Cloudflare Gateway Adds Network-Level Policy Enforcement
Cloudflare Gateway has expanded beyond DNS filtering and HTTP inspection to include network-based policy controls. Administrators can now define rules based on network selectors such as source and destination IP, source port, and destination port—covering traffic like SSH that doesn't fit neatly into HTTP-layer inspection.
The new capability extends the identity-aware model Cloudflare Access already provides for named applications to all network traffic. Because Cloudflare for Teams integrates with identity providers, organizations can enforce per-user network policies regardless of where a user is located or which device they're using.
Cloudflare positions this as part of its broader Cloudflare One initiative, which aims to provide multiple on-ramps to Cloudflare's edge. When combined with Magic WAN, Gateway's network policies can also govern traffic flowing between sites and data centers, not just traffic leaving individual endpoints.
Replacing Legacy Firewalls and Extending Zero Trust
The move addresses two recurring customer pain points. First, organizations want to retire on-premise network firewall appliances, which are costly to maintain and force users to backhaul traffic to a central chokepoint. Those appliances traditionally gave security teams control over which ports and IPs devices could reach—control that Gateway now provides from the cloud without the infrastructure overhead.
Second, Zero Trust adoption typically starts with named resources like applications. But customers migrating to that model want the same granular, identity-based control over all network traffic, not just HTTP. Network policies in Gateway bring Zero Trust principles to the full range of TCP traffic leaving an endpoint.
How Network Policies Are Enforced
The feature builds on the Cloudflare WARP agent, which runs on macOS, Windows, iOS, Android, and (soon) Linux. WARP operates in two modes:
- DNS filtering: WARP acts as a DNS-over-HTTPS (DoH) client, sending queries to a nearby Cloudflare data center where Gateway can filter for malicious domains.
- Proxy mode: WARP establishes a WireGuard tunnel to Cloudflare's edge and sends all network traffic through it, allowing Gateway to inspect HTTP and, now, enforce network-layer policies.
In proxy mode, WARP forwards all outbound TCP traffic along with the enrolled user's identity. Gateway checks each connection against four criteria:
- Source IP or network
- Source port
- Destination IP or network
- Destination port
Rules can target all of an organization's traffic or specific users and directory groups. Even when traffic is allowed, Gateway logs the identity and the four selector values for audit purposes.
Policy evaluation happens at Cloudflare's edge, which spans data centers in over 200 cities. This avoids the latency and hairpinning associated with backhauling traffic to a central firewall. Rules are enforced using Cloudflare's Rust-based Wirefilter execution engine, the same technology used for IP-based filtering in its reverse proxy firewall.
Example: Controlling SSH Access by Group
SSH illustrates the utility of identity-aware network policies. It's a versatile protocol for connecting to remote machines, but its ability to tunnel traffic makes it a security concern. An organization might start by blocking all outbound SSH traffic:
That policy would promptly frustrate engineers who rely on SSH for development work. The fix is to add a rule that allows SSH for the engineering group in the identity provider, placing it above the blanket block to leverage rule precedence:
With that configuration, engineers can use SSH from any corporate device and any location, while all other users remain blocked.
Extending Policies to Private Networks
Network policies also apply to private networks built on Cloudflare Tunnel. Cloudflare announced support for private networks last month, enabling organizations to connect environments using private IP space and route traffic between sites via WARP users, without centralized VPN concentrators.
Now administrators can apply identity-based access rules to traffic within those private networks. The same engineer needing SSH access to an internal development server, for instance, can be granted access via a network policy while other users are denied—even though the destination is a private, non-Internet resource.
Cloudflare says it will continue building out Zero Trust Network Access policies, with future work aimed at helping organizations secure applications that use private hostnames and IPs just as they can today with public-facing apps.
