Network firewall gets threat intelligence and edge-level visibility

Magic Firewall, Cloudflare's network-layer firewall-as-a-service, is adding three capabilities aimed at modern security teams: threat intel integration, geo-blocking, and packet captures at the edge. The updates extend the service's reach beyond its existing rule-based packet filtering to include context-aware security decisions and better tooling for network debugging.

Magic Firewall operates at OSI Layers 3 and 4, applying security policies to IP packets and connections rather than Application Layer (Layer 7) traffic like HTTP. This distinction matters for organizations that want extra network defenses without decrypting traffic at higher layers. The new features address two common gaps in that model: knowing which IPs to trust, and seeing what is actually happening on the network.

Managed threat feeds and custom IP lists

Static firewall rules work when you know exactly what to allow or block, but determining whether an IP is a legitimate endpoint or part of a botnet is harder to encode in a rule. Magic Firewall now integrates with Cloudflare's Threat Intelligence feed, which is derived from the roughly 28 million HTTP requests Cloudflare sees per second and the 76 billion cyber threats it blocks daily. The feed is also augmented with third-party vendor data.

The managed categories include:

  • Malware — IPs distributing malware
  • Botnet Command-and-Control — known C&C centers
  • Anonymizer — known forward proxies used to hide attacker IPs

Rules can match against these lists directly in the UI, alongside support for custom lists. Administrators can define their own sets of IPs, for instance to maintain a canonical list of internal servers that can be referenced across multiple rules without duplication.

Geo-blocking without list maintenance

Geographic restrictions have historically been painful because IP geolocation data changes as addresses are reassigned between countries. Magic Firewall now ships with country-level lists maintained by Cloudflare, so administrators can block or allow traffic by country with a simple rule match. No manual list upkeep is required.

Packet captures across the entire network

Traditional packet capture workflows require logging into each router or firewall—often from different vendors across on-premises, branch offices, and cloud environments—and running a tool like tcpdump with hand-rolled filters. Because Magic Firewall is a single network firewall service, it can capture packets across the whole network in one operation, giving visibility into where a particular IP interacts with your infrastructure regardless of location.

Captures support optional filters using the same Wireshark syntax as Magic Firewall rules, so you can narrow the scope instead of pulling down all traffic. For example:

(ip.src in $cf.anonymizer)

Threat intel, geo-blocking, and IP lists are available now via account team activation. Packet captures enter early access later in December.