the abuse confidence score (0 to 100), total reports, last reported date, ISP, usage type, and country. Call VirusTotal Get an IP Address Report and show the harmless, malicious, and suspicious engine counts plus the reputation value and network owner. Call Cloudflare List IP Access Rules for the selected zone and show whether a matching or overlapping rule already exists, along with its current mode, so nobody creates a duplicate or a rule that contradicts one already in place. Save the vetting results onto the request record with a timestamp rather than refetching on every render, because VirusTotal free keys allow only 4 lookups per minute and 500 per day.

The rule I most want enforced: any request to ALLOW an address that AbuseIPDB scores above 25 gets a loud warning banner on both the card and the detail view, because that is the dangerous direction. Show the score, the report count, and the top reported abuse categories right next to the warning, and make the approver type an explicit acknowledgement before the approve control unlocks. A high score on a block request is the normal case and needs no warning at all.

Enforce separation of duties. The person who submitted a request can never approve it. When the current user is the requester, disable the approve and reject controls and show the reason on the control rather than hiding it. Every decision records who made it and when.

Approving a request calls Cloudflare Create IP Access Rule with the target, the requested mode, and the business justification written into the rule notes so the reason is visible inside Cloudflare too. Store the returned rule id on the request and move the card to Applied. Removing a rule, whether it expired or is simply no longer wanted, calls Cloudflare Delete IP Access Rule with the stored id and records who removed it and when.

Add a separate Expiring soon view listing every applied rule with an expiry inside the next 30 days plus everything already past its expiry date, sorted soonest first, with Extend and Remove now actions on each row. Highlight past-expiry allow rules the hardest, since stale allowlist entries with no end date are a standard firewall audit finding.

Keep a full audit trail on every request: who requested it and when, the reputation scores captured at submission time, who reviewed it, who approved or rejected it and any comment they left, when it was applied, the Cloudflare rule id, and when it was removed. Show the timeline on the request detail view and let me export the trail for firewall audits. Requests, vetting snapshots, approvals, and timeline entries all persist in the app so the history survives after the rule itself is deleted from Cloudflare.