--- title: Account security description: Protect web applications with Cloudflare security products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Account security Make sure your account's security basics are configured properly. ## Objectives By the end of this module, you will be able to: * Secure your account * Understand and configure the most common settings for Cloudflare's Application Security Products * Explore advanced security products such as Bot Management and API Protection ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/#page","headline":"Account security · Cloudflare Learning Paths","description":"Protect web applications with Cloudflare security products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/account-security/","name":"Account security"}}]} ``` --- --- title: Add and manage other members description: Add, edit, and manage Cloudflare account members. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Add and manage other members Learn how to add new account members, edit or revoke their permissions and access, and resend verifications emails. Note To manage account members, you must have a role of **Super Administrator** and have a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). ## View account members To manage account members, you must have a role of **Super Administrator** and have a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). * [ Dashboard ](#tab-panel-9877) * [ API ](#tab-panel-9878) To view members using the dashboard: In the \[Cloudflare dashboard, go to the **Members** page. [ Go to **Members** ](https://dash.cloudflare.com/?to=/:account/members) To view members using the API, send a [GET request](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/members/methods/list/). ## Add account members To manage account members, you must have a role of **Super Administrator** and have a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). * [ Dashboard ](#tab-panel-9879) * [ API ](#tab-panel-9880) To add a member to your account: 1. In the Cloudflare dashboard, go to the **Members** page. [ Go to **Members** ](https://dash.cloudflare.com/?to=/:account/members) 2. Select **Invite**. 3. Fill out the following information: * **Invite members**: Enter one or more email addresses (if multiple, separate addresses with commas). * **Scope**: Use a variety of fields to adjust the [scope](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/) of your roles. * **Roles**: Choose one or more [roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/) to assign your members. 4. Select **Continue to summary**. 5. Review the information, then select **Invite**. Note If a user already has an account with Cloudflare and you have an Enterprise account, you can also select **Skip email confirmation** to add them to your account without sending an email invitation. To add a member using the API, send a [POST request](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/members/methods/create/). ## Edit member permissions To manage account members, you must have a role of **Super Administrator** and have a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). * [ Dashboard ](#tab-panel-9881) * [ API ](#tab-panel-9882) To edit member permissions using the dashboard: 1. In the Cloudflare dashboard, go to the **Members** page. [ Go to **Members** ](https://dash.cloudflare.com/?to=/:account/members) 2. Select a member record, then select **Edit**. 3. Update the scope and roles of their permissions. 4. Select **Continue to summary**. 5. Review the information, then select **Update**. To edit member permissions using the API, get a [list of roles](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/roles/methods/list/) available for an account. Then, send a [PUT request](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/members/methods/update/) to edit their permissions. **Request** ```bash curl --request PUT \ --url https://api.cloudflare.com/client/v4/accounts/{account_id}/members/{member_id} \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "roles": [ { "id": "" }, { "id": "" } ] }' ``` ## Resend an invitation If you invited a member to your account but they cannot find the invitation or the invitation expires, you can resend the invitation through the Cloudflare dashboard: 1. Log in to the [Cloudflare dashboard ↗](https://dash.cloudflare.com/login) and select your account[1](#user-content-fn-1). 2. Go to **Manage Account** \> **Members**. 3. Select a member record where their **Status** is **Invite Pending**. 4. Select **Resend invite**. ## Footnotes 1. To manage account members, you must have a role of **Super Administrator** and have a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). [↩](#user-content-fnref-1) ## Remove account members To manage account members, you must have a role of **Super Administrator** and have a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). * [ Dashboard ](#tab-panel-9883) * [ API ](#tab-panel-9884) To revoke a member's access to your account: 1. In the Cloudflare dashboard, go to the **Members** page. [ Go to **Members** ](https://dash.cloudflare.com/?to=/:account/members) 2. Locate an account member and expand their record. 3. Click **Revoke**. 4. Click **Yes, revoke access**. To revoke a member's access to your account using the API, send a [DELETE request](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/members/methods/delete/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/add-other-members/#page","headline":"Add and manage other members · Cloudflare Learning Paths","description":"Add, edit, and manage Cloudflare account members.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/add-other-members/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/account-security/","name":"Account security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/account-security/add-other-members/","name":"Add and manage other members"}}]} ``` --- --- title: Audit Logs - version 2 description: Use Cloudflare Audit Logs v2 to track user-initiated and system-initiated actions across your account via the dashboard, API, or Logpush. image: https://edgetunnel-b2h.pages.dev/core-services-preview.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/fundamentals/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Audit Logs - version 2 Cloudflare Audit Logs are account-based. All user-initiated actions are recorded automatically across both the Cloudflare API and dashboard. System-initiated logs are also captured to reflect actions taken automatically by Cloudflare systems, such as configuration updates, background processes, or internal policy enforcement. When a user-initiated action triggers additional automated behavior, corresponding system-initiated logs will be generated. In some cases, user-initiated logs include additional enrichments that provide more context about what was changed, offering deeper visibility into the full lifecycle of the action. When an action occurs, it is streamed through Cloudflare's audit logging pipeline and stored. This ensures consistent visibility into activity across all products. For more detailed information about how the user-initiated actions are logged automatically, refer to the [Cloudflare Blog ↗](https://blog.cloudflare.com/introducing-automatic-audit-logs/). Note A transition plan from Audit Logs v1 to Audit Logs v2 will be communicated in due course. ## Key features Audit Logs (version 2) provide a unified and standardized system for tracking and recording actions across Cloudflare products. This system enhances transparency and accountability by offering comprehensive insights into user-initiated and system-initiated activities within your Cloudflare environment. * **Standardized logging**: Audit logs are automatically generated in a consistent format across all Cloudflare services, ensuring uniformity and eliminating inconsistencies. * **Expanded product coverage**: Audit Logs covers \~95% of Cloudflare products, capturing actions from key endpoints, such as `/accounts`, `/zones`, `/user`, and `/memberships` APIs. * **Granular filtering**: Uniformly formatted logs allow for precise filtering by actions, actors, methods, and resources, facilitating efficient investigations. * **Enhanced context and transparency**: Each log entry includes detailed context, such as the authentication method used, the interface (API or dashboard) through which the action was performed, and mappings to Cloudflare Ray IDs for improved traceability. * **Comprehensive activity capture**: Audit Logs records create, update, and delete actions across all supported products. Selective logging of `GET` requests for sensitive read operations is planned for a future release. ## Retention * Audit logs are retained for 18 months before being deleted. No additional setup is required. * In the Audit Logs v2 UI, queries are limited to the most recent 90 days for performance reasons. To access the full 18 months of data, use the API or [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/). * Enterprise customers can use [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/) to store audit logs beyond 18 months. Note Approximately 30 days of logs from the Beta period (back to \~February 8, 2026) are available at GA. These Beta logs will expire on \~April 9, 2026\. Logs generated after GA will be retained for the full 18 months. Older logs remain available in Audit Logs v1. ## Access Audit Logs You can retrieve audit logs using the Cloudflare dashboard, the API, or Logpush. ### API Audit Logs are available through the Cloudflare API. To retrieve audit logs, use the following endpoint: ```bash https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/audit ``` Below is an example request to retrieve audit logs for a certain period of time along with its corresponding response. Replace the example values in the URL with your actual values: * `account_id`: Your Cloudflare account identifier. * `since` (required): Start date for the audit log retrieval. Accepts `yyyy-mm-dd` (interpreted as UTC) or RFC3339 timestamp (`yyyy-mm-ddTHH:MM:SSZ`). * `before` (required): End date for the audit log retrieval. Same format as `since`. ```bash GET https://api.cloudflare.com/client/v4/accounts/1234567890abcdef/logs/audit?since=2025-03-01T00:00:00Z&before=2025-03-26T23:59:59Z ``` **Example response** ```json { "result": [ { "action": "zone.settings.change", "actor": { "email": "user@example.com", "id": "0987654321abcdef" }, "ip": "192.0.2.1", "method": "PUT", "interface": "dashboard", "resources": [ { "resource_id": "zone123", "resource_type": "zone" } ], "timestamp": "2025-03-15T14:25:37Z" } // Additional log entries ], "success": true, "errors": [], "messages": [] } ``` For more information refer to the [API documentation ↗](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/logs/subresources/audit/methods/list/#%28params%29%20default%20%3E%20%28param%29%20since%20%3E%20%28schema%29). ### Dashboard To access audit logs in the Cloudflare dashboard, go to **Manage Account** \> **Audit Logs**. [ Go to **Audit logs** ](https://dash.cloudflare.com/?to=/:account/audit-log) Note The Audit Logs v2 is shown by default. You can switch between Audit Logs v2 and v1 as needed. ### Logpush Note For customers who already have a Logpush job set up for Audit Logs v1, note that a separate Logpush job must be configured for [Audit Logs v2](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/audit%5Flogs%5Fv2/) (dataset). We will communicate the timeline for when Logpush Audit Logs v1 will be deprecated and turned off. To create a Logpush job: 1. In the Cloudflare dashboard, go to the **Logpush** page. [ Go to **Logpush** ](https://dash.cloudflare.com/?to=/:account/logs) 2. Select **Create a Logpush job**. 3. In **Select a destination**, select the destination of your choice and add the destination details. 4. In the datasets section, select the [Audit Logs v2 dataset](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/audit%5Flogs%5Fv2/). Audit Logs v2 is an account-based dataset. 5. Once you are done configuring your logpush job, select **Submit**. ## Audit Log structure Cloudflare's audit logs offer a detailed view of activity across your environment by capturing both the source of actions and the context in which they occur. These logs are categorized by who initiated the action (user or system) and whether the activity occurred within a specific account or spanned multiple accounts under the same user profile. This structure enables flexible filtering, investigation, and compliance monitoring. ### Initiation type Audit logs can be initiated either by users or the system. Understanding the type of actor involved helps in identifying the source and intent of actions. #### User initiated Audit Logs Track actions performed directly by users through Cloudflare interfaces (dashboard or API). These logs capture who performed the action, when it occurred, and what resource was affected. User initiated actions can be performed by three actors: * `actor_type="user"`: Action was performed by an individual user. * `actor_type="Cloudflare_admin"`: Action was performed by Cloudflare. * `actor_type="account"`: Action was performed using an account API token. Refer to the [Account API tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) documentation for more information. #### System initiated Audit Logs Record changes made automatically by Cloudflare systems, without direct user input. These logs provide visibility into internal processes, automated tasks, and security events. Some entries may include associated user context for traceability (`actor_type="system"`). ### Activity Scope #### Account Activity Logs Contain events scoped to a single Cloudflare account. These logs are filterable by `account ID` and reflect actions within that account only. You can optionally filter events further using the `resource_scope` field, which specifies whether the resource is associated with a user, an account, or a zone (`resource_scope ="user"`, `resource_scope ="accounts"`, or `resource_scope ="zones"`). #### User Profile Activity Logs Reflect actions associated with a user's login (email) across multiple accounts. These logs enable cross-account tracking and can be filtered by `user ID` or `email`. They are visible on any account the user had access to at the time of the activity. User Profile Activity Logs can be filtered using `resource_scope ="user"`. The `GET /memberships` endpoint supports cross-account access. To query memberships, use the parameter `resource_scope=memberships`. #### Organization Activity Logs Contain events scoped to specific [Cloudflare Organizations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/). These logs capture user-initiated actions performed by Org Admins through organization-level APIs. Note Cloudflare Organizations is Enterprise-only and currently in public beta. You can retrieve Organization audit logs using either the API or the Cloudflare dashboard. ##### API access Retrievable via the Audit Logs v2 API: ```bash GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit ``` ##### Dashboard access To access organization audit logs in the Cloudflare dashboard, go to **Organizations** \> _(select your organization)_ \> **Manage Organization** \> **Audit Logs**. If you are viewing account-level audit logs and the account belongs to an organization where you are an Organization Super Administrator, you can navigate to the parent organization's audit logs using the **View Organization Audit Logs** button. Note Organization-level audit logs are separate from account-level audit logs. Actions performed within a specific account continue to be available via the account-level Audit Logs UI, Audit Logs v2 API, and Logpush. This release covers user-initiated actions only. Support for system-initiated actions and Logpush for organizations will be added in future releases. ## Example how to query Audit Logs Use the following example to get a list of audit logs for a Cloudflare account. Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Account Settings Write` * `Account Settings Read` **Get account audit logs (Version 2)** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logs/audit" \ --request GET \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` **Example response** ```json { "errors": [ { "message": "message" } ], "result": [ { "account": { "id": "4bb334f7c94c4a29a045f03944f072e5", "name": "Example Account" }, "action": { "description": "Add Member", "result": "success", "time": "2024-04-26T17:31:07Z", "type": "create" }, "actor": { "id": "f6b5de0326bb5182b8a4840ee01ec774", "context": "dash", "email": "alice@example.com", "ip_address": "198.41.129.166", "token_id": "token_id", "token_name": "token_name", "type": "user" }, "raw": { "cf_ray_id": "8e9b1c60ef9e1c9a", "method": "POST", "status_code": 200, "uri": "/accounts/4bb334f7c94c4a29a045f03944f072e5/members", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15" }, "resource": { "id": "id", "product": "members", "request": {}, "response": {}, "scope": {}, "type": "type" }, "zone": { "id": "id", "name": "example.com" } } ], "result_info": { "count": "1", "cursor": "ASqdKd7dKgxh-aZ8bm0mZos1BtW4BdEqifCzNkEeGRzi_5SN_-362Y8sF-C1TRn60_6rd3z2dIajf9EAPyQ_NmIeAMkacmaJPXipqvP7PLU4t72wyqBeJfjmjdE=" }, "success": true } ``` ## Common terms and definitions ### Actor The actor represents who performed the action. It includes identity attributes like user ID, email address, IP address, and the type of actor (`user`, `account`, `Cloudflare_admin`, or `system`). It also includes the context used to initiate the action, such as API or dashboard (`dash`). ### Action The action field captures the nature of the event and whether it was successful. It includes a high-level type (e.g., `create`, `update`, `delete`), a specific description (such as `SSO_LOGIN`), the timestamp of when the action occurred, and the result (`success` or `failure`). `view` actions correspond to `GET` requests. These are defined in the schema but not currently captured in Audit Logs. Selective `GET` logging for sensitive read operations is planned for a future release. ### Account This field refers to the Cloudflare account under which the action was executed. It includes a unique account ID and a human-readable account name to help associate activity with a customer environment. ### Resource The resource identifies the object impacted by the action. It includes the resource type, the unique resource ID, the scope (`user`, `account`, or `zone`), and optionally the product associated with the change. ### Audit Log ID This is a unique identifier for the log record itself. It can be used for deduplication, correlation, or referencing specific actions during investigations. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/#page","headline":"Audit Logs - version 2 · Cloudflare Fundamentals docs","description":"Use Cloudflare Audit Logs v2 to track user-initiated and system-initiated actions across your account via the dashboard, API, or Logpush.","url":"https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/core-services-preview.png","dateModified":"2026-06-26","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/fundamentals/","name":"Cloudflare Fundamentals"}},{"@type":"ListItem","position":3,"item":{"@id":"/fundamentals/account/","name":"Accounts"}},{"@type":"ListItem","position":4,"item":{"@id":"/fundamentals/account/account-security/","name":"Account security"}},{"@type":"ListItem","position":5,"item":{"@id":"/fundamentals/account/account-security/audit-logs/","name":"Audit Logs - version 2"}}]} ``` --- --- title: Review active sessions description: View and revoke active account sessions. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Review active sessions In the Cloudflare dashboard, you can view a list of active sessions associated with your email address. Each time your email is used to log in to your Cloudflare account, a session begins. The Cloudflare dashboard provides session information including if the device is currently viewing the dashboard, the IP address, location, device type, browser type, and last active login. If you notice any suspicious activity, you can also revoke any active sessions. Note By default, the session timeout for the Cloudflare dashboard is 72 hours without any activity. Some customers can also enforce single-sign on (SSO) by [adding a Dashboard SSO application](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/dashboard-sso/). If you navigate to **My Profile** \> **Sessions**, you can view active sessions and revoke any session that you do not recognize. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/review-active-sessions/#page","headline":"Review active sessions · Cloudflare Learning Paths","description":"View and revoke active account sessions.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/review-active-sessions/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/account-security/","name":"Account security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/account-security/review-active-sessions/","name":"Review active sessions"}}]} ``` --- --- title: Review audit logs - v1 description: Access and review account audit logs. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Review audit logs - v1 Note Audit Logs version 2 is available in beta. Refer to the [Audit Logs v2 documentation](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/) for more details. Audit logs summarize the history of changes made within your Cloudflare account. Audit logs include account level actions like login, as well as zone configuration changes. Audit Logs are available on all plan types and are captured for both individual users and for multi-user organizations. Note Most beta features will not appear in audit logs until they are out of beta. Audit logs are available in the dashboard as well as the API. ### Using the dashboard To access audit logs in the Cloudflare dashboard: In the Cloudflare dashboard, go to the **Audit Logs** page. [ Go to **Audit logs** ](https://dash.cloudflare.com/?to=/:account/audit-log) You can search these audit logs by user email or domain and filter by date range. To download audit logs, click **Download CSV**. Note Depending on the volume of data, the export of large amounts of events from Audit Logs might fail with errors. We always recommend using Cloudflare [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/) to make sure Audit Logs are always available and stored externally. ### Using the API To get audit logs from the Cloudflare API, send a [GET request](https://edgetunnel-b2h.pages.dev/api/resources/audit%5Flogs/methods/list/). We recommending using the API for downloading historical audit log data. To maintain Audit Logs query performance, the Audit Logs API was modified on 2019-06-30 to return records with a maximum age of 18 months. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/review-audit-logs/#page","headline":"Review audit logs - v1 · Cloudflare Learning Paths","description":"Access and review account audit logs.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/review-audit-logs/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/account-security/","name":"Account security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/account-security/review-audit-logs/","name":"Review audit logs - v1"}}]} ``` --- --- title: Set-up 2FA description: Configure two-factor authentication for account security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Set-up 2FA Two-factor authentication (2FA) allows user account owners to add an additional layer of login security to Cloudflare accounts. This additional authentication step requires you to provide both something you know, such as a Cloudflare password, and something you have, such as an authentication code from a mobile device. Note Cloudflare user accounts configured to use single sign-on (SSO) cannot configure 2FA. Cloudflare offers the option to use either a phishing-resistant security key, like a YubiKey, or a Time-Based One-Time password (TOTP) mobile app for authentication, like Google Authenticator, or both. If you add both of these authentication methods to your account, you are initially prompted to log in with the security key, but can opt-out and use TOTP instead. To ensure that you can securely access your account even without your mobile device or security keys, Cloudflare also provides backup codes for download. Tip After downloading your backup codes, we recommend saving them in a secure location. As the user account owner, you are automatically assigned the [Super Administrator](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/) role. Once 2FA is enabled, all Cloudflare account members are required to configure 2FA on their mobile devices. --- ## Enable 2FA We recommend that all Cloudflare user account holders enable two-factor authentication (2FA) to keep your accounts secure. 2FA can only be enabled successfully on an account with a [verified email address](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/verify-email-address/). If you do not verify your email address first, you may lock yourself out of your account. Warning Super Administrators can turn on **2FA Enforcement** to require all members to enable 2FA. If you are not a Super Administrator, you will be forced to turn on 2FA prior to accepting the invitation to join a Cloudflare account as a member. To enable two-factor authentication for your Cloudflare login: 1. Log in to the [Cloudflare dashboard ↗](https://dash.cloudflare.com/login). 2. Under the **My Profile** dropdown, select **My Profile**. 3. Select **Authentication**. 4. Select **Add** next to [Mobile App Authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/#configure-totp-mobile-application-authentication) or [Security Key Authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/#configure-security-key-authentication-for-two-factor-cloudflare-login), or **Enable** next to [Email Authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/#configure-email-two-factor-authentication). Note Cloudflare recommends that users enable at least two different 2FA factors, as well as safely store [backup codes](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/#regenerate-backup-codes)) to prevent lockouts. ## Additional configurations Cloudflare also supports 2FA with device built-in authenticators (Apple Touch ID, Android fingerprint, or Windows Hello), Yubikeys and TOTP mobile applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/set-up-2fa/#page","headline":"Set-up 2FA · Cloudflare Learning Paths","description":"Configure two-factor authentication for account security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/set-up-2fa/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/account-security/","name":"Account security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/account-security/set-up-2fa/","name":"Set-up 2FA"}}]} ``` --- --- title: Default traffic security description: Protect web applications with Cloudflare security products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Default traffic security As soon as you onboard your domain to Cloudflare, you are automatically protected. This module reviews what those protections are and why they are critical. ## Objectives By the end of this module, you will be able to: * Understand the most common security controls your applications will have access to ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/#page","headline":"Default traffic security · Cloudflare Learning Paths","description":"Protect web applications with Cloudflare security products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/default-traffic-security/","name":"Default traffic security"}}]} ``` --- --- title: Browser Integrity description: Detect and block requests with invalid headers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Browser Integrity Cloudflare's Browser Integrity Check (BIC) looks for common HTTP headers abused most commonly by spammers and denies access to your page. It also challenges visitors without a user agent or with a non-standard user agent such as commonly used by abusive bots, crawlers, or visitors. [BIC is enabled by default](https://edgetunnel-b2h.pages.dev/waf/tools/browser-integrity-check/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/browser-integrity/#page","headline":"Browser Integrity · Cloudflare Learning Paths","description":"Detect and block requests with invalid headers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/browser-integrity/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/default-traffic-security/","name":"Default traffic security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/default-traffic-security/browser-integrity/","name":"Browser Integrity"}}]} ``` --- --- title: DDoS Protection description: Understand automatic DDoS attack mitigation. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # DDoS Protection Cloudflare automatically detects and mitigates DDoS attacks using its [Autonomous Edge](https://edgetunnel-b2h.pages.dev/ddos-protection/about/components/#autonomous-edge), which is always-on. `Advanced` protections are reserved for Magic Transit customers. | OSI Layer | Ruleset / Feature | Example of covered DDoS attack vectors | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | L3/4 | [Network-layer DDoS Attack Protection](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/network/) | ACK floodsBitTorrent reflection attackCarpet Bombing attacksCHARGEN reflection attacksDNS amplification attackDNS Garbage FloodDNS NXDOMAIN floodDNS Query floodDTLS amplification attacksESP floodGRE floodsICMP flood attackJenkins amplification attacksLantronix reflection attacksmDNS DDoS attacksMemcached amplification attacksMirai and Mirai-variant L3/4 attacksMSSQL reflection attacksNetBios DDoS attacksOut of state TCP attacksProtocol violation attacksQUIC flood attackQuote of the Day (QOTD) reflection attacksRST floodSIP attacksSNMP flood attackSPSS reflection attacksSSDP reflection attacksSYN floodsSYN-ACK reflection attackTeamSpeak 3 floodsUbiquity reflection attacksUDP flood attackVxWorks DDoS attacksFor more DNS protection options, refer to [Getting additional DNS protection](https://edgetunnel-b2h.pages.dev/ddos-protection/about/attack-coverage/#getting-additional-dns-protection). | | L3/4 | [Advanced TCP Protection](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) [1](#user-content-fn-1) | Fully randomized and spoofed ACK floods, SYN floods, SYN-ACK reflection attacks, and other sophisticated TCP-based DDoS attacks | | L7 (DNS) | [Advanced DNS Protection](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) [1](#user-content-fn-1) | Sophisticated and fully randomized DNS attacks, including Water Torture attacks, Random-prefix attacks, and DNS laundering attacks. | | L7 (HTTP/S) | [HTTP DDoS Attack Protection](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/http/) | Cache busting attacksCarpet Bombing attacksHTTP Continuation floodHTTP flood attackHTTP/2 MadeYouResetHTTP/2 Rapid ResetHULK attackKnown DDoS botnetsLOIC attackMirai and Mirai-variant HTTP attacksSlowloris attackTLS/SSL exhaustion attacksTLS/SSL negotiation attacksWordPress pingback attack | ## Footnotes 1. Available to Magic Transit customers. [↩](#user-content-fnref-1) [↩2](#user-content-fnref-1-2) Refer to the learning path [Prevent DDoS attacks](https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/) to dive deeper into this subject. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/ddos/#page","headline":"DDoS Protection · Cloudflare Learning Paths","description":"Understand automatic DDoS attack mitigation.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/ddos/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/default-traffic-security/","name":"Default traffic security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/default-traffic-security/ddos/","name":"DDoS Protection"}}]} ``` --- --- title: DNSSEC description: Sign your zone with DNSSEC for DNS security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # DNSSEC DNS Security Extensions (DNSSEC) adds an extra layer of authentication to DNS, ensuring requests are not routed to a spoofed domain. For additional background on DNSSEC, visit the [Cloudflare Learning Center ↗](https://www.cloudflare.com/learning/dns/dns-security/). When you [enable DNSSEC](https://edgetunnel-b2h.pages.dev/dns/zone-setups/subdomain-setup/dnssec/), Cloudflare signs your zone, publishes your public signing keys, and generates your **DS** record. Note: Cloudflare automatically adds **DS** records for domains using Cloudflare Registrar or those using `.ch` and `.cz` top-level domains. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/dnssec/#page","headline":"DNSSEC · Cloudflare Learning Paths","description":"Sign your zone with DNSSEC for DNS security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/dnssec/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/default-traffic-security/","name":"Default traffic security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/default-traffic-security/dnssec/","name":"DNSSEC"}}]} ``` --- --- title: Mutual TLS (mTLS) description: Authenticate requests with mutual TLS certificates. