Identity-Aware Firewalling Comes to Private Networks on Cloudflare

Cloudflare for Teams now supports Zero Trust network policies for traffic inside private networks running on Cloudflare, not just for connections bound for the public Internet. The rules are enforced across Cloudflare’s edge network in over 200 cities, meaning security teams can filter and log traffic without adding latency or backhauling traffic to a central location.

This builds on last week’s release of network-based policies in Cloudflare Gateway, which let teams restrict the IPs and ports devices can reach. That update was aimed at replacing legacy security appliances. The new capability goes further by removing the need for the castle-and-moat model that those appliances enforced.

Why the Old Model No Longer Fits

Traditional private networks trusted any device that could physically connect. That assumption worked when work happened inside an office, but it fell apart once users started roaming. VPNs punched holes into the network for remote workers, but after authenticating, users could typically move laterally to almost any resource. The firewall grew more porous and IP-based segmentation rules were complex to configure and still tied trust to an address rather than a person.

Meanwhile, other parts of the enterprise moved to identity-based access with multi-factor authentication and continuous enforcement. Networking security largely stayed stuck with source-IP rules.

That doesn’t mean private networks should go away. They are still useful for rapid prototyping—spinning up a resource on a private IP can be faster than creating public DNS records. Private IPs can also be reused across internal ranges and are easier to manage without granting everyone DNS edit rights. Some regulatory requirements even prohibit exposing tools publicly.

The shortcomings were usability and security, not the concept itself. Cloudflare’s private networking offering, announced two months ago, replaced VPN appliances with a tunnel-based architecture fronted by Cloudflare’s global network. That solved the usability side. Today’s update addresses the security half: identity-aware Zero Trust policies that apply inside that private network.

Policy Enforcement at the Edge

The architecture has not changed. A secure TCP tunnel built with cloudflared connects your private network to Cloudflare’s edge, and the tunnel is only reachable by authorized connections. Users run the WARP client to forward their traffic to Cloudflare and reach private IPs without performance penalties or long backhauls.

What is new is inline Layer 4 firewall enforcement. Every TCP connection arriving at Cloudflare now passes through that firewall, regardless of whether Layer 7 inspection or HTTP filtering is enabled. Network-level policies can match traffic by:

  • Source IP address or CIDR range
  • Destination IP address or CIDR range
  • Source port or port range
  • Destination port or port range

That combination lets you apply identity-aware rules down to an individual port across data centers, branch offices and remote users—all without extra hardware.

Configuration Walkthrough

Before setting up policies, you need three pieces in place:

  • cloudflared installed on your private network
  • Private IP ranges routed to Cloudflare’s edge
  • The WARP client deployed on user machines

Once that is done, the Teams Dashboard flow looks like this:

  1. Create a new network policy in Gateway.
  2. Define the IP and port combination to allow access to (for example, an RDP port on a specific private IP).
  3. Attach identity policies—such as limiting access to a named group from your identity provider.

After the policy is saved, only users in that identity group whose machines run WARP can reach the specified IP and port. No additional client software or per-machine configuration is required, and the policy works consistently on any network or device globally.

Roadmap

Cloudflare is planning several enhancements to its Zero Trust private networking offering:

  • Private DNS resolution
  • Handling of conflicting private IP ranges
  • Granular session controls for private network policies
  • Support for east-west traffic between cloudflared endpoints on Cloudflare One, in addition to the current WARP-to-cloudflared client-to-server model

Policies can be configured from the Teams Dashboard, with full documentation available on Cloudflare’s developers site.