JA EN
shiichan

Cloudflare Gateway's Protocol Detection is now available on Free and Pay-as-you-go plans!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's me, Shii-chan! Today I found some great news for Cloudflare One users. A feature that used to be limited to higher-tier plans is now available for free!

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced that Protocol Detection in Cloudflare One Gateway is now available on all plans, including Pay-as-you-go and Free. With Protocol Detection, you can identify traffic proxied through Gateway based on its actual network protocol - things like HTTP, TLS, or SSH - and both log it and enforce policies on it.

The story so far

Until now, Protocol Detection was only available to users on higher-tier plans. If you were on the Free or Pay-as-you-go plan, you had to build your policies based on port numbers alone, with no way to confirm whether traffic on a given port was actually HTTP or something else entirely.

What changes

Now, regardless of plan tier, you can enable Protocol Detection right from your account's network settings. Even small teams and individual users can build policies based on the actual protocol running inside the traffic, making security visibility much easier to achieve.

Dive Deep

According to the official documentation, Gateway can detect quite a range of protocols:

  • HTTP / HTTP2
  • TLS (1.1-1.3)
  • SSH
  • DCERPC
  • MQTT
  • TPKT
  • IMAP / POP3 / SMTP
  • MYSQL
  • RSYNC-DAEMON
  • LDAP
  • NTP

Policies can use the "Detected Protocol" selector as a condition. For example, you can build a rule that blocks all traffic matching "SSH" as the detected protocol, regardless of which port it's running on. Being able to catch traffic that disguises itself on a different port is a nice touch.

To enable it, go to the Zero Trust dashboard, navigate to Traffic policies, then Traffic settings, then Proxy and inspection settings, and turn on "Allow protocol detection." You can also enable "Inspect on all ports" alongside it, which lets Gateway inspect HTTP/HTTPS traffic even on ports other than the standard 80/443.

There are some limitations though. Protocol Detection only works for devices using the Cloudflare One Client in "Traffic and DNS" mode. Also, when TLS is intercepted on all ports, Gateway can't filter non-HTTP protocols hidden inside that TLS connection. For more details, check out the Protocol detection documentation.

Wrap-up

  • Protocol Detection in Cloudflare One Gateway is now available on all plans, including Free and Pay-as-you-go
  • You can log and enforce policies based on the actual protocol - HTTP, TLS, SSH, and more
  • Enabling it is a one-click switch in your account's network settings, though it requires the Cloudflare One Client running in Traffic and DNS mode

This is a great update to try if you're running Cloudflare One on a Free or Pay-as-you-go plan!

Related posts