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Mutual TLS (mTLS) Mutual TLS (mTLS) authentication uses client certificates to ensure traffic between client and server is bidirectionally secure and trusted. mTLS also allows requests that do not authenticate via an identity provider — such as Internet-of-things (IoT) devices — to demonstrate they can reach a given resource. ![mTLS sequence diagram](https://edgetunnel-b2h.pages.dev/_astro/api-shield-call-sequence.DjXyNgan_CJbMD.webp) Support includes [gRPC ↗](https://grpc.io/docs/what-is-grpc/introduction/)\-based APIs, which use binary formats such as protocol buffers rather than JSON. ## Creating a mTLS rule 1. In the Cloudflare dashboard, go to **Client Certificates** page. [ Go to **Client Certificates** ](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/client-certificates) 2. Select **Create a mTLS rule**. 3. In **Custom rules**, several rule parameters have already been filled in. Enter the URI path you want to protect in **Value**. 4. (Optional) Add a `Hostname` field and enter the mTLS-enabled hostnames you wish to protect in **Value**. 5. In **Choose action**, select `Block`. 6. Select **Deploy** to make the rule active. Once you have deployed your mTLS rule, any requests without a [valid client certificate](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/) will be blocked. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/mtls/#page","headline":"Mutual TLS (mTLS) · Cloudflare Learning Paths","description":"Authenticate requests with mutual TLS certificates.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/mtls/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/default-traffic-security/","name":"Default traffic security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/default-traffic-security/mtls/","name":"Mutual TLS (mTLS)"}}]} ``` --- --- title: SSL / TLS description: Configure SSL/TLS encryption options for domains. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # SSL / TLS Cloudflare offers a range of SSL/TLS options. By default, Cloudflare offers Universal SSL to all domains, but there are many other options available. Cloudflare offers SSL/TLS for free because we believe it is the [right thing to do ↗](https://blog.cloudflare.com/introducing-universal-ssl). Encryption is foundational to the Internet because it prevents data from being manipulated. 1. [**Universal SSL**](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/universal-ssl/): This option covers basic encryption requirements and certificate management needs. 2. [**Total TLS**](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/additional-options/total-tls/): Automatically issues certificates for all subdomain levels, extending the protection offered by Universal SSL. 3. [**Advanced Certificates**](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/advanced-certificate-manager/): Offers customizable certificate issuance and management, including options like choosing the certificate authority, certificate validity period, and removing Cloudflare branding from certificates. 4. [**Custom Certificates**](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/custom-certificates/): For eligible plans, customers can upload their own certificates, with the user managing issuance and renewal. 5. [**mTLS Client Certificates**](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/): Cloudflare offers a PKI system, used to create client certificates, which can enforce mutual Transport Layer Security (mTLS) encryption. 6. [**Cloudflare for SaaS Custom Hostnames**](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/): This feature enables SaaS providers to offer their clients the ability to use their own domains while benefiting from Cloudflare's network. 7. [**Keyless SSL Certificates**](https://edgetunnel-b2h.pages.dev/ssl/keyless-ssl/): Keyless SSL allows security-conscious clients to upload their own custom certificates and benefit from Cloudflare, but without exposing their TLS private keys. 8. [**Origin Certificates**](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/origin-ca/): Origin CA certificates from Cloudflare are used to encrypt traffic between Cloudflare and your origin web server. These certificates are created through the Cloudflare dashboard and can be configured with a choice of RSA or ECC private keys and support for various server types. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/ssl/#page","headline":"SSL / TLS · Cloudflare Learning Paths","description":"Configure SSL/TLS encryption options for domains.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/default-traffic-security/ssl/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/default-traffic-security/","name":"Default traffic security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/default-traffic-security/ssl/","name":"SSL / TLS"}}]} ``` --- --- title: Web Application Firewall description: Protect web applications with Cloudflare security products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Web Application Firewall Cloudflare's Web Application Firewall (WAF) is used to protect websites from a wide variety of attack vectors. It analyzes characteristics from each request and takes action based on your domain configuration. In the next module, we will review Rate Limiting which is another product used to protect against potentially more sophisticated volumetric attacks. ## Objectives By the end of this module, you will be able to: * Understand the different WAF components that Cloudflare offers * Understand the main features within each WAF offering ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/firewall/#page","headline":"Web Application Firewall · Cloudflare Learning Paths","description":"Protect web applications with Cloudflare security products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/firewall/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/firewall/","name":"Web Application Firewall"}}]} ``` --- --- title: Custom rules description: Create custom rules for load balancer routing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Custom rules Custom rules allow you to control incoming traffic by filtering requests to a zone. They work as customized web application firewall (WAF) rules that you can use to perform actions like _Block_ or _Managed Challenge_ on incoming requests. You can also use the _Skip_ action in a custom rule to [skip one or more Cloudflare security features](https://edgetunnel-b2h.pages.dev/waf/custom-rules/skip/). In the [new security dashboard](https://edgetunnel-b2h.pages.dev/security/), custom rules are one of the available types of [security rules](https://edgetunnel-b2h.pages.dev/security/rules/). Security rules perform security-related actions on incoming requests that match specified filters. Like other rules evaluated by Cloudflare's [Ruleset Engine](https://edgetunnel-b2h.pages.dev/ruleset-engine/), custom rules have the following basic parameters: * An [expression](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/expressions/) that specifies the criteria you are matching traffic on using the [Rules language](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/). * An [action](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/actions/) that specifies what to perform when there is a match for the rule. The [custom rules documentation](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) includes examples for common use cases. ## Skip rules You can skip one or more Cloudflare security features using a custom rule [configured with the _Skip_ action](https://edgetunnel-b2h.pages.dev/waf/custom-rules/skip/). These rules are also known as skip rules. Refer to [Skip options](https://edgetunnel-b2h.pages.dev/waf/custom-rules/skip/options/) for more information on the features you can skip. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/firewall/custom-rules/#page","headline":"Custom rules · Cloudflare Learning Paths","description":"Create custom rules for load balancer routing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/firewall/custom-rules/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/firewall/","name":"Web Application Firewall"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/firewall/custom-rules/","name":"Custom rules"}}]} ``` --- --- title: Managed Rules description: Deploy WAF managed rulesets for threat protection. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Managed Rules Cloudflare provides pre-configured managed rulesets that protect against web application exploits such as the following: * Zero-day vulnerabilities * Top-10 attack techniques * Use of stolen/leaked credentials * Extraction of sensitive data Managed rulesets are [regularly updated](https://edgetunnel-b2h.pages.dev/waf/change-log/). Each rule has a default action that varies according to the severity of the rule. You can adjust the behavior of specific rules, choosing from several possible actions. Rules of managed rulesets have associated tags (such as `wordpress`) that allow you to search for a specific group of rules and configure them in bulk. ## Rulesets By default, Cloudflare offers the following rulesets: * [Cloudflare Managed Ruleset](https://edgetunnel-b2h.pages.dev/waf/managed-rules/reference/cloudflare-managed-ruleset/) * [Cloudflare OWASP Core Ruleset](https://edgetunnel-b2h.pages.dev/waf/managed-rules/reference/owasp-core-ruleset/) * [Cloudflare Exposed Credentials Check Managed Ruleset](https://edgetunnel-b2h.pages.dev/waf/managed-rules/reference/exposed-credentials-check/) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/firewall/managed-rules/#page","headline":"Managed Rules · Cloudflare Learning Paths","description":"Deploy WAF managed rulesets for threat protection.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/firewall/managed-rules/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/firewall/","name":"Web Application Firewall"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/firewall/managed-rules/","name":"Managed Rules"}}]} ``` --- --- title: Lists description: Protect web applications with Cloudflare security products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Lists Cloudflare Lists is a WAF feature that enables administrators to groups identifiers together, such as IPs, hostnames or ASNs, and reference the list by other Cloudflare products such as [Custom rules](https://edgetunnel-b2h.pages.dev/waf/custom-rules/). Cloudflare currently supports the following types of lists: * [Custom Lists](https://edgetunnel-b2h.pages.dev/waf/tools/lists/custom-lists/): Includes custom IP lists, hostname lists, and ASN lists. * [Managed Lists](https://edgetunnel-b2h.pages.dev/waf/tools/lists/managed-lists/): Lists managed and updated by Cloudflare, such as Managed IP Lists. ## Objectives By the end of this module, you will be able to: * Understand all the options Cloudflare's Lists products offer * Understand the advanced configurations provided to you with a paid offering ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/#page","headline":"Lists · Cloudflare Learning Paths","description":"Protect web applications with Cloudflare security products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/lists/","name":"Lists"}}]} ``` --- --- title: Configurations description: Configure rules with advanced settings. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configurations Both Custom and Managed Lists are located in the account settings. Refer to [Features by plan type](https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/features/) for more information on plan eligibility. ## Custom Lists Using a Custom List is an alternative to creating individual Firewall rules with long lists of IP addresses or other types of identifiers. They are easier to read and update, especially when they are used across many security rules. Lists are often used in conjunction with in-house or third party security feeds. ## Managed Lists The following lists are managed by the Cloudflare team and are regularly updated. | Display name | Name in expressions | Description | | ----------------------------------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Open Proxies | cf.open\_proxies | IP addresses of known open HTTP and SOCKS proxy endpoints, which are frequently used to launch attacks and hide attackers identity. | | Cloudflare Anonymizers | cf.anonymizer | IP addresses of known anonymizers (Open SOCKS Proxies, VPNs, and TOR nodes). | | Cloudflare VPNs | cf.vpn | IP addresses of known VPN servers. | | Cloudflare Malware | cf.malware | IP addresses of known sources of malware. | | Cloudflare Botnets, Command and Control Servers | cf.botnetcc | IP addresses of known botnet command-and-control servers. | ## Creating a rule Refer to [Use lists in expressions](https://edgetunnel-b2h.pages.dev/waf/tools/lists/use-in-expressions/) to learn how to invoke a Managed List. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/configuration/#page","headline":"Configurations · Cloudflare Learning Paths","description":"Configure rules with advanced settings.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/configuration/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/lists/","name":"Lists"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/lists/configuration/","name":"Configurations"}}]} ``` --- --- title: Features description: Review available features by plan type. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Features List availability varies according to the list type and your Cloudflare plan and subscriptions. | | Free | Pro | Business | Enterprise | | --------------------------------------------------- | ------ | ------ | -------- | ---------- | | Availability | Yes | Yes | Yes | Yes | | Number of custom lists (any type) | 1 | 10 | 10 | 1,000 | | Max. number of list items (across all custom lists) | 10,000 | 10,000 | 10,000 | 500,000 | | IP lists | Yes | Yes | Yes | Yes | | Other custom lists (hostnames, ASNs) | No | No | No | Yes | | Managed IP Lists | No | No | No | Yes | Notes: * The number of available custom lists depends on the highest plan in your account. Any account with at least one paid plan will get the highest quota. * Customers on Enterprise plans can create a maximum of 1,000 custom lists in total across different list types. The following additional limits apply: * Up to 40 hostname lists, with a maximum of 10,000 list items across all hostname lists. * Up to 40 ASN lists, with a maximum of 30,000 list items across all ASN lists. * Customers on Enterprise plans may contact their account team if they need more custom lists or a larger maximum number of items across lists. * For details on the availability of Bulk Redirect Lists, refer to the [Rules](https://edgetunnel-b2h.pages.dev/rules/url-forwarding/#availability) documentation. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/features/#page","headline":"Features · Cloudflare Learning Paths","description":"Review available features by plan type.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/features/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/lists/","name":"Lists"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/lists/features/","name":"Features"}}]} ``` --- --- title: Use cases description: Explore common use cases and configurations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use cases The most common uses cases are: * When creating a rule, using a list is easier and less error-prone than adding a long list of items such as IP addresses to a rule expression. * When updating a set of rules that target the same group of IP addresses (or hostnames), using an IP list (or a hostname list) is easier and less error prone than editing multiple rules. * Lists are easier to read and more informative, particularly when you use descriptive names for your lists. When you update the content of a list, any rules that use the list are automatically updated, so you can make a single change to your list rather than modify rules individually. Cloudflare stores your lists at the account level. You can use the same list in rules of different zones in your Cloudflare account. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/use-cases/#page","headline":"Use cases · Cloudflare Learning Paths","description":"Explore common use cases and configurations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/lists/use-cases/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/lists/","name":"Lists"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/lists/use-cases/","name":"Use cases"}}]} ``` --- --- title: Rate Limiting description: Protect web applications with Cloudflare security products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Rate Limiting Rate Limiting mitigates excessive request rates for specific URLs or for an entire domain. Request rates are calculated locally for individual Cloudflare data centers. You can configure thresholds and define responses by IP. If traffic from a specific IP exceeds the threshold, then you can take action on the offending IP for a defined period of time. ## Objectives By the end of this module, you will be able to: * Understand all the options Cloudflare's Rate Limiting product offers * Understand the advanced configurations provided to you with a paid offering ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/#page","headline":"Rate Limiting · Cloudflare Learning Paths","description":"Protect web applications with Cloudflare security products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/rate-limiting/","name":"Rate Limiting"}}]} ``` --- --- title: Configurations description: Configure rules with advanced settings. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configurations Let's step through an example. If your `/create-account` page is being attacked, you will create a rule to limit the amount of requests, per `counting characteristic`, that you feel comfortable permitting through to your origin. The rule below is being created on the `free` plan, which limits configuration options. The rule will trigger if the URI path matches `/create-account`, from the same IP address, _after_ 5 requests and within a 10 second window, [within each Cloudflare datacenter](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/request-rate/), globally. --- ![rate-limiting-create-account-endpoint](https://edgetunnel-b2h.pages.dev/_astro/rl-create-account-endpoint.BFxHF746_ZuP5Pg.webp)![rate-limiting-create-account-endpoint-block](https://edgetunnel-b2h.pages.dev/_astro/rl-create-account-endpoint-block.DOOFhKll_Z1wTXBj.webp) --- ## Advanced configuration In the previous module, we reviewed the various configurations available per plan. Using the same endpoint as an example, let us walk through another example, but with the additional advanced configurations. The rule below is being created on the `enterprise` plan, so we are no longer limited to default configurations. * The rule will also limit the number of requests to `/create-account`, but will only trigger against `POST` requests. In the basic example, even requests with the `GET` method will increment the counter. * Requests that do not have a [client certificate (mTLS)](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/), will increment the counter. * Requests will be counted using the [IP with NAT support](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/parameters/#use-cases-of-ip-with-nat-support) characteristic. * Within a 1 minute period, for each counted entity, if the number of requests exceeds 10, then the user will be presented with a [Managed Challenge](https://edgetunnel-b2h.pages.dev/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge) for a custom duration of 1 day. ![rate-limiting-advanced-config-1](https://edgetunnel-b2h.pages.dev/_astro/rl-advanced-config.CWcevnzk_Z1ixPSR.webp) --- ## Best practices Rules that match identical criteria can be stacked together. For example, instead of creating just a single rule for `/create-account`, you can create multiple rules that match the same path but have different `counting characteristics` or `request limits` to protect against a threat that might behave dynamically. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/configurations/#page","headline":"Configurations · Cloudflare Learning Paths","description":"Configure rules with advanced settings.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/configurations/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/rate-limiting/","name":"Rate Limiting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/rate-limiting/configurations/","name":"Configurations"}}]} ``` --- --- title: Features description: Review available features by plan type. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Features Rate limiting is composed of the following parameters: * An [expression](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/expressions/) that specifies the criteria you are matching traffic on using the [Rules language](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/). * An [action](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/actions/) that specifies what to perform when there is a match for the rule and any additional conditions are met. In the case of rate limiting rules, the action occurs when the rate reaches the specified limit. Besides these two parameters, rate limiting rules require the following additional parameters: * **Characteristics**: The set of parameters that define how Cloudflare tracks the rate for this rule. * **Period**: The period of time to consider (in seconds) when evaluating the rate. * **Requests per period**: The number of requests over the period of time that will trigger the rate limiting rule. * **Duration** (or mitigation timeout): Once the rate is reached, the rate limiting rule blocks further requests for the period of time defined in this field. * **Action behavior**: By default, Cloudflare will apply the rule action for the configured duration (or mitigation timeout), regardless of the request rate during this period. Some Enterprise customers can configure the rule to [throttle requests](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/parameters/#with-the-following-behavior) over the maximum rate, allowing incoming requests when the rate is lower than the configured limit. ## Features by plan type Features vary by plan type. | Feature | Free | Pro | Business | Enterprise with app security | Enterprise with Advanced Rate Limiting | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------- | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Available fieldsin rule expression | Path, [Verified Bot](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/cf.bot%5Fmanagement.verified%5Fbot/) | Host, URI, Path, Full URI, Query, Verified Bot | Host, URI, Path, Full URI, Query, Method, Source IP, User Agent, Verified Bot | General request fields, request header fields, Verified Bot, Bot Management fields[1](#user-content-fn-1) | General request fields, request header fields, Verified Bot, Bot Management fields[1](#user-content-fn-1), request body fields[2](#user-content-fn-2) | | Cache exclusion | No | No | Yes | Yes | Yes | | Counting characteristics | IP | IP | IP, IP with NAT support | IP, IP with NAT support | IP, IP with NAT support, Query, Host, Headers, Cookie, ASN, Country, Path, JA3/JA4 Fingerprint[1](#user-content-fn-1), JSON field value[2](#user-content-fn-2), Body[2](#user-content-fn-2), Form input value[2](#user-content-fn-2), Custom | | Custom counting expression | No | No | Yes | Yes | Yes | | Available fieldsin counting expression | N/A | N/A | All rule expression fields, Response code, Response headers | All rule expression fields, Response code, Response headers | All rule expression fields, Response code, Response headers | | Counting model | Number of requests | Number of requests | Number of requests | Number of requests | Number of requests, [complexity score](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/request-rate/#complexity-based-rate-limiting) | | Rate limitingaction behavior | Perform action during mitigation period | Perform action during mitigation period | Perform action during mitigation period | Perform action during mitigation period, Throttle requests above rate with block action | Perform action during mitigation period, Throttle requests above rate with block action | | Counting periods | 10 s | All supported values up to 1 min[3](#user-content-fn-3) | All supported values up to 10 min[3](#user-content-fn-3) | All supported values up to 65,535 s[3](#user-content-fn-3) | All supported values up to 65,535 s[3](#user-content-fn-3) | | Mitigation timeout periods | 10 s | All supported values up to 1 h[3](#user-content-fn-3) | All supported values up to 1 day[3](#user-content-fn-3) | All supported values up to 1 day[3](#user-content-fn-3) [4](#user-content-fn-4) | All supported values up to 1 day[3](#user-content-fn-3) [4](#user-content-fn-4) | | Number of rules | 1 | 2 | 5 | 100[5](#user-content-fn-5) | 100 | Footnotes 1: Only available to Enterprise customers who have purchased [Bot Management](https://edgetunnel-b2h.pages.dev/bots/plans/bm-subscription/). 2: Availability depends on your WAF plan. 3: List of supported counting/mitigation period values in seconds: 10, 15, 20, 30, 40, 45, 60 (1 min), 90, 120 (2 min), 180 (3 min), 240 (4 min), 300 (5 min), 480, 600 (10 min), 900, 1200 (20 min), 1800, 2400, 3600 (1 h), 65535, 86400 (1 day). Not all values are available on all plans. 4: Enterprise customers can specify a custom mitigation timeout period via API. 5: Enterprise customers must have application security on their contract to get access to rate limiting rules. The number of rules depends on the exact contract terms. ## Footnotes 1. Only available to Enterprise customers who have purchased [Bot Management](https://edgetunnel-b2h.pages.dev/bots/plans/bm-subscription/). [↩](#user-content-fnref-1) [↩2](#user-content-fnref-1-2) [↩3](#user-content-fnref-1-3) 2. Availability depends on your WAF plan. [↩](#user-content-fnref-2) [↩2](#user-content-fnref-2-2) [↩3](#user-content-fnref-2-3) [↩4](#user-content-fnref-2-4) 3. Supported period values in seconds: 10, 15, 20, 30, 40, 45, 60 (1 min), 90, 120 (2 min), 180 (3 min), 240 (4 min), 300 (5 min), 480, 600 (10 min), 900, 1200 (20 min), 1800, 2400, 3600 (1 h), 65535, 86400 (1 day). [↩](#user-content-fnref-3) [↩2](#user-content-fnref-3-2) [↩3](#user-content-fnref-3-3) [↩4](#user-content-fnref-3-4) [↩5](#user-content-fnref-3-5) [↩6](#user-content-fnref-3-6) [↩7](#user-content-fnref-3-7) [↩8](#user-content-fnref-3-8) 4. Enterprise customers can specify a custom mitigation timeout period via API. [↩](#user-content-fnref-4) [↩2](#user-content-fnref-4-2) 5. Enterprise customers must have application security on their contract to get access to rate limiting rules. The number of rules depends on the exact contract terms. [↩](#user-content-fnref-5) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/features/#page","headline":"Features · Cloudflare Learning Paths","description":"Review available features by plan type.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/features/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/rate-limiting/","name":"Rate Limiting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/rate-limiting/features/","name":"Features"}}]} ``` --- --- title: Use cases description: Explore common use cases and configurations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use cases The most common uses cases are: * [Enforce granular access control](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/best-practices/#enforcing-granular-access-control) to resources. Includes access control based on criteria such as user agent, IP address, referrer, host, country, and world region. * [Protect against credential stuffing](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing) and account takeover attacks. * [Limit the number of operations](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/best-practices/#limiting-the-number-of-operations) performed by individual clients. Includes preventing scraping by bots, accessing sensitive data, bulk creation of new accounts, and programmatic buying in ecommerce platforms. * [Protect REST APIs](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/best-practices/#protecting-rest-apis) from resource exhaustion (targeted DDoS attacks) and resources from abuse in general. * [Protect GraphQL APIs](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/best-practices/#protecting-graphql-apis) by preventing server overload and limiting the number of operations. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/use-cases/#page","headline":"Use cases · Cloudflare Learning Paths","description":"Explore common use cases and configurations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/rate-limiting/use-cases/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/rate-limiting/","name":"Rate Limiting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/rate-limiting/use-cases/","name":"Use cases"}}]} ``` --- --- title: Security Center description: Protect web applications with Cloudflare security products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Security Center Cloudflare Security Center brings together your Cloudflare security products, threat intelligence from Cloudflare's global network, and configuration analysis into a unified security intelligence solution. Security Center enables you to strengthen your security posture by: * **Mapping your attack surface** — identifying the Internet-facing assets (domains, DNS records, and IP addresses) associated with your Cloudflare account * **Providing asset inventory and discovery** — listing the infrastructure Cloudflare detects across your account so you can review what is exposed * **Identifying potential security risks, misconfigurations, and vulnerabilities** — running automated scans that compare your current Cloudflare configuration against ideal settings * **Helping you mitigate these risks** — connecting each finding to the relevant Cloudflare product setting so you can resolve issues from the dashboard ## Objectives By the end of this module, you will be able to: * Understand the primary Security Center features such as Security Insights and Brand Protection * Review and manage security risks at the account level, encompassing all of your domains in one unified view ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/security-center/#page","headline":"Security Center · Cloudflare Learning Paths","description":"Protect web applications with Cloudflare security products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/security-center/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/security-center/","name":"Security Center"}}]} ``` --- --- title: Brand Protection description: Detect domain and logo impersonation attempts. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Brand Protection Brand Protection allows you to proactively identify and mitigate domain impersonation and phishing attacks. By monitoring newly registered domains and visual assets across the Internet, Cloudflare helps protect your brand's reputation and prevents your customers or employees from submitting sensitive information to fraudulent sites. Common threats include: * [Typosquatting ↗](https://en.wikipedia.org/wiki/Typosquatting): For example, typing `cloudfalre.com` instead of `cloudflare.com`. * Concatenation of services (`cloudflare-service.com`) often registered by attackers to trick unsuspecting victims into submitting private information such as passwords. * [Homoglyph attacks ↗](https://en.wikipedia.org/wiki/IDN%5Fhomograph%5Fattack) that use lookalike characters to trick unsuspecting victims. ## Types of queries 1. [Domain search](https://edgetunnel-b2h.pages.dev/security-center/brand-protection/#domain-search): allows you to search for domains that might be trying to impersonate your brand. 2. [Logo search](https://edgetunnel-b2h.pages.dev/security-center/brand-protection/#logo-queries): allows you to search for logos that might look and feel like your brand's logo. ## Alerts Brand Protection integrates with Cloudflare's ANS (Alerts Notification Service) to provide configurable alerts when new domains are detected. Any matches that are found during the new domain search are then inserted into an internal alerts table which triggers an alert for the user. This allows you to receive real-time notifications and take immediate action to investigate and potentially block any suspicious domains that may be attempting to impersonate your brand. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/security-center/brand-protection/#page","headline":"Brand Protection · Cloudflare Learning Paths","description":"Detect domain and logo impersonation attempts.