---
title: Filter Workers' public Internet traffic using Gateway policies
description: Workers using cf1:network now egress to the public Internet through Cloudflare Gateway — with policies enforced and DNS, HTTP, and Network logging.
image: https://edgetunnel-b2h.pages.dev/changelog-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

[ ← Back to all posts ](https://edgetunnel-b2h.pages.dev/changelog/) 

## Filter Workers' public Internet traffic using Gateway policies

Jun 05, 2026 

[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) 

Workers using a [VPC Network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) binding with `network_id: "cf1:network"` now egress to public Internet destinations through [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/). This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today.

1. [Worker](https://edgetunnel-b2h.pages.dev/workers/)  
Calls `env.EGRESS.fetch()`
2. [VPC binding](https://edgetunnel-b2h.pages.dev/workers-vpc/) ↓
3. [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
Bind via [cf1:network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/)
4. ↓
5. [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)  
Policies applied:  
[ DNS ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/)[ HTTP ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/)[ Network ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/)
6. ↓
7. ↗ Public Internet  
Any public hostname or IP
[ Gateway logs DNS HTTP Network ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) 

What you get by default:

* **Visibility.** Worker egress shows up in Gateway [DNS](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/), [HTTP](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/), and [Network](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) logs alongside your other traffic, so you can audit what your Workers are calling and when.
* **Enforcement.** Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block.

* [  wrangler.jsonc ](#tab-panel-2733)
* [  wrangler.toml ](#tab-panel-2734)

**JSONC**

```jsonc
{
  "vpc_networks": [
    {
      "binding": "EGRESS",
      "network_id": "cf1:network",
      "remote": true,
    },
  ],
}
```

**TOML**

```toml
[[vpc_networks]]
binding = "EGRESS"
network_id = "cf1:network"
remote = true
```

* [  JavaScript ](#tab-panel-2735)
* [  TypeScript ](#tab-panel-2736)

**JavaScript**

```js
// Egress to a public destination — subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data");
```

**TypeScript**

```ts
// Egress to a public destination — subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data");
```

For configuration options, refer to [VPC Networks](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/). For policy authoring, refer to [Cloudflare Gateway traffic policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/).

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-05-gateway-egress/#page","headline":"Filter Workers' public Internet traffic using Gateway policies · Changelog","description":"Workers using cf1:network now egress to the public Internet through Cloudflare Gateway — with policies enforced and DNS, HTTP, and Network logging.","url":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-05-gateway-egress/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/changelog-preview.png","dateModified":"2026-06-05","datePublished":"2026-06-05","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```