Cloudflare WAN and Magic Transit: Managed Rulesets Finally Arrive on Unified Routing!

Hi everyone, it's me! I found a Cloudflare networking update today and I couldn't help getting excited about it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Advanced Network Firewall Managed Rulesets are now supported for accounts using Unified Routing mode. This applies to three products: Cloudflare Network Firewall, Magic Transit, and Cloudflare WAN.

Here's the original wording:

"Cloudflare Advanced Network Firewall Managed Rulesets are now supported for accounts using Unified Routing mode."

The full breakdown of feature availability lives in a doc called "Check feature availability before upgrading," so if you're thinking about upgrading, that's worth a look.

The story so far

Unified Routing is a relatively new routing mode that lets Cloudflare WAN and Magic Transit traffic flow through one shared routing fabric. It reached general availability on September 18, 2026, bringing features like Automatic Return Routing, BGP, and custom client subnets.

But Advanced Network Firewall features weren't all available in Unified Routing from day one — they've been rolling out gradually:

• April 21, 2026: Country rules were the first feature supported
• July 8, 2026: IP lists, IDS, and SIP rules were added
• August 19, 2026: Threat Intel Lists were added
• And now, September 25, 2026: Managed Rulesets join the list

Watching a team add features one careful step at a time like this makes me want to cheer them on.

What changes

Managed Rulesets are pre-built rulesets that Cloudflare creates and maintains, based on best practices and known malicious patterns. You don't have to write rules from scratch — you just enable them and get a baseline of protection.

Until now, accounts on Unified Routing couldn't use Managed Rulesets, so teams had to either stay on Legacy Routing or run without that protection. With this update, you can move to Unified Routing and keep your Managed Rulesets protection in place.

In short, for network admins running Magic Transit, Cloudflare WAN, or Cloudflare Network Firewall, this removes one more reason to hesitate about migrating to Unified Routing.

Dive Deep

Cloudflare Network Firewall processes traffic in two phases: first the Custom phase (your own custom rules), then the Managed phase (Managed Rulesets). Rules inside a Managed Ruleset can be enabled, disabled, or set to log matching packets, and you can define overrides on top of the default configuration to fit your needs.

The original post doesn't mention pricing or specific rule counts, so if you want more detail, the "Check feature availability before upgrading" doc is the place to check.

Wrap-up

• Advanced Network Firewall Managed Rulesets now work with Unified Routing mode
• This covers Cloudflare Network Firewall, Magic Transit, and Cloudflare WAN
• Unified Routing reached GA on September 18, 2026, and Advanced Network Firewall features have rolled out step by step — Country rules, then IP lists/IDS/SIP, then Threat Intel Lists, and now Managed Rulesets
• Managed Rulesets are Cloudflare-maintained, ready-to-use protection rules that you can enable, disable, or override
• Network admins running Magic Transit or Cloudflare WAN can now move to Unified Routing with much more peace of mind!