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/security-center/brand-protection/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/security-center/","name":"Security Center"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/security-center/brand-protection/","name":"Brand Protection"}}]} ``` --- --- title: Security Insights description: Scan and review aggregated security risks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Security Insights Security Insights provides you with a list of insights, covering different areas of your Cloudflare environment, such as: Cloudflare account settings, DNS record configurations, SSL/TLS certificates configurations, Cloudflare Access configurations and Cloudflare WAF configurations. ## Dashboard analytics Security Insights focuses on your Cloudflare environment by running [security scans](https://edgetunnel-b2h.pages.dev/security/security-insights/how-it-works/#scan-frequency) at regular intervals. Instead of navigating through each of your domains to review their security issues, the Security Center aggregates all of them into a single dashboard. ![Security Insights Overview](https://edgetunnel-b2h.pages.dev/_astro/security-insights-overview.lQDBpBkp_1nGdoq.webp) The list of insights may include potential security threats, vulnerabilities, compliance risks, insecure configurations, or any other identified risks. ## Severity properties Each insight that is discovered by the Security Insights scan will have the following properties assigned to them: * **Severity**: The security risk of the insight. The severity values are: _Low_, _Moderate_, and _Critical_. The higher the severity level, the higher the risk of threat to your environment. * **Insight**: The insight description detailing the current configuration that is causing the risk or vulnerability. * **Risk**: A description of the risk associated with not addressing the issue. * **Type**: The insight category. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/security-center/insights/#page","headline":"Security Insights · Cloudflare Learning Paths","description":"Scan and review aggregated security risks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/application-security/security-center/insights/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-05","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/application-security/security-center/","name":"Security Center"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/application-security/security-center/insights/","name":"Security Insights"}}]} ``` --- --- title: Overview description: Accelerate and secure web traffic in mainland China. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Overview ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/#page","headline":"Overview · Cloudflare Learning Paths","description":"Accelerate and secure web traffic in mainland China.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/china-network-overview/series/","name":"Overview"}}]} ``` --- --- title: How to accelerate dynamic traffic outside of mainland China description: Accelerate dynamic traffic outside mainland China. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # How to accelerate dynamic traffic outside of mainland China * [ Watch this episode ](#tab-panel-9885) * [ Series overview ](#tab-panel-9886) In this video, Jess Liu discusses Cloudflare's CDN Global Acceleration (formerly China Express), including solutions for high latency on dynamic content, accelerating API calls, accessing Cloudflare One services like the Cloudflare One Client and Cloudflare WAN from within mainland China, and securely connecting private enterprise networks. **Related content** For additional resources on the China Network, refer to the following resources: * [Cloudflare China Network](https://edgetunnel-b2h.pages.dev/china-network/) * [CDN Global Acceleration (formerly China Express)](https://edgetunnel-b2h.pages.dev/china-network/concepts/global-acceleration/) * [Internet Content Provider (ICP)](https://edgetunnel-b2h.pages.dev/china-network/concepts/icp/) * [Authoritative DNS in mainland China](https://edgetunnel-b2h.pages.dev/china-network/concepts/china-dns/) [ Watch Episode 1: How to speed up your web traffic inside mainland China ](https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-network-main-features-1/) This video discusses the main features of Cloudflare's China Network, including how the China Network works, improving availability and response times with caching, in-country China name servers, and compliance with ICP regulations. [ Watch Episode 2: How to accelerate dynamic traffic outside of mainland China ](https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-express-overview-2/) This video discusses Cloudflare's CDN Global Acceleration (formerly China Express), including solutions for high latency on dynamic content, accelerating API calls, accessing Cloudflare One services like the Cloudflare One Client and Cloudflare WAN from within mainland China, and securely connecting private enterprise networks. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-express-overview-2/#page","headline":"How to accelerate dynamic traffic outside of mainland China · Cloudflare Learning Paths","description":"Accelerate dynamic traffic outside mainland China.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-express-overview-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-06-15","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/china-network-overview/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/china-network-overview/series/china-express-overview-2/","name":"How to accelerate dynamic traffic outside of mainland China"}}]} ``` --- --- title: How to speed up your web traffic inside mainland China description: Speed up web traffic inside mainland China. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # How to speed up your web traffic inside mainland China * [ Watch this episode ](#tab-panel-9887) * [ Series overview ](#tab-panel-9888) In this video, Jess Liu walks us through the main features of Cloudflare's China Network. They cover how the China Network works, including integrated caching, in-country China name servers, and compliance with ICP regulations. They also briefly discuss Cloudflare’s CDN Global Acceleration (formerly China Express), an option for accelerating dynamic content that cannot be cached. **Related content** For additional resources on the China Network, refer to the following resources: * [Cloudflare China Network](https://edgetunnel-b2h.pages.dev/china-network/) * [CDN Global Acceleration (formerly China Express)](https://edgetunnel-b2h.pages.dev/china-network/concepts/global-acceleration/) * [Internet Content Provider (ICP)](https://edgetunnel-b2h.pages.dev/china-network/concepts/icp/) * [Authoritative DNS in mainland China](https://edgetunnel-b2h.pages.dev/china-network/concepts/china-dns/) [ Watch Episode 1: How to speed up your web traffic inside mainland China ](https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-network-main-features-1/) This video discusses the main features of Cloudflare's China Network, including how the China Network works, improving availability and response times with caching, in-country China name servers, and compliance with ICP regulations. [ Watch Episode 2: How to accelerate dynamic traffic outside of mainland China ](https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-express-overview-2/) This video discusses Cloudflare's CDN Global Acceleration (formerly China Express), including solutions for high latency on dynamic content, accelerating API calls, accessing Cloudflare One services like the Cloudflare One Client and Cloudflare WAN from within mainland China, and securely connecting private enterprise networks. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-network-main-features-1/#page","headline":"How to speed up your web traffic inside mainland China · Cloudflare Learning Paths","description":"Speed up web traffic inside mainland China.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/china-network-overview/series/china-network-main-features-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/china-network-overview/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/china-network-overview/series/china-network-main-features-1/","name":"How to speed up your web traffic inside mainland China"}}]} ``` --- --- title: Secure your applications description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Secure your applications Now that you have [connected your private applications](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/) to Cloudflare, secure those applications behind Cloudflare Access. ## Objectives By the end of this module, you will be able to: * Add your application to Cloudflare Access. * Create an Access policy. * Design reusable policies. * Design a domain structure for your applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/#page","headline":"Secure your applications · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/access-application/","name":"Secure your applications"}}]} ``` --- --- title: Best practices description: Follow recommended deployment best practices. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Best practices Learn best practices for building scalable Access applications and policies. ## Create reusable policy components If you have many policies that contain duplicate rules, we recommend [building a rule group](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/groups/) and referencing it across multiple policies. For example, you could define a rule group for "corporate users", which has both device posture check requirements and specific emails, or just “developers”, which references a group in your identity provider. ## Define your domain structure Access applications have an inherently flexible and powerful domain structure capability. Your domain structure should achieve your application security goals without being overly permissive or overly restrictive. Before designing applications for production, review the [Application paths documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/app-paths/) to understand how path definitions work and how to use wildcards. ### Multiple domains in an application Many customers who have workflows designed around internal web applications, especially those that were built internally, often see challenges related to interdependencies on multiple internal services. Separately, there can be challenges related to SPAs (Single-Page Applications) that make deploying clientless access difficult. For example, an application may have iFrames or other embedded systems that rely on different internal and/or external addresses. If your internal service operates in this way, we recommend specifying multiple top-level domains in a single Access application. Otherwise, if the goal of using multiple domains is to streamline or simplify policy creation, we recommend making one primary domain per application, and automating the rest of your deployment [using Terraform](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/terraform/) or another Infrastructure as Code (IaC) service. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/best-practices/#page","headline":"Best practices · Cloudflare Learning Paths","description":"Follow recommended deployment best practices.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/best-practices/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/access-application/","name":"Secure your applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/access-application/best-practices/","name":"Best practices"}}]} ``` --- --- title: Create an Access application description: Add an application to Cloudflare Access. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create an Access application Cloudflare Access allows you to securely publish internal tools and applications to the Internet by providing an authentication layer between the end user and your origin server. You can use signals from your existing identity providers (IdPs), device posture providers, and [other rules](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#selectors) to control who can access your application. Each application can have multiple policies with different constraints depending on what user group is accessing the application. For example, you can create one policy that requires corporate users to present specific device posture checks or mutual TLS authentication events, and a second policy for contractors which does not require these attributes. ## Add your application to Access 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Applications**. 2. Select **Create new application**. 3. Select **Self-hosted and private**. 4. Select **Add public hostname**. 5. In the **Domain** dropdown, select the domain that will represent the application. Domains must belong to an active zone in your Cloudflare account. You can use [wildcards](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/app-paths/) to protect multiple parts of an application that share a root path. Alternatively, to use a [Cloudflare for SaaS custom hostname](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access/), select **Switch to custom input** and enter your custom hostname. 6. Under **Access policies**, add an existing policy or [create a new policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/policy-management/) to control who can connect to your application. All Access applications are deny by default -- a user must match an Allow policy before they are granted access. 7. Configure how users will authenticate: 1. Select the [identity providers](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) you want to enable for your application. 2. (Recommended) If you plan to only allow access via a single IdP, turn on **Apply instant authentication**. End users will not be shown the [Cloudflare Access login page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-login-page/). Instead, Cloudflare will redirect users directly to your SSO login event. 3. (Optional) Turn on **Authenticate with Cloudflare One Client** to allow users to authenticate to the application using their [ Cloudflare One Client session identity](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/client-sessions/). 8. (Optional) Configure [independent MFA](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/mfa-requirements/#configure-independent-mfa-for-an-application) for the application. 9. In **Session Duration**, choose how often the user's [application token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/) should expire. Cloudflare checks every HTTP request to your application for a valid application token. If the user's application token (and global token) has expired, they will be prompted to reauthenticate with the IdP. For more information, refer to [Session management](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/session-management/). 10. (Optional) Go to the **Additional settings** tab to customize the application experience: * **App Launcher customization**: Configure how this application appears to users in the [App Launcher](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/app-launcher/). * **Custom block pages**: Choose what users will see when they are denied access to the application. * **Cloudflare default**: Reload the [login page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-login-page/) and display a block message below the Cloudflare Access logo. The default message is `That account does not have access`, or you can enter a custom message. * **Redirect URL**: Redirect to the specified website. * **Custom page template**: Display a [custom block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-block-page/) hosted in Cloudflare One. * [**Cross-Origin Resource Sharing (CORS) settings**](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/cors/) * [**Cookie settings**](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#cookie-settings) * **401 Response for Service Auth policies**: Return a `401` response code when a user (or machine) makes a request to the application without the correct [service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/). 11. Select **Create**. When users go to the application, they will be prompted to login with your identity provider. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/create-access-app/#page","headline":"Create an Access application · Cloudflare Learning Paths","description":"Add an application to Cloudflare Access.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/create-access-app/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/access-application/","name":"Secure your applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/access-application/create-access-app/","name":"Create an Access application"}}]} ``` --- --- title: Advanced workflows description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Advanced workflows Configure advanced Access policies to meet the specific requirements of your application or organization. ## Objectives By the end of this module, you will be able to: * Check identity-based attributes that are not directly supported by the Access policy builder. * Deliver sensitive web applications in an isolated browser. * Apply Gateway HTTP policies without a device client. * Connect to applications using their private hostnames without a device client. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/#page","headline":"Advanced workflows · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/advanced-workflows/","name":"Advanced workflows"}}]} ``` --- --- title: External Evaluation rules description: Learn about external evaluation rules in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # External Evaluation rules With Cloudflare Access, you can build infinitely customizable policies using External Evaluation rules. External Evaluation rules allow you to call any API during the evaluation of an Access policy and authenticate users based on custom business logic. Example use cases include: * Customize policies based on time of day. * Check IP addresses against external threat feeds. * Call industry-specific user registries. The External Evaluation rule requires two values: an API endpoint to call and a key to verify that any request response is coming from a trusted source. After the user authenticates with your identity provider, all information about the user, device and location is passed to your external API. The API returns a pass or fail response to Access which will then either allow or deny access to the user. ## Set up External Evaluation rule For detailed setup instructions, refer to [External Evaluation rules](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/external-evaluation/). Example code for the API is available in our [open-source repository ↗](https://github.com/cloudflare/workers-access-external-auth-example). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/external-evaluation/#page","headline":"External Evaluation rules · Cloudflare Learning Paths","description":"Learn about external evaluation rules in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/external-evaluation/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/advanced-workflows/","name":"Advanced workflows"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/advanced-workflows/external-evaluation/","name":"External Evaluation rules"}}]} ``` --- --- title: Isolate Access applications description: Learn about isolate access applications in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Isolate Access applications Note Requires the Browser Isolation add-on. [Cloudflare Browser Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/) integrates with your web-delivered Access applications to protect sensitive applications from data loss. You can build Access policies that require certain users to access your application exclusively through Browser Isolation, while other users matching different policies continue to access the application directly. For example, you may wish to layer on additional security measures for third-party contractors or other users without a corporate device. Cloudflare sends all isolated traffic through our Secure Web Gateway inspection engine, which allows you to apply [Gateway HTTP policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/) such as: * Restrict specific actions and HTTP request methods. * Inspect the request body to match against [Data Loss Prevention](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) (DLP) profiles with as much specificity and control as if the user had deployed an endpoint agent. * Control users ability to cut and paste, upload and download files, or print while in an isolated session. ## Prerequisites Your browser must [allow third-party cookies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#allow-third-party-cookies-in-the-browser) on the application domain. ## Enable Browser Isolation 1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Browser isolation** \> **Browser isolation settings**. 2. Turn on **Allow users to open a remote browser without the device client**. 1. Go to **Access controls** \> **Applications**. 2. Choose a [self-hosted application](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) and select **Configure**. 3. Go to **Policies**. 4. Choose an [Allow policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) and select **Configure**. 5. Under **Additional settings**, turn on **Isolate application**. 6. Save the policy. Browser Isolation is now enabled for users who match this policy. After the user logs into Access, the application will launch in a remote browser. To confirm that the application is isolated, refer to [Check if a web page is isolated](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/#3-check-if-a-web-page-is-isolated). You can optionally add another Allow policy for users on managed devices who do not require isolation. ## Example Access policies In the following example, Policy 1 allows employees on corporate devices to access the application directly. Users who do not match Policy 1, such as employees and contractors on unmanaged devices, will load the application in an isolated browser. flowchart LR accTitle: Access policies for a private web application A[Full-time employee]-->policy1-->D B[Contractor]-->policy2-->E subgraph C[Access application] policy1["Policy 1: Allow employees who pass device posture checks"] policy2["Policy 2: Allow and isolate contractors"] end D[Normal browsing] E["Isolated browsing with HTTP policies applied"] **Policy 1: Allow employees who pass device posture checks** * [ Dashboard ](#tab-panel-9889) * [ API ](#tab-panel-9890) | Action | Rule type | Selector | Value | | ------ | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | Allow | Include | Emails ending in | @team.com | | | Require | [Device Posture - Serial Number List](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/corp-device/) | Corporate serial numbers | | Additional settings | Status | | ------------------- | -------- | | Isolate application | Disabled | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps/$APP_UUID/policies \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "decision": "allow", "name": "Allow employees who pass device posture checks", "include": [ { "email_domain": { "domain": "team.com" } } ], "exclude": [], "require": [ { "device_posture": { "integration_uid": "" } } ], "precedence": 1 }' ``` To create a list of serial numbers, refer to [Create Zero Trust list](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/lists/methods/create/). **Policy 2: Allow and isolate contractors** * [ Dashboard ](#tab-panel-9891) * [ API ](#tab-panel-9892) | Action | Rule type | Selector | Value | | ------ | --------- | ---------------- | --------------------------- | | Allow | Include | Emails ending in | @team.com, @contractors.com | | Additional settings | Status | | ------------------- | ------- | | Isolate application | Enabled | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps/$APP_UUID/policies \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "decision": "allow", "name": "Allow and isolate contractors", "include": [ { "email_domain": { "domain": "team.com" } }, { "email_domain": { "domain": "contractors.com" } } ], "exclude": [], "require": [], "precedence": 2, "isolation_required": true }' ``` ## Example HTTP policies ### Disable file downloads in isolated browser Prevents users on unmanaged devices from downloading any files from your private application. * [ Dashboard ](#tab-panel-9893) * [ API ](#tab-panel-9894) | Selector | Operator | Value | Logic | Action | | ---------------------------- | -------- | ------------------------ | ----- | ------- | | Host | in | internal.site.com | And | Isolate | | Passed Device Posture Checks | not in | Corporate serial numbers | | | | Policy settings | Status | | ---------------------- | ------- | | Disable file downloads | Enabled | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "name": "Disable file downloads in isolated browser", "conditions": [ { "type": "traffic", "expression": { "in": { "lhs": "http.request.host", "rhs": [ "internal.site.com" ] } } }, { "type": "device_posture", "expression": { "any": { "in": { "lhs": { "splat": "device_posture.checks.passed" }, "rhs": [ "" ] } } } } ], "action": "isolate", "precedence": 14002, "enabled": true, "description": "", "rule_settings": { "block_page_enabled": false, "block_reason": "", "biso_admin_controls": { "dcp": false, "dcr": false, "dd": true, "dk": false, "dp": false, "du": false } }, "filters": [ "http" ] }' ``` To create a list of serial numbers, refer to [Create Zero Trust list](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/lists/methods/create/). ### Block file downloads of sensitive data Note Requires Data Loss Prevention add-on. Block users on unmanaged devices from downloading files that contain credit card numbers. This logic requires two policies: * **Policy 1: [Disable file downloads in isolated browser](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/isolate-application/#disable-file-downloads-in-isolated-browser)** * **Policy 2: Block credit card numbers** * [ Dashboard ](#tab-panel-9895) * [ API ](#tab-panel-9896) | Selector | Operator | Value | Logic | Action | | -------------------------------------------------------------------------------------------------- | -------- | -------------------------- | ----- | ------ | | Host | in | internal.site.com | And | Block | | [DLP Profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/) | in | _Financial Information_ | And | | | Passed Device Posture Checks | not in | _Corporate serial numbers_ | | | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "name": "Block credit card numbers", "conditions": [ { "type": "traffic", "expression": { "and": [ { "in": { "lhs": "http.request.host", "rhs": [ "internal.site.com" ] } }, { "any": { "in": { "lhs": { "splat": "dlp.profiles" }, "rhs": [ "" ] } } } ] } }, { "type": "device_posture", "expression": { "any": { "in": { "lhs": { "splat": "device_posture.checks.passed" }, "rhs": [ "" ] } } } } ], "action": "block", "precedence": 14003, "enabled": true, "description": "", "rule_settings": { "block_page_enabled": false, "block_reason": "", "biso_admin_controls": null }, "filters": [ "http" ] }' ``` To configure a DLP profile, refer to [Update predefined profile](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/dlp/subresources/profiles/subresources/predefined/methods/update/) or [Create custom profile](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/dlp/subresources/profiles/subresources/custom/methods/create/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/isolate-application/#page","headline":"Isolate Access applications · Cloudflare Learning Paths","description":"Learn about isolate access applications in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/advanced-workflows/isolate-application/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/advanced-workflows/","name":"Advanced workflows"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/advanced-workflows/isolate-application/","name":"Isolate Access applications"}}]} ``` --- --- title: Alternative on-ramps description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Alternative on-ramps As discussed in the previous modules, almost everything you do with the Cloudflare reverse proxy requires [adding a site](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/add-site/) to Cloudflare. That public DNS record (or its subdomains) becomes the domain on which your users access your private applications. This method is exceptionally secure and transparent; each domain and subdomain has access to the Cloudflare web security portfolio, are inherently DDoS protected, and receive an obfuscated origin IP. For these reasons, using a [public hostname on Cloudflare](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/) is the recommended method to onboard applications for clientless user access. However, there may be times in which a public DNS record cannot be created, or other situations that prevent administrators from using this method. ## Objectives By the end of this module, you will be able to: * Connect to private web applications using their private hostnames. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/alternative-onramps/#page","headline":"Alternative on-ramps · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/alternative-onramps/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/alternative-onramps/","name":"Alternative on-ramps"}}]} ``` --- --- title: Clientless Web Isolation description: Learn about clientless web isolation in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Clientless Web Isolation Note Requires the Browser Isolation add-on. [Clientless Web Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) allows you to on-ramp user traffic to your private network without needing to install the Cloudflare One Client. Users access private applications by going to a prefixed URL: `https://.cloudflareaccess.com/browser/` After the user authenticates to your IdP, Cloudflare will load the application in a secure remote browser and apply your Gateway firewall policies to user traffic. ## Setup To configure Clientless Web Isolation to augment clientless access, refer to [this tutorial](https://edgetunnel-b2h.pages.dev/cloudflare-one/tutorials/clientless-access-private-dns/). ## Best practices * For guidance on building Gateway policies for private network applications, refer to [Secure your first application](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/create-policy/). * If you already deployed the Cloudflare One Client to some devices as part of a mixed-access methodology, ensure that your Gateway firewall policies do not rely on device posture checks. Because Clientless Web Isolation is not a machine in your fleet, it will not return any values for device posture checks. * You can standardize the user experience by making specific applications available in your App Launcher as [bookmarks](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/bookmarks/). In this case, you would create a new bookmark for `https://.cloudflareaccess.com/browser/https://internalresource.com`, which would take users directly to an isolated session with your application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/alternative-onramps/clientless-rbi/#page","headline":"Clientless Web Isolation · Cloudflare Learning Paths","description":"Learn about clientless web isolation in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/alternative-onramps/clientless-rbi/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/alternative-onramps/","name":"Alternative on-ramps"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/alternative-onramps/clientless-rbi/","name":"Clientless Web Isolation"}}]} ``` --- --- title: Concepts description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Review the concepts behind clientless access. ## Objectives By the end of this module, you will be able to: * Understand the purpose and benefits of clientless access. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/concepts/","name":"Concepts"}}]} ``` --- --- title: What is clientless access? description: Understand secure browser-based access without software. