Egress policies for dedicated IPs: from blanket rules to per-flow control
Dedicated egress IPs have long served as a bridge for organizations moving from legacy network security to Zero Trust. The model is straightforward: instead of deploying hardware to guarantee a static source IP for allowlisting, Cloudflare customers can lease a fixed set of IPs that only their proxied traffic egresses from. That gives SaaS providers and third-party services a stable address to validate against.
What it did not give administrators was granularity. Once dedicated egress IPs were enabled, all proxied traffic for the account used them—even traffic that did not need the static address. Cloudflare is now addressing that with Gateway egress policies, allowing administrators to decide, per policy, when traffic uses a dedicated egress IP and when it falls back to the shared enterprise pool.
The feature is available to enterprise-contracted customers who have added dedicated egress IPs to their Zero Trust subscription.
Why granular egress matters
Legacy secure web gateways made it easy to enforce allowlists based on source IP. When users were anchored to an office, a static egress address was a dependable signal. But today’s workforce is distributed, and organizations are retiring on-premise appliances in favor of cloud-delivered proxies. For those that still must satisfy third-party allowlist requirements, dedicated egress IPs replace the need for VPNs or backhauled traffic.
The problem arises when a single organization needs static IPs for only a portion of its traffic. Routing all users through a dedicated egress location forces traffic to take a suboptimal path for everything else, degrading the experience for browsing destinations that have no such requirement. Egress policies resolve this by letting administrators separate the traffic that needs a fixed source IP from the traffic that does not.
Use cases for policy-driven egress
Egress policies match on attributes including identity, device posture, source and destination IP, and geolocation. Two scenarios illustrate the utility.
The first is geo-specific egress. A global media conglomerate working with Cloudflare has marketing staff in India who need to verify how advertisements and websites render in other countries. Those sites restrict or alter access based on the visitor’s source IP geolocation. Previously, the team needed a separate VPN for this verification work—a hole in the perimeter and one more service to maintain. An egress policy can match the destination country or domain IP and egress only that traffic from a dedicated IP located in the target country, while the rest of the organization’s traffic continues through normal paths.
The second is third-party allowlisting. A large credit processor working with Cloudflare uses an external vendor to assess transaction risk. The vendor requires source IP allowlisting. Using dedicated egress IPs for all traffic would satisfy the vendor but would degrade performance for every other destination. An egress policy can scope the dedicated IPs to only traffic bound for that vendor, letting all other traffic egress from the shared Cloudflare pool for optimal routing.
Configuring egress policies
Policy configuration begins under Gateway > Egress Policies in the Zero Trust dashboard. From there, an administrator selects Create egress policy.
As an example, consider an organization where most users of a third-party service are in Portugal. The administrator can assign dedicated egress IPs located in Montijo, Portugal, and build a rule that matches traffic to the vendor’s domain, which resolves to 203.0.113.10, using the destination IP selector.
Creating a single policy is not enough. To prevent dedicated egress IPs from being used for unrelated destinations, the administrator should add a catch-all policy. That rule ensures all other traffic uses the default shared Cloudflare egress IPs, preserving network performance and user privacy.
With both policies enabled, users accessing the third-party service will egress from the assigned dedicated IPv4 or IPv6 addresses, and all other traffic will use the default Cloudflare egress pool.
Control without compromise
Organizations moving off on-premise appliances still need the control that static IPs provided—but they should not have to accept degraded routing for the entire workforce to get it. Gateway egress policies let administrators apply fixed IPs where they are contractually or operationally required and retain the flexibility of the shared pool everywhere else. Dedicated egress IPs can be added to a Cloudflare Zero Trust Enterprise plan or through an account manager.
