Filtering by protocol, not port, in Cloudflare Gateway
Cloudflare Gateway, Cloudflare's secure web gateway, now lets administrators detect, log, and filter network protocols regardless of the source or destination port used. The new protocol detection feature allows network policies to be set based on the protocol itself—for example, blocking all SSH traffic on the network—without having to guess which port the traffic is using.
Protocol detection is available today for Enterprise users of Gateway, supporting HTTP, HTTPS, SSH, TLS, DCE/RPC, MQTT, and TPKT, with more protocols planned.
The limits of port-based filtering
Traditional secure web gateways and firewalls typically filter traffic based on well-known port numbers—for instance, blocking port 22 to stop SSH. This approach has significant blind spots. If traffic uses SSH over a non-standard port, it passes through unfiltered. Conversely, if another protocol happens to run on port 22, it gets blocked even if it poses no risk.
Administrators could lock down destination devices to accept connections only on certain ports, but they often do not control those end devices. The result is either over-blocking legitimate traffic (generating support tickets and disrupting users) or under-filtering intended traffic (leaving a security gap).
How protocol detection works under the hood
To make protocol detection performant, Cloudflare built it directly into OXY, the Rust-based policy framework that applies Gateway policies. A new TCP socket pre-read hook buffers the first few bytes of the data stream, allowing Gateway to compare those bytes against a protocol signature database. Depending on the policy outcome, the connection is either closed immediately (block) or proxied and progressed to establish a TLS session (allow).
Enabling and configuring protocol detection
To enable the feature, navigate to the Settings section of the Zero Trust dashboard, select the Network tile, and toggle on protocol detection under the Firewall section.
Once enabled, go to the Firewall Policies section of the Gateway dashboard and click '+ Add a policy'. You can then create rules that reference a protocol directly, such as the example below that blocks SSH for all users in the Sales department.
This rule prevents members of the sales team from initiating outgoing or incoming SSH sessions.
Availability and roadmap
Enterprise customers with a Cloudflare One account can use protocol detection in their Gateway dashboard immediately. Cloudflare plans to extend the feature to Pay-as-you-go and Free customer accounts in the near future, alongside an expanded list of supported protocols.