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is clientless access? Clientless access is a deployment option of a [Zero Trust Network Access (ZTNA) ↗](https://www.cloudflare.com/learning/access-management/what-is-ztna/) service that provides secure access to internal applications without requiring end users to install any software. Users access corporate resources like intranet web apps, SSH terminals, and Windows servers through RDP from their web browser. Clientless access is commonly used to provide internal, [least-privilege access ↗](https://www.cloudflare.com/learning/access-management/principle-of-least-privilege/) to users on unmanaged devices. Users may include third-party contractors, suppliers, and partners, or employees using personal mobile phones as part of an organization's bring-your-own-device (BYOD) policy. IT/security admins can decide how users authenticate, whether through their corporate identity provider, social media accounts, a PIN sent to their email, strong MFA, or a combination of options. Admins can also add inline services like Remote Browser Isolation (RBI) and Data Loss Prevention (DLP) to help prevent data exfiltration from unmanaged devices, still through a clientless implementation. Isolated apps can enforce broad data controls through the browser, such as preventing uploads/downloads or copy/paste, or incorporating DLP policies. ## Alternatives to clientless access ### Device client A device client enables additional capabilities for a ZTNA deployment, like adding full device posture checks to policy evaluations or providing access to private network resources on private hostnames. However, when extending access to third-party or temporary workers, some organizations are reluctant to buy and ship company-managed devices or onboard clients to users' personal devices. Some IT or security teams may have rigorous device compatibility, interoperability, or other software audit processes that could delay user onboarding for a ZTNA rollout. Contractors may also not allow external company software to be installed on their personal devices, whether a legacy VPN or a more modern software client. ### Identity provider workarounds Some organizations historically have created corporate identities for third-party users within their internal identity provider, or they have spent the time to integrate a third-party's external identity provider with their own. Time and complexity for this work aside, not all resources integrate directly with traditional identity and access management (IAM) products, so a tool like ZTNA can still be needed to aggregate access logistics more broadly across an organization's internal resources. ### Enterprise browsers Enterprise browsers are another tool sparking interest in the industry for hybrid work and internal access use cases. They aim to consolidate security features and provide similar unified access and data protection to resources, all through a managed browser. However, some users may not want to disrupt their preferred workflows through their existing browser(s), and some third parties may still not wish to install any external software including the managed browser. ## Why Cloudflare for clientless access One of the biggest challenges in delivering clientless, secure remote access is making it feel native for your end users. Solutions have existed for decades which operate in a way that breaks TLS on a firewall or creates a picture-in-a-picture to access an internal web service. These legacy solutions make it very difficult to apply traditional web security concepts to private apps. In contrast, Cloudflare is a leading [reverse proxy ↗](https://www.cloudflare.com/learning/cdn/glossary/reverse-proxy/) provider for public-facing web assets, proxying approximately [20% of all websites ↗](https://w3techs.com/technologies/overview/proxy). Together with our [SASE platform](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/), this establishes a unique position for Cloudflare to deliver performant browser-based security for both public and private resources. There is no additional overhead in implementation, management, ongoing updates, or routing. Clientless access accelerates user onboarding for your admins, and it makes private apps feel just like SaaS apps for your end users. Many organizations roll out clientless access use cases toward the start of their larger SASE architecture journey as a “quick win” to develop momentum for a longer [VPN replacement](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/) project or security modernization initiative. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/what-is-clientless-access/#page","headline":"What is clientless access? · Cloudflare Learning Paths","description":"Understand secure browser-based access without software.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/what-is-clientless-access/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/concepts/what-is-clientless-access/","name":"What is clientless access?"}}]} ``` --- --- title: Connect your private applications description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect your private applications Cloudflare Tunnel allows you to securely connect your applications to Cloudflare without a publicly routable IP address. With Tunnel, you do not send traffic to an external IP — instead, a lightweight daemon in your infrastructure (`cloudflared`) creates outbound-only connections to Cloudflare's global network. ## Objectives By the end of this module, you will be able to: * Create a Cloudflare Tunnel. * Publish your application via a public hostname. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/#page","headline":"Connect your private applications · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/connect-private-applications/","name":"Connect your private applications"}}]} ``` --- --- title: Best practices description: Follow recommended deployment best practices. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Best practices We recommend following these best practices when you deploy Cloudflare Tunnel for clientless access. ## Deploy another instance of cloudflared For an additional point of availability, add a [cloudflared replica](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) to another host machine in your network. ## Standardize public hostnames To make your applications easier to manage, standardize the public hostnames that you publish your applications on. Here are a few examples of how customers manage their public hostnames: * Delegate a subdomain of your primary public website to use for internal applications (for example, `tools.dev.customer.com`). * If your internal DNS infrastructure is available for public use, register your internal primary DNS record on Cloudflare and use this domain for your public hostname routes. This allows you to present applications on identical private and public hostnames. * Specify some sort of internal logic that generates hostnames based on the type of tool you are connecting. For example, if you have a set of applications in a US-East datacenter allocated explicitly for production resources, you could create subdomains of `tools.us-east.prod.ztproject.com`. ## Disable TLS verification If your public hostname route serves an `HTTPS` application, we recommend enabling [**No TLS Verify**](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#notlsverify) to reduce connectivity issues caused by mismatched certificates. **No TLS Verify** disables TLS verification between `cloudflared` and the origin service, meaning that `cloudflared` will accept any certificate that the origin service provides. This setting has no impact on traffic between the user's browser and the `cloudflared` host, which will always be encrypted. ## (Optional) Add `Host` header to accommodate local traffic management tools If your target application sits behind a load balancer or similar, you may need to set [**HTTP Host Header**](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#httphostheader) to the service hostname. Load balancers in between the origin service and `cloudflared` can be difficult to troubleshoot, and you can typically resolve the issue by adding a request header to match the way that the load balancer typically identifies traffic. ## Enable tunnel notifications [Enable notifications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/notifications/) in the Cloudflare dashboard to monitor tunnel health. ## Update cloudflared [Update cloudflared](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/) regularly to get the latest features and bug fixes. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/best-practices/#page","headline":"Best practices · Cloudflare Learning Paths","description":"Follow recommended deployment best practices.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/best-practices/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/connect-private-applications/","name":"Connect your private applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/connect-private-applications/best-practices/","name":"Best practices"}}]} ``` --- --- title: Create a Cloudflare Tunnel description: Create a tunnel to connect private applications. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Cloudflare Tunnel To enable clientless access to your applications, you will need to create a Cloudflare Tunnel that publishes applications to a domain on Cloudflare. A published application creates a public DNS record that routes traffic to a specific address, protocol, and port associated with a private application. For example, you can define a public hostname (`mywebapp.example.com`) to provide access to a web server running on `https://localhost:8080`. When a user goes to `mywebapp.example.com` in their browser, their request will first route to a Cloudflare data center where it is inspected against your configured security policies. Cloudflare will then forward validated requests down your tunnel to the web server. ![How an HTTP request reaches a private application connected with Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/_astro/handshake.eh3a-Ml1_26dKUX.webp) ## Create a tunnel To create a Cloudflare Tunnel: 1. Log in to the Cloudflare dashboard and go to **Networking** \> **Tunnels**. [ Go to **Tunnels** ](https://dash.cloudflare.com/?to=/:account/tunnels) 2. Select **Create a tunnel**. 3. Enter a name for your tunnel. We suggest choosing a name that reflects the type of resources you want to connect through this tunnel (for example, `enterprise-VPC-01`). 4. Select **Create Tunnel**. 5. Choose your operating system, then copy the installation command and run it in a terminal on your origin server. 6. Wait for the tunnel to connect. Once the connection is established, select **Continue**. ## Publish an application After creating your tunnel, add a published application route: 1. Go to **Networking** \> **Tunnels**, then select your tunnel. [ Go to **Tunnels** ](https://dash.cloudflare.com/?to=/:account/tunnels) 2. On the **Routes** tab, select **Add route**, then select **Published application**. 3. Enter a subdomain and select a **Domain** from the drop-down menu. Specify any subdomain or path information. Note If you add a multi-level subdomain (more than one level of subdomain), you must [order an Advanced Certificate for the hostname](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/#i-see-this-site-cant-provide-a-secure-connection). 4. In **Service URL**, enter the protocol and address of your application (for example, `http://localhost:8000`). Refer to [supported protocols](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols/) for available options. 5. Select **Save**. All users on the Internet can now connect to this application via its public hostname. In [Module 4: Secure your applications](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/access-application/), we will discuss how to restrict access to authorized users. Note If the tunnel is disconnected: * Ensure that your on-premise or cloud firewall allows egress traffic on the [required ports](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation). * Ensure that the `cloudflared` host machine can connect to your internal applications and services. Verify that the host has the proper security group memberships and that no firewalls will block traffic between the host and the target services. ## Additional resources For more control over how traffic routes through your tunnel, refer to the following links: * [DNS records](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/) * [Load balancer](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/create-tunnel/#page","headline":"Create a Cloudflare Tunnel · Cloudflare Learning Paths","description":"Create a tunnel to connect private applications.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/create-tunnel/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/connect-private-applications/","name":"Connect your private applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/connect-private-applications/create-tunnel/","name":"Create a Cloudflare Tunnel"}}]} ``` --- --- title: Customize the end user experience description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Customize the end user experience Cloudflare Access offers several ways to customize the look and feel of the user login experience. ## Objectives By the end of this module, you will be able to: * Configure the App Launcher so that users can open all applications from single dashboard. * Add bookmarks to the App Launcher for applications that are not behind Access. * Customize the Access login page with your organization's branding. * Display custom block pages when a user is blocked by your Access policies. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/#page","headline":"Customize the end user experience · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/customize-ux/","name":"Customize the end user experience"}}]} ``` --- --- title: App Launcher description: Configure the Access App Launcher portal. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # App Launcher With the Access App Launcher, users can open all applications that they have access to from a single dashboard. The App Launcher is available at a team domain unique to your Cloudflare Zero Trust account, for example `mycompany.cloudflareaccess.com`. Users log in using one of the identity providers configured for the account. Once Access authenticates the user, the App Launcher displays applications they are authorized to use, in the form of application tiles. Selecting an application tile launches the application's hostname, sending the user to that tool as part of their SSO flow. ![App Launcher portal](https://edgetunnel-b2h.pages.dev/_astro/app-launcher.BA8TF5r4_23joar.webp) ## Enable the App Launcher By default, the App Launcher is disabled. To enable it, you must configure a policy that defines which users can access the App Launcher. To enable the App Launcher: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Access settings**. 2. Under the **Manage your App Launcher** card, select **Manage**. 3. On the **Policies** tab, [build a policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) to define who can access your App Launcher portal. These rules do not impact permissions for the applications secured behind Access. 4. On the **Authentication** tab, choose the identity providers users can authenticate with. 5. Select **Save**. The App Launcher is now available at `.cloudflareaccess.com`. You can always edit your App Launcher rules by going to **Access controls** \> **Access settings**. ## Add a tile to the App Launcher Tiles have a one-to-one relationship with each application you create in Access. The tile names displayed in the Access App Launcher portal correspond to the application names listed under **Access controls** \> **Applications**. For example, if you create one application for general access to your Jira deployment and a separate application that restricts requests to a particular Jira path, a user authorized for both will see separate tiles for each. If you add multiple hostnames to a single application, the user will only see the domain selected in the application's **App Launcher** settings. To show an Access application in the App Launcher: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Applications**. 2. Select an application and select **Configure**. 3. Go to **Experience settings**. 4. Select **Show application in App Launcher**. The App Launcher link will only appear for users who are allowed by your Access policies. Blocked users will not see the app in their App Launcher. Note This toggle does not impact the user's ability to reach the application. Allowed users can always reach the application via a direct link, regardless of whether the toggle is enabled. Blocked users will never have access to the application. 5. (Optional) To use a custom logo for the application tile, select **Use custom logo** and enter a link to your desired image. Note If you are having issues specifying a custom logo, check that the image is served from an HTTPS endpoint. For example, `http://www.example.com/upload/logo.png` will not work. However, `https://www.example.com/upload/logo.png` will. 6. In **Application domains**, choose a domain to use for the App Launcher link. 7. (Optional) In **Tags**, add [custom tags](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/tags/) so that users can more easily find the application in their App Launcher. ## Customize App Launcher appearance To customize the App Launcher with your own branding, messages, and links, refer to the [Custom pages documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/app-launcher-customization/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/app-launcher/#page","headline":"App Launcher · Cloudflare Learning Paths","description":"Configure the Access App Launcher portal.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/app-launcher/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/customize-ux/","name":"Customize the end user experience"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/customize-ux/app-launcher/","name":"App Launcher"}}]} ``` --- --- title: Block page description: Display custom Access block pages. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Block page You can customize the block page that displays when users fail to authenticate to an Access application. Each application can have a different block page. Gateway block page To customize the page that users see when they are blocked by a Gateway firewall policy, refer to [Gateway block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/). ## Types of block pages Cloudflare Access offers three different block page options: * **Default**: Displays a Cloudflare branded block page. * **Custom Redirect URL** \- Redirects blocked requests to the specified URL. For example, you could redirect the user to a [dynamic Access Denied page ↗](https://github.com/cloudflare/cf-identity-dynamic) that fetches their identity and shows the exact reason they were blocked. * **Custom Page Template** \- (Only available on Pay-as-you-go and Enterprise plans) Displays a [custom HTML page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-block-page/#create-a-custom-block-page) hosted by Cloudflare. ### Identity versus non-identity You can display a different [type of block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-block-page/#types-of-block-pages) to users who fail an identity-based policy versus a non-identity policy. * **Identity failure block page**: Displays when the user is blocked by an identity-based Access policy (such as email, user group, or external evaluation rule), after logging in to their identity provider. * **Non-identity failure block page**: Displays when the user is blocked by a non-identity Access policy (such as country, IP, or device posture). Cloudflare checks non-identity attributes before prompting the user to login. ## Create a custom block page Note Only available on Pay-as-you-go and Enterprise plans. To create a custom block page for Access: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Custom pages**. 2. Find the **Access Custom Pages** setting and select **Manage**. 3. Select **Add a page template**. 4. Enter a unique name for the block page. 5. In **Type**, select whether this is an [identity or non-identity block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-block-page/#identity-versus-non-identity). 6. In **Custom HTML**, enter the HTML code for your custom page. For example, ```html

Access denied.

To obtain access, contact your IT administrator.

``` 7. To check the appearance of your custom page, select **Download** and open the HTML file in a browser. 8. Once you are satisfied with your custom page, select **Save**. You can now select this block page when you [configure an Access application](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/block-page/#page","headline":"Block page · Cloudflare Learning Paths","description":"Display custom Access block pages.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/block-page/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/customize-ux/","name":"Customize the end user experience"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/customize-ux/block-page/","name":"Block page"}}]} ``` --- --- title: Bookmarks description: Add bookmarks to the Access App Launcher. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Bookmarks With Cloudflare One, you can show applications on the [App Launcher](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/app-launcher/) even if those applications are not secured behind Access. This way, users can access all the applications they need to work, all in one place — regardless of whether those applications are protected by Access. Links to applications not protected by Access can be added as bookmarks. You can assign [Access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) to control which users see the bookmark in the App Launcher. Users who do not match an Allow policy will not see the bookmark tile. Unlike policies for other Access application types, bookmark policies only affect visibility in the App Launcher and do not control access to the destination URL. 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Applications**. 2. Select **Create new application** \> **Bookmarks**. 3. Name your application. 4. Enter your **Application URL**, for example `https://mybookmark.com`. 5. (Optional) To restrict who can see the bookmark, select an existing policy or create a new one. If you do not add any policies, the bookmark is visible to all users in your organization. * To use an existing policy, select **Select existing policies** and choose the policies you want to apply. Refer to [supported policies](#supported-policies) for policy limitations. * To create a new policy, select **Create new policy** and [build your policy rules](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/). 6. Select **Next**. 7. Turn on **App Launcher visibility** if you want the application to be visible in the App Launcher. The toggle does not impact the ability for users to reach the application. 8. (Optional) To add a custom logo for your application, select **Custom** and enter the image URL. Note If you are having issues specifying a custom logo, check that the image is served from an HTTPS endpoint. For example, `http://www.example.com/upload/logo.png` will not work. However, `https://www.example.com/upload/logo.png` will. 9. Select **Save**. The application will show up on the Applications page labeled as `BOOKMARK`. You can always edit or delete your bookmarks, as you would any other application. ## Authentication logs Bookmark applications do not generate individual [Access authentication logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#authentication-logs) when a user selects the bookmark tile. Only the authentication event to the App Launcher itself is logged. ## Supported bookmark policies Bookmark policies support all [Access policy selectors](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#selectors), including * Identity-based selectors (such as emails, email domains, or identity provider groups) * Location-based selectors (such as country or IP ranges) * Device posture checks (requires installing the Cloudflare One Client) The following policy features are not supported for bookmark applications: * [Isolate application](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/isolate-application/) * [Purpose justification](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/require-purpose-justification/) * [Temporary authentication](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/temporary-auth/) If you attempt to assign a policy that uses an unsupported feature, the dashboard will display an error. Device posture policies To show bookmarks only to users on managed devices, assign a policy that requires device posture checks (such as [Require Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/require-gateway/)). The bookmark will only appear in the App Launcher for users whose devices satisfy the posture requirements. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/bookmarks/#page","headline":"Bookmarks · Cloudflare Learning Paths","description":"Add bookmarks to the Access App Launcher.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/bookmarks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/customize-ux/","name":"Customize the end user experience"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/customize-ux/bookmarks/","name":"Bookmarks"}}]} ``` --- --- title: Login page description: Customize the Access login page branding. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Login page The Access login page is where users select their identity provider (IdP) or One-Time PIN prior to accessing the application. Customers who only use one IdP usually enable **Apply instant authentication** for their applications, which redirects end users directly to the SSO login page. If you are using multiple IdPs, we recommend customizing the Access login page to match your branding and minimize user confusion. ## Customize the login page To change the appearance of your login page: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Custom pages**. 2. Find the **Access login page** setting and select **Manage**. 3. Give the login page the look and feel of your organization by adding: * Your organization's name * A logo * A custom header and footer * A preferred background color Any changes you make will be reflected in real time in the **Preview** card. 4. Once you are satisfied with your customization, select **Save**. The login page is now updated for all of your Access applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/login-page/#page","headline":"Login page · Cloudflare Learning Paths","description":"Customize the Access login page branding.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/login-page/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-06","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/customize-ux/","name":"Customize the end user experience"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/customize-ux/login-page/","name":"Login page"}}]} ``` --- --- title: Tags description: Organize applications with Access tags. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Tags You can label an Access application with up to 25 custom tags. End users can then filter the applications in their [App Launcher](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/app-launcher/) by their tags. ### Create a tag To create a new tag: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Tags**. 2. Select **Add a tag**. 3. Enter up to 35 alphanumeric characters for the tag (for example, `Human Resources`) and select it in the dropdown menu. 4. Select **Save**. You can now [add this tag](#tag-an-access-application) to an Access application. ### Tag an Access application To add a tag to an existing Access application: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Applications**. 2. Select an application and select **Configure**. 3. Go to **Additional settings**. 4. In the **Tags** dropdown, select the tags that you would like to assign to this application. The tag must be [created](#create-a-tag) before you can select it in the dropdown. 5. Select **Save**. The tag will now appear on the application's App Launcher tile. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/tags/#page","headline":"Tags · Cloudflare Learning Paths","description":"Organize applications with Access tags.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/customize-ux/tags/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/customize-ux/","name":"Customize the end user experience"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/customize-ux/tags/","name":"Tags"}}]} ``` --- --- title: Initial setup description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Initial setup In this guide, you will learn how to deliver clientless access using the Cloudflare Zero Trust suite of products. This guide will focus on browser-based applications that do not require users to install a device client of any kind. It will discuss both common and complex scenarios, and should give you the tools to provide secure user access to internal web applications following a [Zero Trust model ↗](https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/). If you need to deliver access to non-browser based applications, refer to our complementary guide for [replacing your VPN](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/). ## Objectives By the end of this module, you will be able to: * Set up a Cloudflare account. * Add your domain to Cloudflare. * Create a Zero Trust organization to manage applications and policies. * Configure an identity provider (IdP) for user authentication. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/#page","headline":"Initial setup · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/initial-setup/","name":"Initial setup"}}]} ``` --- --- title: Add a site description: Add your domain to Cloudflare DNS. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Add a site In clientless access deployments, users connect to internal applications via public hostnames. You will need to own a domain, add it to Cloudflare, and configure Cloudflare as the [authoritative DNS provider](https://edgetunnel-b2h.pages.dev/dns/zone-setups/full-setup/setup/#34-update-your-registrar) for that domain. Enterprise customers who cannot change their authoritative DNS provider have the option to configure a [CNAME setup](https://edgetunnel-b2h.pages.dev/dns/zone-setups/partial-setup/). You only need to add one domain to Cloudflare, since you can create an infinite number of subdomains to manage all of your private applications. ## Add a site to Cloudflare 1. Log in to the [Cloudflare dashboard ↗](https://dash.cloudflare.com/login). 2. Select **Onboard a domain**. 3. Enter your website's apex domain (`example.com`). 4. Select a [plan ↗](https://www.cloudflare.com/plans/#compare-features) for this website. Everything you need to do with the domain in Cloudflare Zero Trust is available on the **Free** plan. 5. Select **Continue**. Cloudflare will scan your website for any configured DNS records. Note If Cloudflare is unable to identify your domain as a registered domain, make sure you are using an existing [top-level domain ↗](https://www.cloudflare.com/learning/dns/top-level-domain/) (`.com`, `.net`, `.biz`, or others). Additionally, Cloudflare requires your `apex domain` to be one level below a valid TLD defined in the [Public Suffix List (PSL) ↗](https://github.com/publicsuffix/list/blob/master/public%5Fsuffix%5Flist.dat). 1. Review your DNS records and select **Continue**. 2. Before your domain can begin using Cloudflare for DNS resolution, you need to [add these nameservers](https://edgetunnel-b2h.pages.dev/dns/nameservers/update-nameservers/) at your registrar. Make sure [DNSSEC](https://edgetunnel-b2h.pages.dev/dns/dnssec/) is turned off before proceeding. Provider-specific instructions This is not an exhaustive list of provider-specific instructions, but the following links may be helpful: * [Ionos ↗](https://www.ionos.com/help/domains/using-your-own-name-servers/using-your-own-name-servers-for-a-domain/) * [101Domain ↗](https://help.101domain.com/kb/managing-name-server-records) * [Amazon ↗](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-adding-changing) * [Blacknight ↗](https://help.blacknight.com/hc/articles/4413036322321-How-do-I-change-the-nameservers-for-my-domain) * [BlueHost ↗](https://www.bluehost.com/help/article/custom-nameservers) * [DirectNIC ↗](https://directnic.com/knowledge/article/33:how%2Bdo%2Bi%2Bmodify%2Bname%2Bservers%2Bfor%2Bmy%2Bdomain%2Bname%253F) * [DNSMadeEasy ↗](http://www.dnsmadeeasy.com/support/faq/) * [Domain.com ↗](https://www.domain.com/help/article/domain-management-how-to-update-nameservers) * [Dotster ↗](https://www.dotster.com/help/article/domain-management-how-to-update-nameservers) * [DreamHost ↗](https://help.dreamhost.com/hc/en-us/articles/360038897151) * [EasyDNS ↗](https://kb.easydns.com/knowledge/settingchanging-nameservers/) * [Enom ↗](https://help.enom.com/hc/en-us/articles/115000486451-Nameservers-NS) * [Fast Domain ↗](https://www.fastdomain.com/hosting/help/transfer%5Fclient%5Fstart) * [FlokiNET ↗](https://billing.flokinet.is/index.php?rp=/knowledgebase/57/Nameserver-and-DNS-records.html) * [Gandi ↗](https://docs.gandi.net/en/domain%5Fnames/common%5Foperations/changing%5Fnameservers.html) * [GoDaddy ↗](https://www.godaddy.com/help/change-nameservers-for-your-domain-names-664) * [HostGator ↗](https://www.hostgator.com/help/article/changing-name-servers) * [Hostico ↗](https://hostico.ro/docs/setarea-nameserverelor-din-contul-de-client-hostico/) * [HostMonster ↗](https://my.hostmonster.com/cgi/help/222) * [Hover ↗](https://support.hover.com/support/solutions/articles/201000064742-changing-your-domain-nameservers) * [Internetdbs ↗](https://faq.internetbs.net/hc/en-gb/articles/4516921367837-How-to-update-Nameservers-for-a-domain) * [iPage ↗](https://www.ipage.com/help/article/domain-management-how-to-update-nameservers) * [MelbourneIT ↗](https://support.melbourneit.au/docs/how-do-i-manage-my-dns-on-cpanel) * [Moniker ↗](https://support.moniker.com/hc/en-gb/articles/10101271418653-How-to-update-Nameservers-for-a-domain) * [Name.com ↗](https://www.name.com/support/articles/205934457-registering-custom-nameservers) * [Namecheap ↗](https://www.namecheap.com/support/knowledgebase/article.aspx/767/10/how-can-i-change-the-nameservers-for-my-domain) * [Network Solutions ↗](https://www.networksolutions.com/manage-it/edit-nameservers.jsp) * [OVH ↗](https://docs.ovh.com/gb/en/domains/web%5Fhosting%5Fgeneral%5Finformation%5Fabout%5Fdns%5Fservers/#step-2-edit-your-domains-dns-servers) * [Porkbun ↗](https://kb.porkbun.com/article/22-how-to-change-your-nameservers) * [Rackspace ↗](https://support.rackspace.com/how-to/rackspace-name-servers/) * [Register ↗](https://www.register.com/knowledge) * [Squarespace ↗](https://support.squarespace.com/hc/articles/4404183898125-Nameservers-and-DNSSEC-for-Squarespace-managed-domains#toc-open-the-domain-s-advanced-settings) * [Site5 ↗](https://kb.site5.com/dns-2/custom-nameservers/) * [Softlayer ↗](https://cloud.ibm.com/docs/dns?topic=dns-add-edit-or-delete-custom-name-servers-for-a-domain) * [Yola ↗](https://helpcenter.yola.com/hc/articles/360012492660-Changing-your-name-servers) If you cannot change your domain nameservers, you can still use Cloudflare on your website by activating Cloudflare through a [certified hosting partner ↗](https://www.cloudflare.com/en-gb/partners/technology-partners/). 