JA EN
shiichan

Cloudflare Gateway now lets you write policies by traffic destination!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's shiichan! I found an interesting update on the Cloudflare Changelog, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Gateway HTTP policies and Network policies now include a new "Traffic Destination" selector. This selector identifies how traffic exits Cloudflare, in other words which off-ramp method it uses.

With this, administrators can write policies that target specific off-ramp methods. For example, you can now apply different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.

The story so far

Before this update, Gateway policies couldn't clearly distinguish between different kinds of traffic destinations. There wasn't a selector that separated "traffic going to the public Internet" from "traffic going to an internal destination through Tunnel," so building policies that depend on the exit route required workarounds.

What changes

Now that the Traffic Destination selector is available, you can set separate policies for traffic heading to the Internet, through a Cloudflare WAN connection, through Cloudflare Tunnel, to a Cloudflare One Client device, or through a Mesh node.

For instance, you could apply stricter rules only to traffic going out to the Internet, while using different rules for internal traffic routed through Tunnel. This makes it much easier to design flexible policies based on the exit route. It's a nice improvement if you manage a Cloudflare One or Zero Trust environment and want finer-grained control.

Dive Deep

Here are the traffic destination values this selector supports, along with their API values:

  • Internet (internet) traffic to the public Internet
  • Cloudflare WAN (cloudflare_wan) traffic through a Cloudflare WAN connection
  • Cloudflare Tunnel (cloudflare_tunnel) traffic to a private origin through Cloudflare Tunnel
  • Cloudflare One Client (device_client) traffic to another device running the Cloudflare One Client
  • Mesh (mesh) traffic through a Cloudflare Mesh node

On the API side, this is exposed through the net.offramp.type field, usable in both HTTP and Network policies. An example expression looks like this:

net.offramp.type == "internet"

Wrap-up

  • Gateway's HTTP and Network policies gained a new Traffic Destination selector
  • You can now write different policies depending on the traffic's exit method (Internet, Cloudflare WAN, Tunnel, Client, or Mesh)
  • The API field is net.offramp.type, matched against values like internet or cloudflare_tunnel
  • This one is especially useful for Cloudflare One and Zero Trust administrators who want finer control based on exit routes!

Related posts