Cutting Out Distractions With Cloudflare Gateway

With more people working remotely, the pull of constantly updated news sites is a genuine productivity killer. One straightforward solution is to block those outlets at the network level, so the temptation never even reaches the browser. Cloudflare’s Gateway DNS filtering service makes this easy to set up and even easier to reverse when the workday ends.

Gateway redirects DNS queries through Cloudflare's network, where you can enforce policies that block specific domains or entire content categories. The free tier is sufficient for basic domain-based blocking; setup takes only a couple of minutes.

Initial Gateway Setup

Start by navigating to the Cloudflare for Teams dashboard. If you don't have an account, you’ll be prompted to sign up before you can proceed. The onboarding flow guides you through creating your first location — typically a physical network such as your home or office router.

During setup, the dashboard automatically detects your public IP address and links it to the location. Gateway uses this IP to match DNS requests coming from your router or device. For the configuration to work, you must update your router's DNS settings, removing the current resolvers and pointing to Cloudflare's addresses:

  • 172.64.36.1
  • 172.64.36.2

The exact steps for changing DNS settings vary by router or device vendor, but Cloudflare provides specific setup instructions for a wide range of hardware.

Creating a Blocking Policy

Once Gateway is configured, go to the policies section in the dashboard. Create a new policy and give it a descriptive name like "Deep Work." Then, add the domains of the specific sites you want to suppress — for example, the major cable news networks and Twitter.

After saving the policy, the rules propagate across Cloudflare’s network of data centers. The effect is nearly immediate, taking only seconds to reach every node.

If you'd rather avoid picking individual domains, Gateway also supports category-based filtering. Selecting a category such as "Sports" blocks all sites associated with that topic, which is a practical way to eliminate a whole class of time sinks at once. Note that pre-defined content categories have limited functionality on the free tier.

Verifying the Block

To confirm the policy is active, navigate to one of the blocked websites. Your browser will be served a page stating that the site is unreachable — this is Gateway intercepting the DNS query and refusing to resolve the hostname.

For a more direct test from the command line, use dig or nslookup on a blocked domain. The DNS response will show status: REFUSED, which indicates the policy is enforcing correctly.

When you're ready to rejoin the news cycle, simply update or delete the policy at the dashboard. The change is just as fast as enabling it, turning your web access back on without any lingering configuration overhead.