3. (Optional) Follow the **Quick Start Guide** to configure security and performance settings. Registrars can take up to 24 hours to process nameserver changes. Your domain must be in an **Active** status before you can use it for clientless access. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/add-site/#page","headline":"Add a site · Cloudflare Learning Paths","description":"Add your domain to Cloudflare DNS.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/add-site/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/initial-setup/","name":"Initial setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/initial-setup/add-site/","name":"Add a site"}}]} ``` --- --- title: Configure an identity provider (recommended) description: Connect your identity provider to Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure an identity provider (recommended) An [identity provider (IdP)](https://www.cloudflare.com/learning/access-management/what-is-an-identity-provider/) stores and manages users' digital identities. You can integrate your existing identity provider with Cloudflare Zero Trust in order to manage user access to your private network. This requires configuration both in Cloudflare and with the identity provider itself. Note Some admins choose to test by authenticating with a [one-time PIN (OTP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) instead of an IdP. OTP can also be used as an alternative login method for contractors or other guests that are not part of your IdP. To add an identity provider: * [ Dashboard ](#tab-panel-9897) * [ Terraform (v5) ](#tab-panel-9898) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Integrations** \> **Identity providers**. 2. In the **Your identity providers** card, select **Add new identity provider**. 3. Select the identity provider you want to add. If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, select the [generic OIDC](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/) option. If they support SAML, select the [generic SAML](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration. 4. Fill in the necessary fields to set up your identity provider. Each identity provider will have different required fields for you to fill in. Step-by-step instructions are shown in the dashboard side panel. Alternatively, refer to the [IdP-specific documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/). 5. Once you have filled in the necessary fields, select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Organizations, Identity Providers, and Groups Write` 2. Add an identity provider to Cloudflare One using the [cloudflare\_zero\_trust\_access\_identity\_provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fidentity%5Fprovider) resource. For example, to add a Microsoft Entra ID integration: ```tf resource "cloudflare_zero_trust_access_identity_provider" "microsoft_entra_id" { account_id = var.cloudflare_account_id name = "Entra ID example" type = "azureAD" config = { client_id = var.entra_id_client_id client_secret = var.entra_id_client_secret directory_id = var.entra_id_directory_id support_groups = true } } ``` Each identity provider integration has different required attributes. You will need to obtain these attribute values from your identity provider. For more information, refer to the [IdP-specific documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/). If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, use the [generic OIDC](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/) option. If they support SAML, use the [generic SAML](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration. Users will now be able to select this IdP when they are prompted to authenticate. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/configure-idp/#page","headline":"Configure an identity provider (recommended) · Cloudflare Learning Paths","description":"Connect your identity provider to Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/configure-idp/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/initial-setup/","name":"Initial setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/initial-setup/configure-idp/","name":"Configure an identity provider (recommended)"}}]} ``` --- --- title: Create a Cloudflare account description: Sign up for a Cloudflare account. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Cloudflare account To create a new Cloudflare account: 1. [Sign up ↗](https://dash.cloudflare.com/sign-up) on the Cloudflare dashboard. 2. To secure your account, enable [two-factor authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/). 3. If you have a Cloudflare contact (Enterprise only), ask them to set up your account as a multi-user organization. Account members will need: * [**Access** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit applications and Access policies. * [**Gateway** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit Gateway policies. * [**PII** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/#cloudflare-zero-trust-pii) to view user information in Gateway activity logs. ## Best practices If you are creating an account for your team or a business, we recommend choosing an email alias or distribution list for your **Email**, such as `cloudflare@example.com`. This email address is the main point of contact for your Cloudflare billing, usage notifications, and account recovery. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/create-cloudflare-account/#page","headline":"Create a Cloudflare account · Cloudflare Learning Paths","description":"Sign up for a Cloudflare account.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/create-cloudflare-account/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/initial-setup/","name":"Initial setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/initial-setup/create-cloudflare-account/","name":"Create a Cloudflare account"}}]} ``` --- --- title: Create a Zero Trust organization description: Set up a Zero Trust organization. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Zero Trust organization To start using Zero Trust features, create a Zero Trust organization in your Cloudflare account. ## Sign up for Zero Trust To create a Zero Trust organization: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) by going to **Zero Trust** \> **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) at any time. ## (Optional) Manage Zero Trust in Terraform You can use the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest) to manage your Zero Trust organization alongside your other IT infrastructure. To get started with Terraform, refer to our [Terraform tutorial series](https://edgetunnel-b2h.pages.dev/terraform/tutorial/). To add Zero Trust to your Terraform configuration: 1. [Sign up for Zero Trust](#sign-up-for-zero-trust) on the Cloudflare dashboard. 2. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Organizations, Identity Providers, and Groups Write` 3. Add the [cloudflare\_zero\_trust\_organization ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Forganization) resource: ```terraform resource "cloudflare_zero_trust_organization" "" { account_id = var.cloudflare_account_id name = "Acme Corporation" auth_domain = ".cloudflareaccess.com" } ``` Replace `` with the Zero Trust organization name selected during [onboarding](#sign-up-for-zero-trust). You can also view your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) under **Zero Trust** \> **Settings** \> **Team name and domain**. You can now update Zero Trust organization settings using Terraform. Tip If you plan to manage all Zero Trust settings in Terraform, set the dashboard to [API/Terraform read-only mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/api-terraform/#set-dashboard-to-read-only). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/create-zero-trust-org/#page","headline":"Create a Zero Trust organization · Cloudflare Learning Paths","description":"Set up a Zero Trust organization.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/create-zero-trust-org/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/initial-setup/","name":"Initial setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/initial-setup/create-zero-trust-org/","name":"Create a Zero Trust organization"}}]} ``` --- --- title: Migrate applications description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Migrate applications Publish internal applications that users currently access from a traditional corporate network. Note The remaining modules (Modules 6-9) discuss special considerations and setup options for enterprise environments. If you are only looking to configure a basic clientless access setup, feel free to skip them. ## Objectives By the end of this module, you will be able to: * Manage applications that are directly integrated with an identity provider. * Pass user information from Cloudflare Access to your application. * Review best practices for onboarding different types of internal applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/#page","headline":"Migrate applications · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/","name":"Migrate applications"}}]} ``` --- --- title: Best practices description: Follow recommended deployment best practices. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Best practices Most customers have a heterogeneous private application portfolio; some are home-built, some are internal managed services, some have SSO integrations available, and some rely on HTML or other forms of authentication. With that in mind, we recommend that you mix-and-match [onboarding solutions](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/#potential-solutions) to fit the needs of each individual application. As shown in the table below, you can bucket applications into a series of stack-ranked categories that prioritize ease of implementation and total organizational impact. | Application type | Recommendation | Outcome | | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Private web apps without integrated SSO | [Present applications exclusively on Cloudflare domains.](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/#recommended-solution) | Users access applications on new domains delegated to Cloudflare and instantly apply SSO through Cloudflare integration. | | Private web apps with integrated SSO | **If SSO configuration is possible:** [Present applications exclusively on Cloudflare domains.](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/#recommended-solution) **If SSO configuration is not possible:** Present applications on existing internal domains with identical external domains delegated to Cloudflare | Users access internal web services on the same or new domains from Cloudflare. If configured, the SSO provider transparently redirects users from internal domains to Cloudflare authoritative external domains. | | New critical internal applications being developed | [Present applications exclusively on Cloudflare domains.](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/#recommended-solution) | Developers can programmatically generate (or be given) new public hostnames on Cloudflare to represent the redirects for their application in SAML or OIDC integrations. | | New microservices being developed | [Present applications exclusively on Cloudflare domains.](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/#recommended-solution) Optionally, [consume the Access JWT](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/consume-jwt/#consume-the-cloudflare-jwt) as authentication in internal applications. | Developers can inject the JWT authorization mechanism directly into the codebase of their application and [use Terraform](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/terraform/) to automatically build Cloudflare hostnames and policies for their applications. | | Internal API endpoints (including internal applications with dependencies on external/internal APIs) | Present internal APIs on Cloudflare domains, and build Access policies that accept [service tokens](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/) alongside user-oriented policies. | Automated systems can authenticate via a [service token in the request header](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/#connect-your-service-to-access), while end users continue to login through their IdP. | ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/best-practices/#page","headline":"Best practices · Cloudflare Learning Paths","description":"Follow recommended deployment best practices.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/best-practices/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/","name":"Migrate applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/best-practices/","name":"Best practices"}}]} ``` --- --- title: Authenticate without integrated SSO description: Use Cloudflare JWT for application authentication. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Authenticate without integrated SSO A common goal for many security organizations is to implement continuous authentication and authorization. With Cloudflare Access JWT validation, you can achieve this goal without introducing significant user interruption or requiring behavioral changes for your end users. As discussed on the [previous page](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/), some of your applications may currently rely on a direct SSO integration to authenticate requests. However, if you were to put this type of application behind Cloudflare to enable remote access, your user would need to authenticate twice. First, they must authenticate to your identity provider via Cloudflare Access. Once they have authenticated to Access, your user will reach the front door of your internal application, where they must complete a second authentication event via the direct SSO integration. Instead of [managing a direct SSO integration](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/) in your application, we recommend using the JSON Web Token (JWT) issued by Cloudflare Access to authenticate requests. Cloudflare becomes the primary responsible party for validating the token returned from your SSO provider. By allowing your applications to consume the Cloudflare JWT, users will only have a single authentication event required to access the application, and you can better manage authorization to your internal services with lower overhead. ## Consume the Cloudflare JWT When Cloudflare sends a request to your application, the request will include a JWT signed with a key pair unique to your account. You can build a workflow in your application to [validate the Cloudflare Access JWT](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/). This will give you stronger-than-HTML security for users who have authenticated to Cloudflare and will make your user login experience seamless. The authorization flow is illustrated in the following diagram: ![ZTWA authorization flow with JWT validation](https://edgetunnel-b2h.pages.dev/_astro/access-jwt-flow.D4gusMDK_2dFSMh.webp) ## Send authorization headers with Workers When applications do not have integrated SSO, or any other method to deliver just-in-time (JIT) user provisioning or management, it is common to look for a way within Cloudflare to automatically pass user information into the private application. To best accomplish this, we recommend using Cloudflare Workers to send custom HTTP headers. As requests route through Cloudflare's network to your application, the Worker can insert headers into the request which contain the user's identity, device posture attributes, and other custom SAML/OIDC claims from the [Cloudflare Access JWT](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/). Refer to [this tutorial](https://edgetunnel-b2h.pages.dev/cloudflare-one/tutorials/access-workers/) for setup details. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/consume-jwt/#page","headline":"Authenticate without integrated SSO · Cloudflare Learning Paths","description":"Use Cloudflare JWT for application authentication.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/consume-jwt/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/","name":"Migrate applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/consume-jwt/","name":"Authenticate without integrated SSO"}}]} ``` --- --- title: Applications with integrated SSO description: Manage applications with existing SSO integrations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Applications with integrated SSO Many organizations in the past few years have recognized the importance of source-of-truth identity and have directly integrated their SSO provider with their internal applications. The SSO provider is only aware of the internal domain on which the application exists (via the configured ACS URL), which means the user must be connected to the local network in order to access the application. This security architecture makes sense for a traditional network perimeter, but it presents challenges for Zero Trust adoption. In the clientless access model, the user's device has no concept of an internal corporate network, only the specific, scoped applications to which they have access. The problem is summarized in the following diagram: flowchart LR accTitle: Authorization flow with integrated SSO A("User goes to app.public.com")-->B("Cloudflare Tunnel routes public hostname (app.public.com) to internal domain (app.internal.com)")-->C("app.internal.com redirects to integrated SSO")-->D("SSO ACS URL returns app.internal.com")-->E("404 error Device cannot resolve app.internal.com") ## Potential solutions If your applications use integrated SSO, there are a number of different paths you can take to onboard your applications to Cloudflare Access. | Solution | Steps required | Pros | Cons | | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | [Present applications exclusively on Cloudflare domains](#recommended-solution) | Change SSO ACS URL to the Cloudflare Tunnel public hostname | Increased security posture No changes to application code No changes to internal DNS design | Hard cutover event when ACS URL changes from internal to external domain | | Present applications on existing internal domains with identical external domains delegated to Cloudflare | Add domains to Cloudflare that match internal domains | No changes to SSO ACS URL No change for end users | Requires careful management of internal and external domains Requires changing internal DNS design | | [Consume the Cloudflare JWT in internal applications](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/consume-jwt/) | Remove integrated SSO Update application to accept the Cloudflare JWT for user authorization | Reduced authentication burden for end users No changes to internal DNS design Instantly secure applications without direct SSO integration | Requires changing application code Hard cutover event when application updates | | Use Cloudflare as the direct SSO integration, which then calls your IdP of choice (Okta, OneLogin, etc.) | Swap existing SSO provider for [Access for SaaS](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/saas-apps/) | Increased flexibility for changing IdPs Ability to use multiple IdPs simultaneously | Hard cutover event for IdP changes No SCIM provisioning for application | ## Recommended solution If you are able to configure your SSO provider, we recommend presenting all internal web services exclusively on Cloudflare domains. This is the model that Cloudflare takes for web application access internally and the most common method of resolution for customers in this scenario. With this approach, you do not need to make any changes to your existing DNS infrastructure. Cloudflare Tunnel in your network will manage the translation from external (Cloudflare public) DNS to internal DNS, which is how the system is designed to function. After you update the ACS URL in your SSO provider to the Cloudflare public hostname, the outcome will look like this: flowchart LR accTitle: Authorization flow with updated SSO ACS URL A("User goes to app.public.com")-->B("Cloudflare Tunnel routes public hostname (app.public.com) to internal domain (app.internal.com)")-->C("app.internal.com redirects to integrated SSO")-->D("SSO ACS URL returns app.public.com")-->E("Browser displays app.public.com") All users - whether in the office, remote, using or not using the VPN client - will always route through the Cloudflare Access authentication flow at `app.public.com` to access a private application. This provides a single control plane for policy application and security audits, and no additional user training is necessary. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/#page","headline":"Applications with integrated SSO · Cloudflare Learning Paths","description":"Manage applications with existing SSO integrations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/migrate-applications/integrated-sso/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"},"keywords":["SSO"]} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/","name":"Migrate applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/migrate-applications/integrated-sso/","name":"Applications with integrated SSO"}}]} ``` --- --- title: Terraform automation description: Secure browser-based access without device clients. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Terraform automation Integrate Cloudflare Access into your private application development pipeline. ## Objectives By the end of this module, you will be able to: * Publish internal applications to Cloudflare using Terraform. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/terraform/#page","headline":"Terraform automation · Cloudflare Learning Paths","description":"Secure browser-based access without device clients.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/terraform/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/terraform/","name":"Terraform automation"}}]} ``` --- --- title: Publish applications with Terraform description: Learn about publish applications with terraform in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Publish applications with Terraform This guide covers how to use the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) to quickly publish and secure a private application. In the following example, we will add a new published application to an existing Cloudflare Tunnel, configure how `cloudflared` proxies traffic to the application, and secure the application with Cloudflare Access. ## Prerequisites * [Add your domain to Cloudflare](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/add-site/) * [Configure an IdP integration](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/initial-setup/configure-idp/) * [Create a Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/connect-private-applications/create-tunnel/#create-a-tunnel) via the Zero Trust dashboard * Install the [Terraform client ↗](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) * [Create an API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) (refer to the [minimum required permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform/#3-create-a-cloudflare-api-token)) ## 1\. Create a Terraform configuration directory Terraform functions through a working directory that contains configuration files. You can store your configuration in multiple files or just one — Terraform will evaluate all of the configuration files in the directory as if they were in a single document. 1. Create a folder for your Terraform configuration: ```sh mkdir cloudflare-tf ``` 2. Change into the directory: ```sh cd cloudflare-tf ``` ## 2\. Declare providers and variables Create a `.tf` file and copy-paste the following example. Fill in your API token, account and zone information, and Tunnel ID. Find the Tunnel ID 1. In the Cloudflare dashboard, go to **Networking** \> **Tunnels**. [ Go to **Tunnels** ](https://dash.cloudflare.com/?to=/:account/tunnels) 2. Select the tunnel name. 3. Copy the **Tunnel ID**. ```txt terraform { required_providers { cloudflare = { source = "cloudflare/cloudflare" version = "~> 4.0" } } } provider "cloudflare" { api_token = "" } variable "account_id" { default = "" } variable "zone_id" { default = "" } variable "zone_name" { default = "mycompany.com" } variable "tunnel_id" { default = "" } ``` Warning To prevent accidentally exposing your Cloudflare credentials, do not save this file in your version control system. Learn more about [tracking a Terraform configuration](https://edgetunnel-b2h.pages.dev/terraform/tutorial/track-history/). ## 3\. Configure Cloudflare resources Add the following resources to your Terraform configuration. ### Add published application to Cloudflare Tunnel Using the [cloudflare\_tunnel\_config ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/tunnel%5Fconfig) resource, create an ingress rule that maps your application to a public DNS record. This example makes `localhost:8080` available on `app.mycompany.com`, sets the [Connect Timeout](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#connecttimeout), and enables [Access JWT validation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#access). ```txt resource "cloudflare_tunnel_config" "example_config" { account_id = var.cloudflare_account_id tunnel_id = var.tunnel_id config { ingress_rule { hostname = "app.${var.zone_name}" service = "http://localhost:8080" origin_request { connect_timeout = "2m0s" access { required = true team_name = "myteam" aud_tag = [cloudflare_access_application.example_app.aud] } } } ingress_rule { # Respond with a `404` status code when the request does not match any of the previous hostnames. service = "http_status:404" } } } ``` Note Published application configurations must include a catch-all ingress rule at the bottom of the file. ### Create an Access application Using the [cloudflare\_access\_application ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/access%5Fapplication) resource, add the application to Cloudflare Access. ```txt resource "cloudflare_access_application" "example_app" { zone_id = var.zone_id name = "Example application" domain = "app.${var.zone_name}" type = "self_hosted" session_duration = "24h" auto_redirect_to_identity = false } ``` ### Create an Access policy Using the [cloudflare\_access\_policy ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/access%5Fapplication) resource, create a policy to secure the application. The following policy will only allow access to users who authenticate through your identity provider. ```txt resource "cloudflare_access_policy" "example_policy" { application_id = cloudflare_access_application.example_app.id zone_id = var.zone_id name = "Example policy" precedence = "1" decision = "allow" include { login_method = [""] } } ``` ## 4\. Deploy Terraform To deploy the configuration files: 1. Initialize your configuration directory: ```sh terraform init ``` 2. Preview everything that will be created: ```sh terraform plan ``` 3. Apply the configuration: ```sh terraform apply ``` Users can now access the private application by going to the public URL and authenticating with Cloudflare Access. You can view your new tunnel in the Cloudflare dashboard under **Networking** \> **Tunnels**. [ Go to **Tunnels** ](https://dash.cloudflare.com/?to=/:account/tunnels) Your Access application and policy are under **Zero Trust** \> **Access controls** \> **[Applications ↗](https://dash.cloudflare.com/?to=/:account/one/access/apps)**. Note If you need to modify the Access application, Access policy or DNS record, you must make the changes via Terraform. Changes made via the dashboard will break Terraform's state. To prevent this from happening, [set the dashboard to read-only](https://edgetunnel-b2h.pages.dev/cloudflare-one/api-terraform/#set-dashboard-to-read-only). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/terraform/publish-apps-with-terraform/#page","headline":"Publish applications with Terraform · Cloudflare Learning Paths","description":"Learn about publish applications with terraform in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/terraform/publish-apps-with-terraform/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-06-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/clientless-access/terraform/","name":"Terraform automation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/clientless-access/terraform/publish-apps-with-terraform/","name":"Publish applications with Terraform"}}]} ``` --- --- title: Account Creation description: Set up DNS filtering and email security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Account Creation Get started by creating a Cloudflare account and initializing the Zero Trust and Area 1 dashboards. ## Objectives By the end of this module, you will have: * Created a Cloudflare account. * Initialized the Zero Trust dashboard. * Initialized the Area 1 dashboard. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/#page","headline":"Account Creation · Cloudflare Learning Paths","description":"Set up DNS filtering and email security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/account-creation/","name":"Account Creation"}}]} ``` --- --- title: Create a Cloudflare account description: Sign up for a Cloudflare account. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Cloudflare account To create a new Cloudflare account: 1. [Sign up ↗](https://dash.cloudflare.com/sign-up) on the Cloudflare dashboard. 2. To secure your account, enable [two-factor authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/). 3. After your account is accepted into the Cybersafe Schools program, you can to reach out to your Cloudflare contact and ask them to set up your account as a multi-user organization. This will allow you to define [role based access](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/) controls. For this project, account members will need: * [**Gateway** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit DNS policies. * [**PII** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/#cloudflare-zero-trust-pii) to view user information in DNS logs. * [**Configuration** permissions](https://edgetunnel-b2h.pages.dev/email-security/account-setup/permissions/) for Area 1 Email security. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-cloudflare-account/#page","headline":"Create a Cloudflare account · Cloudflare Learning Paths","description":"Sign up for a Cloudflare account.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-cloudflare-account/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/account-creation/","name":"Account Creation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/account-creation/create-cloudflare-account/","name":"Create a Cloudflare account"}}]} ``` --- --- title: Create an Email security account description: Set up a Cloudflare Email security account. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create an Email security account To create your Email security account, you will need the alphanumeric string on the URL when logged in to the Cloudflare dashboard. Once you have created your [Cloudflare account](https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-cloudflare-account/), your account team will create an Email security account for you. To establish your tenant, you will need the following information: * Average monthly inbound message volume * Number of active email users * At least one domain * Admin email address ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-email-security-account/#page","headline":"Create an Email security account · Cloudflare Learning Paths","description":"Set up a Cloudflare Email security account.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-email-security-account/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/account-creation/","name":"Account Creation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/account-creation/create-email-security-account/","name":"Create an Email security account"}}]} ``` --- --- title: Create a Zero Trust organization description: Set up a Zero Trust organization. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Zero Trust organization To set up a Zero Trust organization: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) by going to **Zero Trust** \> **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) at any time. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-zero-trust-org/#page","headline":"Create a Zero Trust organization · Cloudflare Learning Paths","description":"Set up a Zero Trust organization.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/account-creation/create-zero-trust-org/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/account-creation/","name":"Account Creation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/account-creation/create-zero-trust-org/","name":"Create a Zero Trust organization"}}]} ``` --- --- title: Concepts description: Set up DNS filtering and email security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Learn the technical concepts behind Project Cybersafe Schools. ## Objectives By the end of this module, you will be able to: * Understand the purpose of the Children’s Internet Protection Act (CIPA). * Describe the life of a DNS request. * Explain how DNS filtering works to control which websites users can access. * Understand the benefits of protecting your email inbox. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Set up DNS filtering and email security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/concepts/","name":"Concepts"}}]} ``` --- --- title: Project Cybersafe Schools and CIPA description: Learn about project cybersafe schools and cipa in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Project Cybersafe Schools and CIPA Project Cybersafe Schools (PCS) grants eligible schools free access to Cloudflare’s Email security and Gateway products. Like other under-resourced organizations, schools face cyber attacks from malicious actors that can impact schools’ ability to safely perform a basic function – teach children. Schools face email, phishing, and ransomware attacks that slow access and threaten leaks of confidential student data. PCS will help support small K-12 public school districts, for free, by providing cloud email security to protect against a broad spectrum of threats including malware-less business email compromise, multichannel phishing, credential harvesting, and other targeted attacks. PCS will also protect against Internet threats with DNS filtering by preventing users from reaching unwanted or harmful online content like ransomware or phishing sites and can be deployed to comply with the Children’s Internet Protection Act (CIPA). ## Project Cybersafe Schools Eligibility This program is only available to eligible school districts. To be eligible, Project Cybersafe School participants must be: * K-12 public school districts located in the United States. * Up to 2,500 students in the district. Apply to [Project Cybersafe Schools ↗](https://www.cloudflare.com/lp/cybersafe-schools/). ## Children’s Internet Protection Act (CIPA) The [Children's Internet Protection Act (CIPA) ↗](https://www.fcc.gov/sites/default/files/childrens%5Finternet%5Fprotection%5Fact%5Fcipa.pdf) is a federal law enacted by the United States Congress to address concerns about children's access to inappropriate or harmful content over the Internet. CIPA requires K-12 schools and libraries that receive certain federal funding to implement Internet safety measures to protect minors from harmful online content. The law aims to prevent students from accessing explicit, obscene, or otherwise harmful material. It also emphasizes the use of technology protection measures, including DNS filtering, to safeguard against Internet threats such as ransomware, phishing sites, and other potentially harmful content. ### Requirements CIPA mandates that K-12 schools and libraries adopt Internet safety policies that include measures to block or filter access to specific categories of content. These categories encompass a wide range of topics that could be harmful or inappropriate for minors. Compliance with these requirements helps ensure that students' online experiences are safer and more secure. ### Configuration To facilitate compliance with CIPA requirements, administrators can [enable a single filtering policy option](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/common-policies/#turn-on-cipa-filter). This includes applying the required filter categories to block access to unwanted or harmful online content. Note It is important to note that while our recommended CIPA compliance rule covers the essential filter categories, CIPA is designed to be flexible, allowing administrators to adjust filtering policies based on local standards and requirements. Administrators should carefully assess their specific location and userbase to determine if additional categories may need to be added or modified to ensure comprehensive protection. Cloudflare’s recommended CIPA rule blocks the following content subcategories: * Adult Themes * Alcohol * Anonymizer * Brand Embedding * Child Abuse * Command and Control & Botnet * Cryptomining * DGA Domains * DNS Tunneling * Drugs * Gambling * Hacking * Malware * Militancy, Hate & Extremism * Nudity * P2P * Phishing * Pornography * Private IP Address * Profanity * Questionable Activities * School Cheating * Spam * Spyware * Tobacco * Violence * Weapons Review the [domain categories](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/) for more information. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/cipa-overview/#page","headline":"Project Cybersafe Schools and CIPA · Cloudflare Learning Paths","description":"Learn about project cybersafe schools and cipa in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/cipa-overview/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/concepts/cipa-overview/","name":"Project Cybersafe Schools and CIPA"}}]} ``` --- --- title: What is DNS? description: Understand the Domain Name System fundamentals. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is DNS? The Domain Name System (DNS) is the phonebook of the Internet. DNS translates the domain name that you type in the browser (such as `www.example.com`) to a computer-friendly IP address (`93.184.216.34`), similar to how a phonebook translates a person's name to a phone number. The IP address identifies the server where the website data is stored, allowing the browser to contact the server and load the page. ## Life of a DNS query The process of translating a domain to an IP address is known as a DNS lookup. DNS lookups are performed by dedicated servers called DNS resolvers. Your Wi-Fi router is typically preconfigured to send DNS queries to the resolver owned by your ISP. However, you can choose to configure your router, operating system, or browser to use a different resolver. Some examples of free, public DNS resolvers include Cloudflare 1.1.1.1, Google 8.8.8.8, and OpenDNS. As shown in the diagram below, the DNS resolver contacts a series of nameservers (where DNS records are stored) to track down the requested IP address. The resolver analyzes the domain in reverse, starting from the top-level domain (`.com`) and ending with the subdomain (`www`). The final nameserver in the DNS lookup, called the authoritative nameserver, contains the desired IP address. The concept is similar to how the post office delivers a package — first routing it to the correct country, then to the correct state, city, street and so forth until it arrives at your home address. flowchart LR accTitle: DNS lookup process A[Browser] -- What is the IP address of www.example.com? --> B((DNS resolver)) -- Where is .com? --> C[("Root nameserver")] C --IP of .com nameserver--> B B -- Where is example.com?--> D[(.com nameserver)] D -- IP of example.com nameserver --> B B -- Where is www.example.com? --> E[(example.com nameserver)] E -- 93.184.216.34 --> B B -- 93.184.216.34 --> A ## Related resources For more background information on DNS, refer to our [Learning Center ↗](https://www.cloudflare.com/learning/dns/what-is-dns/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/what-is-dns/#page","headline":"What is DNS? · Cloudflare Learning Paths","description":"Understand the Domain Name System fundamentals.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/what-is-dns/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/concepts/what-is-dns/","name":"What is DNS?"}}]} ``` --- --- title: What is DNS filtering? description: Learn how DNS filtering blocks threats. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is DNS filtering? DNS filtering is a technique to block access to websites or online content. DNS filtering is implemented by specialized DNS resolvers (such as Cloudflare Gateway) that allow you to define a blocklist of domains or content categories. The DNS resolver acts as a filter by refusing to resolve queries for domains on the blocklist, thus preventing users from loading those websites. ## Purpose of DNS filtering DNS filtering is commonly used to: * Protect school data from phishing, ransomware, and malware. * Block websites that go against school acceptable use policy, such as adult content, gambling, and piracy. * Restrict access to websites that may impact student productivity, such as gaming, social media, and video streaming. ## How DNS filtering works DNS filtering involves configuring your browser, device, or router to send all DNS requests to a DNS filtering service. The DNS filtering service checks the domain or IP against your DNS policies. If the domain or IP matches a block policy, the DNS filtering service can redirect the request to an alternative IP address or block it altogether. The diagram below shows the logic for Cloudflare Gateway's DNS filtering service. flowchart LR accTitle: DNS filtering A[Browser] -- What is the IP address of www.example.com? --> B subgraph ide1 [Cloudflare Gateway] direction TB B(DNS policies)-.->C((DNS resolver)) end C --> D[(Nameservers)] flowchart TD accTitle: DNS filtering logic A[Blocked by DNS policy?] --Yes --> B[Block page is configured?] --Yes--> C[Return IP of block page] B--No-->E[Return 0.0.0.0] A --No --> D[Return IP of www.example.com] ## DNS filtering vs. Secure Web Gateway A URL assumes the form: `protocol://subdomain.domain.tld:port/path?query` DNS filtering only applies to the hostname — `subdomain.domain.tld`. You cannot block specific protocols, ports, paths, or query types. Additionally, users can bypass DNS policies if they already know the IP address of the website, or by connecting through a Virtual Private Network (VPN) or proxy server. Secure Web Gateways (SWGs) offer a greater set of capabilities, including: * [URL filtering ↗](https://www.cloudflare.com/learning/access-management/what-is-url-filtering/) to block specific paths and queries * L4 firewalls to block ports and protocols * Antivirus scanning * [Data loss prevention ↗](https://www.cloudflare.com/learning/access-management/what-is-dlp/) * [Browser isolation ↗](https://www.cloudflare.com/learning/access-management/what-is-browser-isolation/) However, this can make SWGs more complex to deploy. Therefore, many organizations will start with DNS filtering as an initial layer of defense against Internet threats. ## Related resources * For more background information on DNS filtering, refer to our [Learning Center ↗](https://www.cloudflare.com/learning/access-management/what-is-dns-filtering/). ## Next steps In the remaining modules, you will learn how to set up DNS filtering on your devices using Cloudflare Gateway. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/what-is-dns-filtering/#page","headline":"What is DNS filtering? · Cloudflare Learning Paths","description":"Learn how DNS filtering blocks threats.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/what-is-dns-filtering/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/concepts/what-is-dns-filtering/","name":"What is DNS filtering?"}}]} ``` --- --- title: What is Email security? description: Learn about email protocol security gaps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Email security? Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol ↗](https://www.cloudflare.com/learning/email-security/what-is-smtp/). As a result, email is a major attack vector. Email security is the process of preventing [email-based ↗](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing ↗](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks ↗](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware ↗](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery, and filtering [spam ↗](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/what-is-email-security/#page","headline":"What is Email security? · Cloudflare Learning Paths","description":"Learn about email protocol security gaps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/concepts/what-is-email-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/concepts/what-is-email-security/","name":"What is Email security?"}}]} ``` --- --- title: Onboarding Email security description: Set up DNS filtering and email security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Onboarding Email security Continue securing your environment by protecting against email phishing attacks. ## Objectives By the end of this module, you will be able to: * Identify the minimum CIPA filters to facilitate compliance. * Learn other ways to protect your network from unwanted traffic. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/email-security-onboarding/#page","headline":"Onboarding Email security · Cloudflare Learning Paths","description":"Set up DNS filtering and email security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/email-security-onboarding/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/email-security-onboarding/","name":"Onboarding Email security"}}]} ``` --- --- title: Deploy via Microsoft Graph API description: Learn about deploy via microsoft graph api in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Deploy via Microsoft Graph API An API deployment model with Email security has multiple benefits for Microsoft 365 Customers. The API deployment with Email security offers: * Easy protection for complex email architectures, without requiring any change to mail flow operations. * Agentless deployment for Microsoft 365. * Office 365 directory integration to retrieve user and group information and prevent user impersonation. ![Microsoft 365 API deployment diagram](https://edgetunnel-b2h.pages.dev/_astro/ms365-api-deployment.1XiiRyde_1XY0oD.webp) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/email-security-onboarding/api-deployment/#page","headline":"Deploy via Microsoft Graph API · Cloudflare Learning Paths","description":"Learn about deploy via microsoft graph api in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/email-security-onboarding/api-deployment/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/email-security-onboarding/","name":"Onboarding Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/email-security-onboarding/api-deployment/","name":"Deploy via Microsoft Graph API"}}]} ``` --- --- title: Next steps description: Explore advanced load balancing configurations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Next steps Now that you have learned how Email security can protect your inbox from phishing attacks, refer to the following resources to onboard and enhance your email security posture: | Resource | Description | | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Phish submissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/phish-submissions/) | As part of your continuous email security posture, administrators and security analysts need to submit missed phish samples so Cloudflare can process them and take necessary action. | | [API integration](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/setup/post-delivery-deployment/api/) | Onboard your domain via API deployment. | | [Impersonation registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/impersonation-registry/) | The impersonation registry contains combinations of emails of users who are likely to be impersonated. | | [Trusted domains](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/trusted-domains/) | Trusted domains allows you to identify domains that should be exempted from Email security detections. | | [Allow policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/allow-policies/) | Allow policies exempt messages that match certain patterns from normal detection scanning. | | [Blocked senders](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/blocked-senders/) | Blocked senders can mark all messages from specific senders with a MALICIOUS disposition. | | [PhishGuard](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/phishguard/) | PhishGuard is a managed email security service that provides resources for end-to-end phish and targeted attack management and response. | ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/email-security-onboarding/email-security-next-steps/#page","headline":"Next steps · Cloudflare Learning Paths","description":"Explore advanced load balancing configurations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/email-security-onboarding/email-security-next-steps/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/email-security-onboarding/","name":"Onboarding Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/email-security-onboarding/email-security-next-steps/","name":"Next steps"}}]} ``` --- --- title: Onboarding Cloudflare Gateway description: Set up DNS filtering and email security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Onboarding Cloudflare Gateway Now that your Cloudflare environment is ready and you have established a foundation of the technical concepts behind Project Cybersafe Schools, you are ready to test and onboard your DNS traffic. ## Objectives By the end of this module, you will be able to: * Explain the different methods to proxy your traffic to Gateway. * Create a Gateway location and understand its purpose. * Verify your Gateway environment by proxing local DNS traffic. * Create a test policy to validate functionality. * Deploy Cloudflare's recommended CIPA rule. * Customize the block page to ensure a seamless look and feel. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/#page","headline":"Onboarding Cloudflare Gateway · Cloudflare Learning Paths","description":"Set up DNS filtering and email security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}}]} ``` --- --- title: Block pages description: Learn about block pages in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Block pages ## Enable the block page for DNS policies For DNS policies, you will need to enable the block page on a per-policy basis. 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies** \> **DNS**. 2. Select **Add a policy** to create a new policy, or choose the policy you want to customize and select **Edit**. You can only edit the block page for policies with a Block action. 3. Under **Configure policy settings**, turn on **Modify Gateway block behavior**. 4. Choose your block behavior: * **Use account-level block setting**: Use the global block page setting configured in your account settings. The global setting can be the default Gateway block page, an [HTTP redirect](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page), or a [custom Gateway block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#customize-the-block-page). * **Override account setting with URL redirect**: Redirect users with a `307` HTTP redirect to a URL you specify on a policy level. 5. (Optional) If your account-level block page setting uses a custom Gateway block page, you can turn on **Add an additional message to your custom block page when traffic matches this policy** to add a custom message to your custom block page when traffic is blocked by this policy. This option will replace the **Message** field. 6. Select **Save policy**. Depending on your settings, Gateway will display a block page in your users' browsers or redirect them to a specified URL when they are blocked by this policy. ## Customize the block page You can customize the Cloudflare-hosted block page by making global changes that Gateway will display every time a user reaches your block page. Customizations will apply regardless of the type of policy (DNS or HTTP) that blocks the traffic. To customize your block page: * [ Dashboard ](#tab-panel-9899) * [ Terraform (v5) ](#tab-panel-9900) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Custom pages**. 2. Under **Account Gateway block page**, select **Customize**. 3. Choose **Custom Gateway block page**. Gateway will display a preview of your custom block page. Available customizations include: * Your organization's name * [Logo](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#add-a-logo-image) * Header text * Global block message, which will be displayed above the policy-specific block message * [Mailto link](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#allow-users-to-email-an-administrator) * Background color 4. Select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. In [cloudflare\_zero\_trust\_gateway\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fsettings), configure the `block_page` argument with your customizations: ```tf resource "cloudflare_zero_trust_gateway_settings" "team_name" { account_id = var.cloudflare_account_id settings = { block_page = { enabled = true //do not use the default Gateway block page mode = "customized_block_page" //use a custom block page name = "Cloudflare" logo_path = "https://logos.com/a.png" header_text = "--header--" footer_text = "--footer--" mailto_address = "admin@example.com" mailto_subject = "Blocked Request" background_color = "#ffffff" suppress_footer = false } } } ``` Gateway will now display a custom Gateway block page when your users visit a blocked website. ### Add a logo image You can include an external logo image to display on your custom block page. The block page resizes all images to 146x146 pixels. The URL must be valid and no longer than 2048 characters. Accepted file types include SVG, PNG, JPEG, and GIF. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-block-pages/#page","headline":"Block pages · Cloudflare Learning Paths","description":"Learn about block pages in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-block-pages/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-block-pages/","name":"Block pages"}}]} ``` --- --- title: Gateway connection methods description: Choose a Gateway DNS connection method. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Gateway connection methods There are various methods to onboard your traffic and your method will be determined based on your individual or organizational requirements. In this learning path, we will focus on an [**Agentless (DNS only) deployment method**](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/dns/). Protecting more than DNS, such as network packets, HTTP requests, or egress traffic is possible, but requires a more advanced deployment method such as [WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) or [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/zero-trust/cloudflare-gateway/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-connection-methods/#page","headline":"Gateway connection methods · Cloudflare Learning Paths","description":"Choose a Gateway DNS connection method.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-connection-methods/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-connection-methods/","name":"Gateway connection methods"}}]} ``` --- --- title: Create CIPA policy description: Learn about create cipa policy in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create CIPA policy ## Create CIPA policy 1. Go to **Traffic policies** \> **Firewall policies**. 2. Create a policy to block using the CIPA filter: | Selector | Operator | Value | Action | | ------------------ | -------- | ------------- | ------ | | Content Categories | in | _CIPA Filter_ | Block | 3. In **Logs** \> **Gateway** \> **DNS**, verify that you see the blocked domain. Your environment is now protected against all of the subcategories listed in [Configuration](https://edgetunnel-b2h.pages.dev/fundamentals/reference/policies-compliances/cybersafe/#configuration). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-create-cipa-policy/#page","headline":"Create CIPA policy · Cloudflare Learning Paths","description":"Learn about create cipa policy in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-create-cipa-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-create-cipa-policy/","name":"Create CIPA policy"}}]} ``` --- --- title: Create a test policy description: Learn about create a test policy in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a test policy To ensure a smooth deployment, we recommend testing a simple policy before deploying DNS filtering to your organization. ## Test a policy in the browser 1. Go to **Traffic policies** \> **Firewall policies**. 2. Create a policy to block all security categories: | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All security risks_ | Block | 3. In the browser, go to `malware.testcategory.com`. You should see a generic Gateway block page. 4. In **Logs** \> **Gateway** \> **DNS**, verify that you see the blocked domain. Note When testing against frequently-visited sites, you may need to [clear the DNS cache](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/test-dns-filtering/#clear-dns-cache) in your browser or OS. Otherwise, the DNS lookup will return the locally-cached IP address and bypass your DNS policies. You have now validated DNS filtering! ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-create-test-policy/#page","headline":"Create a test policy · Cloudflare Learning Paths","description":"Learn about create a test policy in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-create-test-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-create-test-policy/","name":"Create a test policy"}}]} ``` --- --- title: Gateway locations description: Set up Gateway DNS locations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Gateway locations DNS locations are a collection of DNS endpoints which can be mapped to physical entities such as offices, homes, or data centers. The fastest way to start filtering DNS queries from a location is by changing the DNS resolvers at the router. ## Add a DNS location To add a DNS location to Gateway: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Networks** \> **Resolvers & Proxies** \> **DNS locations**. 2. Select **Add a location**. 3. Choose a name for your DNS location. 4. Choose at least one [DNS endpoint](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/dns/locations/#dns-endpoints) to resolve your organization's DNS queries. 5. (Optional) Toggle the following settings: * **Enable EDNS client subnet** sends a user's IP geolocation to authoritative DNS nameservers. [EDNS Client Subnet (ECS)](https://edgetunnel-b2h.pages.dev/cloudflare-one/glossary/?term=ecs) helps reduce latency by routing the user to the closest origin server. Cloudflare enables EDNS in a privacy preserving way by not sending the user's exact IP address but rather the first `/24` range of the larger range that contains their IP address. This `/24` range will share the same geographic location as the user's exact IP address. * **Set as Default DNS Location** sets this location as the default DoH endpoint for DNS queries. 6. Select **Continue**. 7. (Optional) Turn on source IP filtering for your configured endpoints, then add any source IPv4/IPv6 addresses to validate. * Endpoint authentication is required for standard IPv4 addresses and optional for dedicated IPv4 addresses. * **DoH endpoint filtering & authentication** lets you restrict DNS resolution to only valid identities or user tokens in addition to IPv4/IPv6 addresses. 8. Select **Continue**. 9. Review the settings for your DNS location, then choose **Done**. Captive portal limitation Deploying Gateway DNS filtering using static IP addresses may prevent users from connecting to public Wi-Fi networks through captive portals. If users are experiencing connectivity issues related to captive portals, they should: 1. Remove the static IP addresses from the device. 2. Connect to the Wi-Fi network. 3. Once the connection has been established, add the static IP addresses back. To avoid this issue, use the [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) to connect your devices to Cloudflare One. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-locations/#page","headline":"Gateway locations · Cloudflare Learning Paths","description":"Set up Gateway DNS locations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-locations/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-locations/","name":"Gateway locations"}}]} ``` --- --- title: Update local DNS resolver description: Learn about update local dns resolver in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Update local DNS resolver With a Gateway location created, you have the ability to send traffic to your environment. You can test without risk by changing your DNS resolvers in your browser or network settings. ## Change DNS resolver at the network level To configure your device to send traffic to Gateway: macOS ![macOS DNS Resolver Options](https://edgetunnel-b2h.pages.dev/_astro/dns-resolvers-macosx.B1GnFXfW_Z1NldnS.webp) Windows ![Windows DNS Resolver Options](https://edgetunnel-b2h.pages.dev/_astro/dns-resolvers-windows.3Ns9LR4f_Z1qBa8z.webp) Linux ```sh cat /etc/resolv.conf ``` ```sh nameserver 172.64.X.X nameserver 172.64.X.X ``` iPhone ![iPhone DNS Resolver Options](https://edgetunnel-b2h.pages.dev/_astro/dns-resolvers-iphone.BNl5oq1v_Z18cmq9.webp) Android ![Android DNS Resolver Options](https://edgetunnel-b2h.pages.dev/_astro/dns-resolvers-android.JkoCH2BP_Z1c3rDf.webp) ## Change DNS resolver in the browser To configure your browser to send traffic to Gateway: 1. Obtain your DNS over HTTPS (DoH) address: 1. Go to **Traffic policies** \> **DNS locations**. 2. Select the default location. 3. Copy your **DNS over HTTPS** hostname: `https://.cloudflare-gateway.com/dns-query` 2. Follow the configuration instructions for your browser: Mozilla Firefox 1. In Firefox, go to **Settings**. 2. In **Privacy & Security**, go to **DNS over HTTPS**. 3. Under **Enable secure DNS using**, select _Max Protection_. 4. In **Choose provider**, choose _Custom_. 5. In the field, enter `https://.cloudflare-gateway.com/dns-query`. Firefox is now configured to use your DoH endpoint. For more information on configuring DoH settings in Firefox, refer to [Mozilla's documentation ↗](https://support.mozilla.org/kb/dns-over-https). Note If you want to enforce DNS policies through the Cloudflare One Client instead of over DoH, you can disable DoH for your organization by blocking the [Firefox DoH canary domain ↗](https://support.mozilla.org/kb/canary-domain-use-application-dnsnet). Google Chrome 1. In Chrome, go to **Settings** \> **Privacy and security** \> **Security**. 2. Scroll down and turn on **Use secure DNS**. 3. Select **With Custom**. 4. In the **Enter custom provider** field, enter `https://.cloudflare-gateway.com/dns-query`. Read more about [enabling DNS over HTTPS ↗](https://www.chromium.org/developers/dns-over-https) on Chrome. Microsoft Edge 1. In Microsoft Edge, go to **Settings**. 2. Select **Privacy, Search, and Services**, and scroll down to **Security**. 3. Turn on **Use secure DNS**. 4. Select **Choose a service provider**. 5. In the **Enter custom provider** field, enter `https://.cloudflare-gateway.com/dns-query`. Brave 1. In Brave, go to **Settings** \> **Security and Privacy** \> **Security**. 2. Turn on **Use secure DNS**. 3. Select **With Custom**. 4. In the **Enter custom provider** field, enter `https://.cloudflare-gateway.com/dns-query`. Safari Currently, Safari does not support DNS over HTTPS. 3. Verify that third-party firewall or TLS decryption software does not inspect or block traffic to the DoH endpoint: `https://.cloudflare-gateway.com/dns-query`. ## More locations To configure your router or OS, or to add additional DNS endpoints, refer to [DNS locations](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/dns/locations/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-update-local-resolver/#page","headline":"Update local DNS resolver · Cloudflare Learning Paths","description":"Learn about update local dns resolver in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-update-local-resolver/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-update-local-resolver/","name":"Update local DNS resolver"}}]} ``` --- --- title: Verify local connectivity description: Learn about verify local connectivity in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Verify local connectivity To verify that your DNS traffic is sent to Gateway: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Traffic settings**. 2. Under **Log traffic activity**, enable activity logging for all DNS logs. 3. On your device, open a browser and go to any website. 4. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Logs** \> **DNS**. 5. Make sure DNS queries from your device appear. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-verify-local-connectivity/#page","headline":"Verify local connectivity · Cloudflare Learning Paths","description":"Learn about verify local connectivity in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/cybersafe/gateway-onboarding/gateway-verify-local-connectivity/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/","name":"Onboarding Cloudflare Gateway"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/cybersafe/gateway-onboarding/gateway-verify-local-connectivity/","name":"Verify local connectivity"}}]} ``` --- --- title: Advertise prefixes description: Advertise IP prefixes via Magic Transit. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Advertise prefixes Once pre-flight checks are completed, Cloudflare unlocks your prefixes for you to [advertise via the dashboard, API or BGP](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/advertise-prefixes/) at a time of your choosing. Refer to [Dynamic advertisement best practices](https://edgetunnel-b2h.pages.dev/byoip/concepts/dynamic-advertisement/best-practices/) to learn more about advertising prefixes. If you are using a Cloudflare IP, you do not need to advertise your prefixes. Warning You must [put the appropriate MSS clamps](#set-maximum-segment-size) in place before [routing ↗](https://www.cloudflare.com/learning/network-layer/what-is-routing/) changes are made. Failure to apply an MSS clamp can result in dropped packets and hard-to-debug connectivity issues. Also, when using [Cloudflare Network Interconnect](https://edgetunnel-b2h.pages.dev/magic-transit/network-interconnect/) with Magic Transit you must set the following MSS clamp sizes to accommodate additional overhead: * GRE tunnels over CNI with Dataplane v1: 1476 bytes * CNI with Dataplane v2 / CNI with Dataplane v1 with a maximum transmission unit (MTU) size of 1500 bytes handoff does not require an MSS clamp. MSS clamps are used to backhaul data from the data center where traffic is ingested (close to the end user) to the facility with the CNI link. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/advertise-prefixes/#page","headline":"Advertise prefixes · Cloudflare Learning Paths","description":"Advertise IP prefixes via Magic Transit.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/advertise-prefixes/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/advertise-prefixes/","name":"Advertise prefixes"}}]} ``` --- --- title: Concepts description: Learn how you can protect your data center from distributed denial-of-service (DDoS) attacks with Magic Transit. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Learn core concepts about Magic Transit and its functionality, in order to protect your data centers from distributed denial-of-service (DDoS) attacks. ## Objectives By the end of this module you will be able to: * Understand what Magic Transit is * Why you should use it to protect your IP network ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Learn how you can protect your data center from distributed denial-of-service (DDoS) attacks with Magic Transit.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/concepts/","name":"Concepts"}}]} ``` --- --- title: Benefits of using Magic Transit description: Learn about benefits of using magic transit in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Benefits of using Magic Transit Magic Transit leverages Cloudflare's global anycast network. As of writing this guide, Cloudflare's global network spans over 330 cities, and has over 405 Tbps network capacity. This bandwidth allows it to absorb all manners of attack that otherwise would overwhelm a typical data center or on-premise hardware Distributed Denial-of-Service (DDoS) appliances. The number of DDoS attacks has been steadily increasing in recent years. In the first quarter of 2025, Cloudflare [mitigated 16.8 million network-layer DDoS attacks ↗](https://blog.cloudflare.com/ddos-threat-report-for-2025-q1/#ddos-attacks-in-numbers). This represents a 397% increase quarter over quarter and a 509% increase year over year. Other advantages of choosing Magic Transit: * **Scalability**: As Cloudflare's global network expands, so does Magic Transit ability to absorb ever bigger DDoS attacks. * **Ease of management**: Magic Transit offers centralized, cloud-based management tools that simplify configuration and monitoring of your network security. * **Improvement of network performance**: Magic Transit steers traffic along tunnel routes based on priorities you define and uses equal-cost multi-path routing to provide load-balancing across tunnels with the same prefix and priority. * **Integration with zero-trust services**: Magic Transit integrates with other Cloudflare products, including Cloudflare One's SASE offerings, Cloudflare Network Firewall, and more. * **Integration with CNI**: Directly connect your infrastructure to Cloudflare with CNI and bypass the Internet. Beyond a more reliable and secure experience, using CNI is an alternative to anycast GRE tunnels for getting traffic delivered to your infrastructure with a 1500-byte maximum transmission unit (MTU) handoff. * **Real-time traffic visibility and alerting**: Monitor and analyze traffic patterns, threat activity, and mitigation actions in real time through Cloudflare's analytics and logging tools. Set up customized alerts to notify you of potential threats, enabling faster incident response and better-informed network decisions. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/concepts/benefits-magic-transit/#page","headline":"Benefits of using Magic Transit · Cloudflare Learning Paths","description":"Learn about benefits of using magic transit in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/concepts/benefits-magic-transit/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/data-center-protection/concepts/benefits-magic-transit/","name":"Benefits of using Magic Transit"}}]} ``` --- --- title: What is Magic Transit? description: Understand Magic Transit DDoS protection for networks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Magic Transit? Magic Transit is a network security and performance solution that offers Distributed Denial-of-Service (DDoS) protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Magic Transit works at Layer 3 of the [OSI model ↗](https://www.cloudflare.com/en-gb/learning/ddos/glossary/open-systems-interconnection-model-osi/), protecting entire IP networks from DDoS attacks. Instead of relying on local infrastructure that can be overwhelmed by large DDoS attacks, Magic Transit uses the [global Cloudflare Network ↗](https://www.cloudflare.com/network/) to ingest and mitigate attacks close to their source. Magic Transit delivers its connectivity, security, and performance benefits by serving as the front door to your IP network. This means it accepts IP packets destined for your network, processes them, and then forwards them to your origin infrastructure. The Cloudflare network uses Border Gateway Protocol (BGP) to announce your company's IP address space, extending your network presence globally, and [anycast](https://edgetunnel-b2h.pages.dev/magic-transit/reference/gre-ipsec-tunnels/#anycast) to absorb and distribute attack traffic. Once packets hit Cloudflare's network, traffic is inspected for attacks, filtered, steered, accelerated, and sent onward to your origin. Magic Transit users have two options for their implementation: ingress traffic or ingress and egress traffic. Users with an egress implementation will need to set up policy-based routing (PBR) or ensure default routing on their end forwards traffic to Cloudflare via tunnels. For an in-depth explanation of Magic Transit, refer to [Magic Transit Reference Architecture](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/magic-transit/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/concepts/what-is-magic-transit/#page","headline":"What is Magic Transit? · Cloudflare Learning Paths","description":"Understand Magic Transit DDoS protection for networks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/concepts/what-is-magic-transit/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/data-center-protection/concepts/what-is-magic-transit/","name":"What is Magic Transit?"}}]} ``` --- --- title: Configure DDoS protection description: Learn about configure ddos protection in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure DDoS protection Cloudflare DDoS protection automatically detects and mitigates Distributed Denial of Service (DDoS) attacks using its Autonomous Edge. Magic Transit customers have access to additional features, such as: * [Advanced TCP protection](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) (disabled by default) * [Advanced DNS protection (beta)](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) ## Create a DDoS override 1. In the Cloudflare dashboard, go to the **L3/4 DDoS protection** page. [ Go to **DDoS Managed Rules** ](https://dash.cloudflare.com/?to=/:account/network-security/ddos) 2. Go to **Network-layer DDoS Protection**. 3. Select **Deploy a DDoS override**. 4. In **Set scope**, specify if you wish to apply the override to all incoming packets or to a subset of the packets. 5. If you are creating an override for a subset of the incoming packets, define the [custom expression](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/network/network-overrides/override-expressions/) that matches the incoming packets you wish to target in the override, using either the Rule Builder or the Expression Editor. 6. Select **Next**. 7. Depending on what you wish to override, refer to the following sections (you can perform both configurations on the same override): Configure all the rules in the ruleset (ruleset override) 1. Select **Next**. 2. Enter a name for your override in **Execution name**. 3. To always apply a given action for all the rules in the ruleset, select an action in **Ruleset action**. 4. To set the sensitivity level for all the rules in the ruleset, select a value in **Ruleset sensitivity**. Configure one or more rules 1. Search for the rules you wish to override using the available filters. You can search for tags. 2. To override a single rule, select the desired value for a field in the displayed dropdowns next to the rule. To configure more than one rule, select the rules using the row checkboxes and update the fields for the selected rules using the dropdowns displayed before the table. You can also configure all the rules with a given tag. For more information, refer to [Configure a managed ruleset](https://edgetunnel-b2h.pages.dev/waf/managed-rules/deploy-zone-dashboard/#configure-a-managed-ruleset). 14\. Select **Next**. 15\. Enter a name for your override in **Execution name**. Notes * Tag and rule overrides have priority over ruleset overrides. * The managed ruleset includes some read-only rules that you cannot override. 8. To save and deploy the override, select **Deploy**. If you are not ready to deploy your override, select **Save as Draft**. ## DDoS advanced protection ### Advanced TCP Protection Cloudflare's Advanced TCP Protection, powered by [flowtrackd ↗](https://blog.cloudflare.com/announcing-flowtrackd/), is a stateful TCP inspection engine used to detect and mitigate sophisticated out-of-state TCP attacks such as randomized and spoofed ACK floods or SYN and SYN-ACK floods. Note Advanced TCP and DNS Protection systems are automatically enabled in `Monitor` mode with the default thresholds for new Magic Transit customers and their [authorized prefixes](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/advertise-prefixes/). Magic Transit customers can also enable the Advanced DDoS systems when the prefixes are ready, change the sensitivity level, or adjust the thresholds by contacting their account team. #### Setup [Create a global configuration](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/#rules) to set up SYN Flood and Out-of-state TCP rules and filters for Advanced TCP Protection. ### Advanced DNS Protection Cloudflare's Advanced DNS Protection, powered by [flowtrackd ↗](https://blog.cloudflare.com/announcing-flowtrackd/), provides stateful protection against DNS-based DDoS attacks, specifically sophisticated and fully randomized DNS attacks such as [random prefix attacks](https://edgetunnel-b2h.pages.dev/dns/dns-firewall/random-prefix-attacks/about/). Note Advanced TCP and DNS Protection systems are automatically enabled in `Monitor` mode with the default thresholds for new Magic Transit customers and their [authorized prefixes](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/advertise-prefixes/). Magic Transit customers can also enable the Advanced DDoS systems when the prefixes are ready, change the sensitivity level, or adjust the thresholds by contacting their account team. #### Setup [Create a rule](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/how-to/create-rule/#create-an-advanced-dns-protection-rule) to enable Advanced DNS Protection. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-ddos/#page","headline":"Configure DDoS protection · Cloudflare Learning Paths","description":"Learn about configure ddos protection in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-ddos/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/configure-ddos/","name":"Configure DDoS protection"}}]} ``` --- --- title: Configure tunnels and routes description: Protect data centers with Magic Transit DDoS mitigation. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure tunnels and routes In this unit you will learn how to set up tunnels and routes to steer traffic. ## Objectives By the end of this module you will be able to: * Create tunnels on both the Cloudflare side and your router side to connect to your infrastructure. * Configure static routes or dynamic routes with BGP peering to steer your traffic via next-hop from Cloudflare's global network to your connected networks. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/#page","headline":"Configure tunnels and routes · Cloudflare Learning Paths","description":"Protect data centers with Magic Transit DDoS mitigation.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/configure-tunnels-routes/","name":"Configure tunnels and routes"}}]} ``` --- --- title: Configure routes description: Set up Magic Transit static routes. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure routes Magic Transit Virtual Network uses a routing table to steer your traffic from Cloudflare's global network to your connected networks via next-hop. You can add entries to the Magic Transit Virtual Network routing table through static route configuration or routes learned from BGP peering (beta) (available over CNI with Dataplane v2, as well as IPsec and GRE tunnels). Refer to [Traffic Steering](https://edgetunnel-b2h.pages.dev/magic-transit/reference/traffic-steering/) for more information about all the technical aspects related to: * Routes' priorities and weights * Regional scoping of traffic to reduce latency * BGP peering (beta) Anycast routing Cloudflare uses anycast to route traffic. Anycast is a network addressing and routing method that routes incoming requests to different locations. Traffic can arrive at a different geographic location than expected. Not all requests go to the closest data center because Internet routing and peering relationships are complex, and Cloudflare optimizes for performance and reliability. One page for all your routes The dashboard **Routes** page shows the routes for all of your connectors — including Cloudflare Tunnel and Cloudflare Mesh — in a single table, not just Magic Transit static routes. The following steps cover Magic Transit static routes. Routes for other connector types appear in the same table and can be filtered by type. ## Configure static routes ### Create a static route * [ Dashboard ](#tab-panel-9903) * [ API ](#tab-panel-9904) 1. Go to **Routes** page. [ Go to **Routes** ](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 1. From the **Routes** tab, select **Create route**, then choose **WAN** as the route type. 1. Enter a descriptive name for your route in **Description**. 2. In **Prefix**, enter your range of IP addresses. For example, `10.10.10.100/24`. 3. In **Tunnel/Next hop**, select a tunnel for your route from the tunnels you created in [Configure tunnel endpoints](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-tunnel-endpoints/). 4. Choose the **Priority** for your route. Lower numbers have higher priorities. Note Cloudflare routing applies longest-prefix match. A more specific static route (like `/30`) always takes precedence over a less specific one (like `/29`), regardless of tunnel priority — unless you remove the more specific route. Keep this in mind when configuring priorities for your routes. Refer to [Route prioritization](https://edgetunnel-b2h.pages.dev/magic-transit/reference/traffic-steering/#route-prioritization) for more information. 5. (Optional) Choose a **Weight** for your route. Refer to [Set priority and weights for static routes](https://edgetunnel-b2h.pages.dev/magic-transit/reference/traffic-steering/#set-priority-and-weights-for-static-routes) for examples. 6. (Optional) If you need to scope your route to a specific region, you can do it in **Region code**. 7. (Optional) We highly recommend testing your route before adding it by selecting **Test routes**. 8. Select **Add routes**. Note You will need your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and [API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) to use the API. Create a `POST` request [using the API](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/routes/methods/create/) to create one or more static routes. Example: Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Magic WAN Write` * `Magic Transit Write` **Create a Route** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/routes" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "nexthop": "", "prefix": "", "priority": 0, "id": "023e105f4ecef8ad9ca31a8372d0c353", "description": "", "scope": { "colo_names": [ "den01" ], "colo_regions": [ "APAC" ] }, "weight": 0 }' ``` ```json { "errors": [ { "code": 1000, "message": "message" } ], "messages": [ { "code": 1000, "message": "message" } ], "result": { "routes": [ { "nexthop": "203.0.113.1", "prefix": "192.0.2.0/24", "priority": 0, "id": "023e105f4ecef8ad9ca31a8372d0c353", "description": "New route for new prefix 203.0.113.1", "scope": { "colo_names": [ "den01" ], "colo_regions": [ "APAC" ] }, "weight": 0 } ] }, "success": true } ``` ### Edit a static route * [ Dashboard ](#tab-panel-9905) * [ API ](#tab-panel-9906) 1. From the **Routes** tab, locate the route to modify. 2. Select the three dots next to it > **Edit**. 1. Enter the updated route information. 2. (Optional) We highly recommend testing your route before adding it by selecting **Test routes**. 3. Select **Edit routes**. Note You will need your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and [API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) to use the API. Create a `PUT` request [using the API](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/routes/methods/update/) to update one or more static routes. Example: Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Magic WAN Write` * `Magic Transit Write` **Update Route** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/routes/$ROUTE_ID" \ --request PUT \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "nexthop": "", "prefix": "", "priority": 0, "id": "023e105f4ecef8ad9ca31a8372d0c353", "description": "", "scope": { "colo_names": [ "den01" ], "colo_regions": [ "APAC" ] }, "weight": 0 }' ``` ```json { "errors": [ { "code": 1000, "message": "message" } ], "messages": [ { "code": 1000, "message": "message" } ], "result": { "modified": true, "modified_route": { "nexthop": "203.0.113.1", "prefix": "192.0.2.0/24", "priority": 0, "id": "023e105f4ecef8ad9ca31a8372d0c353", "description": "New route for new prefix 203.0.113.1", "scope": { "colo_names": [ "den01" ], "colo_regions": [ "APAC" ] }, "weight": 0 } }, "success": true } ``` ### Delete static route * [ Dashboard ](#tab-panel-9901) * [ API ](#tab-panel-9902) 1. From the **Routes** tab, locate the static route to delete. 2. Select the three dots next to it > **Delete**. 1. Confirm the action by selecting the checkbox and select **Delete**. Note You will need your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and [API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) to use the API. Create a `DELETE` request [using the API](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/routes/methods/delete/) to delete a static route. Example: Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Magic WAN Write` * `Magic Transit Write` **Delete Route** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/routes/$ROUTE_ID" \ --request DELETE \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` ```json { "errors": [ { "code": 1000, "message": "message" } ], "messages": [ { "code": 1000, "message": "message" } ], "result": { "deleted": true, "deleted_route": { "nexthop": "203.0.113.1", "prefix": "192.0.2.0/24", "priority": 0, "id": "023e105f4ecef8ad9ca31a8372d0c353", "description": "New route for new prefix 203.0.113.1", "scope": { "colo_names": [ "den01" ], "colo_regions": [ "APAC" ] }, "weight": 0 } }, "success": true } ``` ## Configure BGP routes BGP peering is available when using the following on-ramps: * [CNI with Dataplane v2](https://edgetunnel-b2h.pages.dev/network-interconnect/). * [IPsec and GRE tunnels (beta)](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-tunnel-endpoints/). Requires [Unified Routing (beta)](https://edgetunnel-b2h.pages.dev/magic-transit/reference/traffic-steering/#unified-routing-mode-beta). ### Choose an ASN for BGP peering The Magic Transit Virtual Network routing table is managed by the customer. You can select both the Cloudflare-side ASN (Autonomous System Number) and the ASN for your customer device. The customer device ASN can be 2-byte or 4-byte. [Public ASNs used for Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/advertise-prefixes/#cloudflare-asn-vs-your-own-asn) are verified during the onboarding process. By default, each BGP peering session uses the same Cloudflare-side ASN to represent peering with the Magic Transit Virtual Network routing table. This ASN is called the **CF Account ASN** and is set to `13335`. You can configure this to a private 2-byte ASN (any value between `64512` and `65534`, such as `65000`). Note If you are setting up BGP over IPsec or GRE tunnels you cannot change this value. To set this ASN: 1. Go to the Routes page. [ Go to **Routes** ](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 1. Select **WAN configuration**. 2. In **CF Account ASN**, enter Cloudflare's ASN. 3. Select **Update**. Magic Transit customers should also be aware of the following: * The Cloudflare side ASN will never be exposed in `AS_PATH` of anycast announcements from the Cloudflare edge. In those announcements, Cloudflare will always use the Cloudflare ASN of `13335` optionally prepended with a bring-your-own ASN as described in [Cloudflare ASN vs. your own ASN](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/advertise-prefixes/#cloudflare-asn-vs-your-own-asn). * The customer device ASN can be a private ASN or the ASN they are using for Magic Transit anycast announcements at the edge: this has no impact on the ASN for the anycast announced prefix at the edge of the Cloudflare global network. ### Set up BGP peering You need to configure two ASNs: * The Cloudflare [account-scoped ASN](#choose-an-asn-for-bgp-peering) named **CF Account ASN**. * One ASN for each on-ramp you want to configure with BGP. If you have already set up your Cloudflare account ASN, skip steps two and three below. #### Set up BGP for an interconnect Note BGP over CNI is in closed beta and is not currently available to new customers. If you are interested in BGP peering over CNI, contact your account team. 1. Go to the Routes page. [ Go to **Routes** ](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 1. Select **WAN configuration**. 2. In **CF Account ASN**, enter Cloudflare's ASN, and select **Update**. 3. Go to **Interconnects**. [ Go to **Interconnects** ](https://dash.cloudflare.com/?to=/:account/magic-networks/connections/cni-tunnels) 1. Locate the CNI interconnect with Dataplane v2 to configure with BGP > select the **three dots** next to it > **Configure BGP**. 2. In **Customer device ASN**, enter the ASN for your network. 3. In **MD5 key**, you can optionally enter the key for your network. Note that this is meant to prevent accidental misconfigurations and is not a security mechanism. 4. (Optional) In **Additional Advertised prefix list**, input any additional prefixes you want to advertise alongside your existing routes. Leave this blank if you do not want to advertise extra routes. Typical prefixes to configure here include: * A route to `0.0.0.0/0`, the default route — to attract all Internet-bound traffic if using Magic Transit with Egress. * A route to `100.96.0.0/12`, the portion of CGNAT space [used by default with Cloudflare One Clients](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#return-traffic-routing). 5. Select **Save**. #### Set up BGP for IPsec/GRE tunnels 1. Go to the Routes page. [ Go to **Routes** ](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 1. Select **WAN configuration**. 2. In **CF Account ASN**, enter Cloudflare's ASN, and select **Update**. 3. Go to **Connectors**. [ Go to **Connectors** ](https://dash.cloudflare.com/?to=/:account/magic-networks/connections) 1. In **IPsec/GRE tunnels**, locate the tunnel you want to configure with BGP > select the **three dots** next to it > **Configure BGP**. 2. In **Customer device ASN**, enter the ASN for your network. 3. In **MD5 key**, you can optionally enter the key for your network. Note that this is meant to prevent accidental misconfigurations and is not a security mechanism. 4. (Optional) In **Additional Advertised prefix list**, input any additional prefixes you want to advertise alongside your existing routes. Leave this blank if you do not want to advertise extra routes. Typical prefixes to configure here include: * A route to `0.0.0.0/0`, the default route — to attract all Internet-bound traffic if using Magic Transit with Egress. * A route to `100.96.0.0/12`, the portion of CGNAT space [used by default with Cloudflare One Clients](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#return-traffic-routing). 5. Select **Save**. ### Important remarks for GRE/IPsec tunnels If you are configuring BGP peering for a tunnel (GRE or IPsec) you must be aware of the following: * Your Customer Premises Equipment (CPE) must initiate the BGP peering session. Cloudflare will not initiate. * Your BGP speaker must peer with the tunnel's IPv4 interface address. Your CPE may use any IPv4 address for its side of the peering connection; it does not need to use the other address from the `/31` or `/30` interface subnet. Warning If the tunnel is to an Azure VPN gateway, the tunnel interface address must not be in the link-local range. Azure will not initiate BGP sessions to peers using link-local addresses. Use an RFC 1918 address for your tunnel interface address instead. * Hold time must be greater than 0 seconds (BGP `KEEPALIVE` messages are required). Cloudflare recommends at least 45 seconds. Cloudflare advertises a hold time of 90 seconds for GRE/IPsec tunnels. If you set a value greater than 90 seconds, the negotiated hold time will be 90 seconds, according to the standard way BGP has of negotiating hold times. * Connect retry time should be low (for example, five or 10 seconds). * Your CPE may advertise up to 5,000 prefixes on one BGP session. * MD5 authentication is optional. You can use a maximum of 80 characters. Supported characters include `` a-zA-Z0-9'!@#$%^&*()+[]{}<>/.,;:_-~`= \\| `` Warning MD5 authentication is not a valid security mechanism. The MD5 key is not treated as a secret value. This is only supported for preventing misconfiguration, not for defending against malicious attacks. When MD5 is enabled, you cannot use Telnet to test BGP connectivity (Telnet does not support TCP MD5 authentication). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-routes/#page","headline":"Configure routes · Cloudflare Learning Paths","description":"Set up Magic Transit static routes.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-routes/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/configure-tunnels-routes/","name":"Configure tunnels and routes"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/data-center-protection/configure-tunnels-routes/configure-routes/","name":"Configure routes"}}]} ``` --- --- title: Configure tunnels description: Create GRE or IPsec tunnels for Magic Transit. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure tunnels Cloudflare assigns an IPv4 anycast address to your account for use as the tunnel destination for your network's routers. You can find this address in the Cloudflare dashboard under **Address Space** \> [**Leased IPs** ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space). To request additional endpoint addresses, contact your account team. Cloudflare handles failures on its network automatically by advertising your endpoint IP from multiple nodes across many globally distributed data centers. To handle failures on your network, configure two tunnels from separate routers. ## Before you begin Before creating a tunnel, make sure you have the following information: * **Cloudflare endpoint address**: The anycast IP address assigned to your account. You can find it in the Cloudflare dashboard under **Address Space** \> [**Leased IPs** ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space). * **Customer endpoint IP**: A public Internet routable IP address outside of the prefixes Cloudflare will advertise on your behalf (typically provided by your ISP). Not required if using [Cloudflare Network Interconnect](https://edgetunnel-b2h.pages.dev/network-interconnect/) or for IPsec tunnels (unless your router uses an IKE ID of type `ID_IPV4_ADDR`). * **Interface address**: A `/31` (recommended) or `/30` subnet from RFC 1918 private IP space (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) or `169.254.240.0/20`. Warning Make sure the interface address prefixes are always within the allowed Cloudflare ranges, especially for cloud service providers that might automatically generate prefixes for you. Otherwise, the tunnel will not work. ## Ways to onboard traffic to Cloudflare ### GRE and IPsec tunnels You can use GRE or IPsec tunnels to onboard your traffic to Magic Transit, and set them up through the Cloudflare dashboard or the API. If you use the API, you need your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and [API key](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/keys/#view-your-global-api-key). Anycast routing Cloudflare uses anycast to route traffic. Anycast is a network addressing and routing method that routes incoming requests to different locations. Traffic can arrive at a different geographic location than expected. Not all requests go to the closest data center because Internet routing and peering relationships are complex, and Cloudflare optimizes for performance and reliability. #### Choose between GRE and IPsec | Feature | GRE | IPsec | | ---------------- | --------------------------------- | ------------------------------------------------ | | Encryption | No | Yes | | Authentication | No | Pre-shared key (PSK) | | Setup complexity | Simpler | Requires PSK exchange | | Best for | Trusted networks, CNI connections | Internet-facing connections requiring encryption | Refer to [Tunnels and encapsulation](https://edgetunnel-b2h.pages.dev/magic-transit/reference/gre-ipsec-tunnels/) to learn more about the technical requirements for both tunnel types. #### IPsec supported ciphers Refer to [supported ciphers for IPsec](https://edgetunnel-b2h.pages.dev/magic-transit/reference/gre-ipsec-tunnels/#supported-configuration-parameters) for a complete list. IPsec tunnels only support Internet Key Exchange version 2 (IKEv2). #### Anti-replay protection If you use Magic Transit and anycast IPsec tunnels, we recommend disabling anti-replay protection. Cloudflare disables this setting by default. However, you can enable it through the API or the Cloudflare dashboard for devices that do not support disabling it, including Cisco Meraki, Velocloud, and AWS VPN Gateway. Refer to [Anti-replay protection](https://edgetunnel-b2h.pages.dev/magic-transit/reference/anti-replay-protection/) for more information on this topic, or [Add IPsec tunnels](#add-ipsec-tunnel) to learn how to enable this feature. ### Network Interconnect (CNI) Beyond GRE and IPsec tunnels, you can also use Network Interconnect (CNI) to onboard your traffic to Magic Transit. Refer to [Network Interconnect (CNI)](https://edgetunnel-b2h.pages.dev/magic-transit/network-interconnect/) for more information. ## Add tunnels Warning Cloudflare Network Firewall rules apply to Internet Control Message Protocol (ICMP) traffic. If you enable Cloudflare Network Firewall, ensure your rules allow ICMP traffic sourced from Cloudflare public IPs. Otherwise, health checks will fail. Refer to [Cloudflare Network Firewall rules](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/about/ruleset-logic/#cloudflare-network-firewall-rules-and-magic-transit-endpoint-health-checks) for more information. * [ Dashboard ](#tab-panel-9907) * [ API ](#tab-panel-9908) 1. Go to **Connectors** page. [ Go to **Connectors** ](https://dash.cloudflare.com/?to=/:account/magic-networks/connections) 1. From the **IPsec/GRE tunnels** tab, select **Create a tunnel**. 2. On the **Add tunnels** page, choose either a **GRE tunnel** or **IPsec tunnel**. 1. In **Name**, give your tunnel a descriptive name. This name must be unique, cannot contain spaces or special characters, and cannot be shared with other tunnels. 2. _(Optional)_ Give your tunnel a description in **Description**. 3. In **IPv4 Interface address**, enter the internal IP address for your tunnel along with the interface's prefix length (`/31` or `/30`). This is used to route traffic through the tunnel on the Cloudflare side. We recommend using a `/31` subnet, as it provides the most efficient use of IP address space. Expand the section below for your tunnel type to complete the configuration: GRE tunnel 1. In **Customer GRE endpoint**, enter your router's public IP address. You do not need this value if you use a physical or virtual connection like Cloudflare Network Interconnect because Cloudflare provides it. 2. In **Cloudflare GRE endpoint**, enter one of the anycast addresses assigned to your account. You can find them in [Leased IPs ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space). 3. _(Optional)_ Leave the default values for **TTL** and **MTU**, or customize them for your network. 4. _(Optional)_ Configure health check settings. Expand the following to learn more about each option: Health check options * **Tunnel health checks**: Enabled by default. If you disable tunnel health checks, your tunnels appear 100% down in your [tunnel health dashboard](https://edgetunnel-b2h.pages.dev/magic-transit/network-health/check-tunnel-health-dashboard/) even when working. Cloudflare keeps sending traffic through the tunnel without the means to detect if the tunnel goes down. You must set up your own system to detect down tunnels, as Cloudflare cannot warn you about down tunnels. Refer to [Tunnel health checks](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/) for more information. * **Health check rate**: If you keep tunnel health checks enabled, choose a [health check rate](https://edgetunnel-b2h.pages.dev/magic-transit/network-health/update-tunnel-health-checks-frequency/) for your tunnel. Available options are _Low_, _Medium_, and _High_. * **Health check type**: Defaults to _Reply_ and to creating an ICMP (Internet Control Message Protocol) reply. If your firewall drops this type of packet because it assumes the packet is an attack, change this option to _Request_ which creates an ICMP request. Refer to [Tunnel health checks](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/) for more information. * **Health check direction**: Defaults to **unidirectional** for Magic Transit. Refer to [Bidirectional vs unidirectional health checks](#bidirectional-vs-unidirectional-health-checks) for more details. * **Health check target**: The customer end of the tunnel. This field is only visible when **Health check direction** is set to _Unidirectional_. 5. _(Optional)_ We recommend you test your tunnel before officially adding it. To test the tunnel, select **Test tunnels**. 1. To add multiple tunnels, select **Add GRE tunnel** for each new tunnel. 1. After adding your tunnel information, select **Add tunnels**. 1. (_Optional_) Select **Allow BGP (Border Gateway Protocol) peering** (beta) if you want to dynamically exchange routes between your network and Cloudflare. This feature requires [Unified Routing (beta)](https://edgetunnel-b2h.pages.dev/magic-transit/reference/traffic-steering/#unified-routing-mode-beta). BGP is recommended for environments with frequently changing routes or when you need automatic failover. Refer to [Configure BGP routes](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-routes/#configure-bgp-routes) for more information. IPsec tunnel 1. _(Optional)_ In **Customer endpoint**, enter your router's public IP address. This value is only required if your router uses an IKE ID of type `ID_IPV4_ADDR`. 2. In **Cloudflare endpoint**, enter one of the anycast addresses assigned to your account. You can find them in [Leased IPs ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space). 3. _(Optional)_ Configure health check settings. Expand the following to learn more about each option: Health check options * **Tunnel health checks**: Enabled by default. If you disable tunnel health checks, your tunnels appear 100% down in your [tunnel health dashboard](https://edgetunnel-b2h.pages.dev/magic-transit/network-health/check-tunnel-health-dashboard/) even when working. Cloudflare keeps sending traffic through the tunnel without the means to detect if the tunnel goes down. You must set up your own system to detect down tunnels, as Cloudflare cannot warn you about down tunnels. Refer to [Tunnel health checks](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/) for more information. * **Health check rate**: If you keep tunnel health checks enabled, choose a [health check rate](https://edgetunnel-b2h.pages.dev/magic-transit/network-health/update-tunnel-health-checks-frequency/) for your tunnel. Available options are _Low_, _Medium_, and _High_. * **Health check type**: Defaults to _Reply_ and to creating an ICMP (Internet Control Message Protocol) reply. If your firewall drops this type of packet because it assumes the packet is an attack, change this option to _Request_ which creates an ICMP request. Refer to [Tunnel health checks](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/) for more information. * **Health check direction**: Defaults to **unidirectional** for Magic Transit. Refer to [Bidirectional vs unidirectional health checks](#bidirectional-vs-unidirectional-health-checks) for more details. * **Health check target**: The customer end of the tunnel. This field is only visible when **Health check direction** is set to _Unidirectional_. Note IPsec tunnels will not function without a pre-shared key (PSK). 4. If you do not have a pre-shared key yet: 1. Select **Add pre-shared key later**. 2. _(Optional)_ We recommend you test your tunnel configuration before officially adding it. To test the tunnel, select **Test tunnels**. 3. Select **Add tunnels**. 4. The Cloudflare dashboard loads the list of tunnels you have configured. The IPsec tunnel you just created displays a warning triangle icon to indicate it is not yet functional. Select **Edit**. 5. Choose **Generate a new pre-shared key** \> **Update and generate a pre-shared key**. Save the key to a safe place, and select **Done**. 5. If you already have a pre-shared key: 1. Select **Use my own pre-shared key**. 2. Paste your key in **Your pre-shared key**. 3. _(Optional)_ We recommend you test your tunnel before officially adding it. To test the tunnel, select **Test tunnels**. 4. Select **Add tunnels**. 6. _(Optional)_ Enable **Replay protection** if you have devices that do not support disabling it. Refer to [Anti-replay protection](https://edgetunnel-b2h.pages.dev/magic-transit/reference/anti-replay-protection/) for more information. 1. To add multiple tunnels, select **Add IPsec tunnel** for each new tunnel. 1. After adding your tunnel information, select **Add tunnels**. 1. (_Optional_) Select **Allow BGP (Border Gateway Protocol) peering** (beta) if you want to dynamically exchange routes between your network and Cloudflare. This feature requires [Unified Routing (beta)](https://edgetunnel-b2h.pages.dev/magic-transit/reference/traffic-steering/#unified-routing-mode-beta). BGP is recommended for environments with frequently changing routes or when you need automatic failover. Refer to [Configure BGP routes](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-routes/#configure-bgp-routes) for more information. Note You will need your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and [API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) to use the API. GRE tunnel Create a `POST` request [using the API](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/gre%5Ftunnels/methods/create/) to create a GRE tunnel. Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Magic WAN Write` * `Magic Transit Write` **Create a GRE tunnel** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/gre_tunnels" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "", "description": "", "interface_address": "", "cloudflare_gre_endpoint": "", "customer_gre_endpoint": "" }' ``` ```json { "errors": [ { "code": 1000, "message": "message" } ], "messages": [ { "code": 1000, "message": "message" } ], "result": { "gre_tunnels": [ { "cloudflare_gre_endpoint": "", "customer_gre_endpoint": "", "interface_address": "", "name": "", "description": "", "health_check": { "direction": "unidirectional", "enabled": true, "rate": "low", "type": "reply" }, "mtu": 0, "ttl": 0 } ] }, "success": true } ``` IPsec tunnel 1. Create a `POST` request [using the API](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/ipsec%5Ftunnels/methods/create/) to create an IPsec tunnel. Note that in the example, replay protection is disabled by default. You can enable it with the flag `"replay_protection": true` for each IPsec tunnel, if the devices you use do not support disabling this feature. If you have already created IPsec tunnels, update them with a [PUT request](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/ipsec%5Ftunnels/methods/update/). Refer to [Anti-replay protection](https://edgetunnel-b2h.pages.dev/magic-transit/reference/anti-replay-protection/) for more information on this topic. Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Magic WAN Write` * `Magic Transit Write` **Create an IPsec tunnel** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/ipsec_tunnels" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "", "description": "", "interface_address": "", "cloudflare_endpoint": "", "customer_endpoint": "" }' ``` ```json { "errors": [ { "code": 1000, "message": "message" } ], "messages": [ { "code": 1000, "message": "message" } ], "result": { "ipsec_tunnels": [ { "id": "", "interface_address": "", "name": "", "cloudflare_endpoint": "", "customer_endpoint": "", "description": "", "health_check": { "direction": "unidirectional", "enabled": true, "rate": "low", "type": "reply" }, "psk_metadata": {}, "replay_protection": false } ] }, "success": true } ``` Take note of the tunnel `id` value. We will use it to generate a pre-shared key (PSK). 2. Create a `POST` [request](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/ipsec%5Ftunnels/methods/psk%5Fgenerate/) to generate a PSK. Use the tunnel `id` value you received from the previous command. Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Magic WAN Write` * `Magic Transit Write` **Generate Pre-Shared Key (PSK) for IPsec tunnels** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/ipsec_tunnels/$IPSEC_TUNNEL_ID/psk_generate" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` ```json { "result": { "ipsec_id": "", "ipsec_tunnel_id": "", "psk": "", "psk_metadata": { "last_generated_on": "2025-03-13T14:28:47.054317925Z" } }, "success": true, "errors": [], "messages": [] } ``` Take note of your `psk` value. 3. Create a `PUT` [request](https://edgetunnel-b2h.pages.dev/api/resources/magic%5Ftransit/subresources/ipsec%5Ftunnels/methods/update/) to update your IPsec tunnel with the PSK. ```bash curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/magic/ipsec_tunnels/%7Bipsec_tunnel_id%7D" \ --request PUT \ --json '{ "psk": "" }' ``` ```json { "result": { "modified": true, "modified_ipsec_tunnel": { "id": "", "interface_address": "", "created_on": "2025-03-13T14:28:21.139535Z", "modified_on": "2025-03-13T14:33:26.09683Z", "name": "", "cloudflare_endpoint": "", "customer_endpoint": "", "remote_identities": { "hex_id": "", "fqdn_id": "", "user_id": "" }, "psk_metadata": { "last_generated_on": "2025-03-13T14:28:47.054318Z" }, "description": "", "health_check": { "enabled": true, "target": "", "type": "reply", "rate": "mid", "direction": "unidirectional" } } }, "success": true, "errors": [], "messages": [] } ``` 1. Use the `psk` value from step 3 to configure the IPsec tunnel on your equipment as well. Configure bidirectional health checks Bidirectional health checks are available for GRE and IPsec tunnels. For Magic Transit this option defaults to unidirectional. You can change this setting via the API with `"bidirectional"` or `"unidirectional"`: ```bash curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/magic/ipsec_tunnels/%7Bipsec_tunnel_id%7D" \ --request PUT \ --json '{ "health_check": { "direction": "bidirectional" } }' ``` ```json { "result": { "modified": true, "modified_ipsec_tunnel": { "id": "", "interface_address": "", "created_on": "2025-03-13T14:28:21.139535Z", "modified_on": "2025-03-13T14:33:26.09683Z", "name": "", "cloudflare_endpoint": "", "customer_endpoint": "", "remote_identities": { "hex_id": "", "fqdn_id": "", "user_id": "" }, "psk_metadata": { "last_generated_on": "2025-03-13T14:28:47.054318Z" }, "description": "", "health_check": { "enabled": true, "target": "", "type": "reply", "rate": "mid", "direction": "bidirectional" } } }, "success": true, "errors": [], "messages": [] } ``` ## Bidirectional vs unidirectional health checks To check for tunnel health, Cloudflare sends a [health check probe](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/) consisting of ICMP (Internet Control Message Protocol) reply [packets ↗](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) to your network. Cloudflare needs to receive these probes to know if your tunnel is healthy. Cloudflare defaults to unidirectional health checks for Magic Transit (direct server return), and bidirectional health checks for Cloudflare WAN. However, routing unidirectional ICMP reply packets over the Internet to Cloudflare is sometimes subject to drops by intermediate network devices, such as stateful firewalls. Magic Transit customers with egress traffic can modify this setting to bidirectional. If you are a Magic Transit customer with egress traffic, refer to [Magic Transit egress traffic](https://edgetunnel-b2h.pages.dev/magic-transit/reference/egress/) for more information on the technical aspects you need to consider to create a successful connection to Cloudflare. ### Legacy bidirectional health checks For customers using the legacy health check system with a public IP range, Cloudflare recommends: * Configuring the tunnel health check target IP address to one within the `172.64.240.252/30` prefix range. * Applying a policy-based route that matches [packets ↗](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) with a source IP address equal to the configured tunnel health check target (for example `172.64.240.253/32`), and route them over the tunnel back to Cloudflare. ## Next steps Now that you have set up your tunnel endpoints, you need to configure routes to direct your traffic through Cloudflare. You have two routing options: * **Static routes**: Best for simple, stable networks where routes rarely change. You manually define each route. * **BGP peering**: Best for dynamic environments with frequently changing routes, multiple prefixes, or when you need automatic failover. Requires enabling BGP on your tunnel during creation. Refer to [Configure routes](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-routes/) for detailed instructions on both options. ## Troubleshooting If you experience issues with your tunnels: * For tunnel health check problems, refer to [Troubleshoot tunnel health](https://edgetunnel-b2h.pages.dev/magic-transit/troubleshooting/tunnel-health/). * For IPsec tunnel establishment issues, refer to [Troubleshoot with IPsec logs](https://edgetunnel-b2h.pages.dev/magic-transit/troubleshooting/ipsec-troubleshoot/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-tunnels/#page","headline":"Configure tunnels · Cloudflare Learning Paths","description":"Create GRE or IPsec tunnels for Magic Transit.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-tunnels/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/configure-tunnels-routes/","name":"Configure tunnels and routes"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/data-center-protection/configure-tunnels-routes/configure-tunnels/","name":"Configure tunnels"}}]} ``` --- --- title: Enable Cloudflare Network Firewall description: Learn about enable cloudflare network firewall in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Enable Cloudflare Network Firewall Magic Transit customers are automatically provided with the [standard features](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/plans/#standard-features) of Cloudflare Network Firewall, Cloudflare's firewall-as-a-service product. Cloudflare recommends creating a ruleset customized to your environment and needs. Without any rules configured, Cloudflare Network Firewall will pass on all traffic after mitigations are applied to your tunnels. The [Extended ruleset](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/best-practices/extended-ruleset/) is the best practice for reducing your attack surface by adopting a positive security model. If possible, use your current Edge Firewall policies to help you decide what ports to permit/block. If you cannot use the extended ruleset, then use the [minimal ruleset guidance](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/best-practices/minimal-ruleset/) to create a customized ruleset to block known unwanted traffic and common vectors for attack. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/enable-network-firewall/#page","headline":"Enable Cloudflare Network Firewall · Cloudflare Learning Paths","description":"Learn about enable cloudflare network firewall in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/enable-network-firewall/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/enable-network-firewall/","name":"Enable Cloudflare Network Firewall"}}]} ``` --- --- title: Enable Notifications description: Learn about enable notifications in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Enable Notifications You can configure Tunnel Health Alerts (formerly Magic Tunnel health alerts) to receive email, webhook, and PagerDuty notifications when the percentage of successful health checks for an IPsec/GRE tunnel drops below the selected [service-level objective (SLO)](https://edgetunnel-b2h.pages.dev/magic-transit/reference/how-cloudflare-calculates-tunnel-health-alerts/). Tunnel health alerts monitor the health check success rate of each IPsec/GRE tunnel included in the alert that has actively transferred customer traffic (excluding health check traffic) over the past six hours. You can define an SLO threshold for the percentage of health checks that must be successful for each IPsec/GRE tunnel. If the number of successful health checks for the IPsec/GRE tunnel(s) included in the alert drops below the SLO threshold, an alert fires. ## Alert data When a Tunnel health alert fires, you receive the following data in the email, webhook, and PagerDuty notification: * Cloudflare account name * Cloudflare account ID * Alert type * Tunnel name * Tunnel ID * Tunnel status * Alert SLO * Timestamp ## SLO thresholds Currently, there are seven SLO threshold values that you can configure through the Cloudflare dashboard. For a more granular approach, use the [API](#set-up-tunnel-health-alerts). The SLO threshold for Tunnel health alerts is the percentage of successful health checks for each IPsec/GRE tunnel in the alert: | Alert Sensitivity Level | SLO threshold | | ----------------------- | ------------- | | Minimum | 95.0 | | Very low | 96.0 | | Low | 97.0 | | Medium | 98.0 | | High | 99.0 | | Very high | 99.5 | | Maximum | 99.9 | The time it takes to receive alerts depends on the sensitivity level you configure for your SLO thresholds. Higher sensitivity levels notify you faster when a tunnel's health degrades, but they may also trigger alerts for brief or minor disruptions. Lower sensitivity levels reduce the chance of false alarms but may delay notifications for less severe issues. While the underlying detection timing remains consistent across sensitivity levels, the speed of notification depends on how significantly the tunnel's health has dropped and the sensitivity you have chosen. Cloudflare recommends that you [test SLO thresholds](#test-slos) to determine which one better serves your use case. For details, refer to [How Cloudflare calculates Tunnel health alerts](https://edgetunnel-b2h.pages.dev/magic-transit/reference/how-cloudflare-calculates-tunnel-health-alerts/). ## Set up Tunnel Health Alerts * [ Dashboard ](#tab-panel-9909) * [ API ](#tab-panel-9910) 1. Go to the **Notifications** page. [ Go to **Notifications** ](https://dash.cloudflare.com/?to=/:account/notifications) 2. Select **Add**. 3. From the **Product** drop-down menu, select **Magic Transit**. 4. Select **Tunnel Health Check Alert** \> **Select** to add a notification. You can add alerts by tunnel or by data center (beta). Alert by tunnel 1. Select **Alert by tunnel**. 2. Enter a name and description for the notification. 3. Add webhooks or an email address for the person who should receive the notification, and select **Next**. 4. Select the **Alert Sensitivity Level** threshold from the drop-down menu. The threshold defaults to _Medium (98.0)_. You can choose from options between _Minimum (95.0)_ and _Maximum (99.9)_. For details, refer to [How Cloudflare calculates Tunnel health alerts](https://edgetunnel-b2h.pages.dev/magic-transit/reference/how-cloudflare-calculates-tunnel-health-alerts/). 5. From the **Alert interval** drop-down menu, set the minimum amount of time that must pass before Cloudflare sends you a duplicate alert. Options range from five minutes to seven days. 6. Enable **Set as default alert for any new tunnels created in the future** if you want the alert sensitivity level you chose to be automatically applied to all new tunnels you create. 7. Select **Next**. 8. Choose the tunnels you want to receive alerts for. You can search by specific tunnel names, or filter them by type (Generic Routing Encapsulation (GRE), Internet Protocol Security (IPsec), and CNI (Cloudflare Network Interconnect)). Select **Next**. 9. Review the details of your alert. If these details are correct, select **Create alert**. Alert by data center (beta) 1. Select **Alert by data center**. 2. Enter a name and description for the notification. 3. Add webhooks or an email address for the person who should receive the notification, and select **Next**. 4. Select the **Alert Sensitivity Level** threshold from the drop-down menu. The threshold defaults to _Medium (98.0)_. You can choose from options between _Minimum (95.0)_ and _Maximum (99.9)_. For details, refer to [How Cloudflare calculates Tunnel health alerts](https://edgetunnel-b2h.pages.dev/magic-transit/reference/how-cloudflare-calculates-tunnel-health-alerts/). 5. From the **Alert interval** drop-down menu, set the minimum amount of time that must pass before Cloudflare sends you a duplicate alert. Options range from five minutes to seven days. 6. Choose the data centers you want to receive alerts for, and select **Next**. 7. Choose the tunnels you want to receive alerts for. You can search by specific tunnel names, or filter them by type (GRE, IPsec, and CNI (Cloudflare Network Interconnect)). Select **Next**. 8. Review the details of your alert. If these details are correct, select **Create alert**. Note For details on specific permissions, refer to the [documentation for Notifications](https://edgetunnel-b2h.pages.dev/notifications/get-started/). Send a [POST request](https://edgetunnel-b2h.pages.dev/api/resources/alerting/subresources/policies/methods/create/) to create a tunnel health alert. You can set tunnel health alerts with any SLO value between `0` and `99.99`. Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Notifications Write` * `Account Settings Write` **Create a Notification policy** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/alerting/v3/policies" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "alert_type": "magic_tunnel_health_check_event", "description": "", "enabled": true, "filters": { "slo": [ "99.9" ] }, "mechanisms": { "email": [ { "id": "EMAIL_ADDRESS" } ] }, "name": "" }' ``` ```json { "result": [ { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "name": "", "description": "", "enabled": true, "alert_type": "magic_tunnel_health_check_event", "mechanisms": { "email": [ { "id": "" } ] }, "created": "2024-09-11T14:13:29.585658Z", "modified": "2024-09-11T14:13:29.585658Z", "conditions": { "and": [ { "or": [ { "<=": [ { "var": "slo" }, "99.9" ] } ] } ] }, "filters": { "slo": ["99.9"] } } ], "success": true, "errors": [], "messages": [] } ``` ## Test SLOs To test whether a specific alert sensitivity level works for your use case: 1. [Create an alert](#set-up-tunnel-health-alerts) with a specific sensitivity level for a tunnel with active traffic within the past six hours. If you are unsure which tunnels to choose, refer to [Network Analytics](https://edgetunnel-b2h.pages.dev/magic-transit/analytics/network-analytics/) for real-time and historical data about your network. 2. Disable the tunnel you are testing, so there is 100% [health check failure](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/). 3. The time it takes for Cloudflare to send you an alert depends on the sensitivity you chose for your alerts. ## Other notifications Cloudflare also recommends that you enable the following account notifications for your Magic Transit service: * Layer 3/4 DDoS Attack Alert * Route Leak Detection Alert (to detect BGP Hijacks) * (Optional) Advanced Layer 3/4 DDoS Attack Alert * (Optional) Cloudflare status - Maintenance Notification (in case you want to be alerted regarding maintenance in specific Cloudflare data centers). Refer to [Cloudflare Notifications](https://edgetunnel-b2h.pages.dev/notifications/) for more information on how to enable these notifications. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/enable-notifications/#page","headline":"Enable Notifications · Cloudflare Learning Paths","description":"Learn about enable notifications in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/enable-notifications/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/enable-notifications/","name":"Enable Notifications"}}]} ``` --- --- title: Get started description: Begin onboarding with Magic Transit. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Get started ## Scope your configuration Magic Transit is not a self-serve product. Start by [engaging with our team ↗](https://www.cloudflare.com/network-services/products/magic-transit/) to assess your needs and implementation timeline. During this assessment, Cloudflare reviews specific requirements such as your prefix count and how fast you can go through the necessary steps to implement Magic Transit on your network. ## IPs To use Magic Transit, you need to own a publicly routable IP address block with a minimum size of `/24`. If you do not own a `/24` address block, you can use Magic Transit with a Cloudflare-owned IP address. This option is helpful if you do not meet the `/24` prefix length requirements or want to protect a smaller network. To protect your network with a Cloudflare IP address, contact your account manager. After you receive your IP address: * [Create a tunnel](https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-tunnels/). * [Set up static routes](https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-routes/#configure-static-routes) or [BGP peering (beta)](https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/configure-tunnels-routes/configure-routes/#configure-bgp-routes). * [Configure health checks](https://edgetunnel-b2h.pages.dev/magic-transit/network-health/run-endpoint-health-checks/). * Confirm you properly configured [tunnel](https://edgetunnel-b2h.pages.dev/magic-transit/network-health/update-tunnel-health-checks-frequency/) and endpoint health checks. * Update your infrastructure at your own pace to use the allocated Cloudflare IPs. When you use a Cloudflare-owned IP space, you do not need a Letter of Agency (LOA). When using Cloudflare-leased IPs, Cloudflare automatically enables [Magic Transit Egress](https://edgetunnel-b2h.pages.dev/magic-transit/reference/egress/), which routes your egress traffic to Cloudflare instead of the Internet. Set up policy-based routing on your end to ensure return traffic routes properly. ## Verify router compatibility Magic Transit relies on anycast tunnels to transmit packets from Cloudflare's global network to your origin network. The routers at your tunnel endpoints must meet the following requirements for Magic Transit compatibility. * Support GRE tunnels (or IPsec if GRE is not available). * Support at least one tunnel per Internet service provider (ISP). * Support maximum segment size (MSS) clamping. * Support asymmetric traffic flow (for ingress-only Magic Transit). ## Draft Letter of Agency Draft a [Letter of Agency (LOA)](https://edgetunnel-b2h.pages.dev/byoip/concepts/loa/) that identifies the prefixes you want to advertise and authorizes Cloudflare to announce them. Our transit providers require the LOA so they can accept the routes we advertise on your behalf. If you are an Internet service provider (ISP) and advertising prefixes on behalf of a customer, you need an LOA for the ISP and for the customer. If you are using a [Cloudflare IP address](#ips), you do not need to submit an LOA. Note The LOA must be a PDF. Transit providers may reject the LOA if it is a JPG or PNG. ### Example of a Letter of Agency **Letter of Agency template** ```txt [COMPANY LETTERHEAD] LETTER OF AGENCY ("LOA") [DATE] To whom it may concern: [COMPANY NAME] (the "Company") authorizes Cloudflare, Inc. with AS13335 to advertise the following IP address blocks / originating ASNs: - - - - - - - - - - - - - - - - - - - [Subnet & Originating ASN] [Subnet & Originating ASN] [Subnet & Originating ASN] - - - - - - - - - - - - - - - - - - - As a representative of the Company that is the owner of the aforementioned IP address blocks / originating ASNs, I hereby declare that I am authorized to sign this LOA on the Company’s behalf. Should you have any questions please email me at [E-MAIL ADDRESS], or call: [TELEPHONE NUMBER] Regards, [SIGNATURE] [NAME TYPED] [TITLE] [COMPANY NAME] [COMPANY ADDRESS] [COMPANY STAMP] ``` ## Verify IRR entries Verify that your Internet Routing Registry (IRR) entries match your corresponding origin autonomous system numbers (ASNs) to ensure Magic Transit routes traffic to the correct autonomous systems (AS). For guidance, refer to [Verify IRR entries](https://edgetunnel-b2h.pages.dev/byoip/concepts/irr-entries/best-practices/#verify-an-irr-entry). If you are using a [Cloudflare IP](#ips), you do not need to verify your IRR entries. ### Optional: RPKI check for prefix validation You can also use the Resource Public Key Infrastructure (RPKI) as an additional option to validate your prefixes. RPKI is a [security framework method ↗](https://blog.cloudflare.com/rpki/) that associates a route with an autonomous system. It uses cryptography to validate the information before being passed to the routers. If you operate a network (ISP, cloud provider, enterprise, and others), using RPKI ensures that routers correctly recognize your IP prefixes. This prevents service disruptions and protects your brand's reputation. Without RPKI, attackers could announce your IP space, misdirect your traffic, and potentially harm your business. To check your prefixes, you can use [Cloudflare's RPKI Portal ↗](https://rpki.cloudflare.com/?view=validator). ## Set maximum segment size Before enabling Magic Transit, you must make sure that you set up the maximum segment size on your network. Cloudflare Magic Transit uses tunnels to deliver [packets ↗](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) from our global network to your data centers. Cloudflare encapsulates these packets adding new headers. You must account for the space consumed by these headers when configuring the maximum transmission unit (MTU) and maximum segment size (MSS) values for your network. ### MSS clamping recommendations #### GRE tunnels as off-ramp The MSS value depends on how your network is set up. * **Magic Transit ingress-only traffic (DSR):** * **On your edge router transit ports**: Set a TCP MSS clamp to a maximum of 1,436 bytes. * **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: Apply the MSS clamp on the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce the current value by 24 bytes. * **For Magic Transit ingress + egress traffic:** * **On the Magic Transit GRE tunnel internal interface**: Meaning where the Magic Transit egress traffic will traverse. Your devices may do this automatically once the tunnel is configured, but it depends on your devices. Set the TCP MSS clamp to 1,436 bytes maximum. * **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: On the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce its current value by 24 bytes. #### IPsec tunnels For IPsec tunnels, the value you need to specify depends on how your network is set up. The MSS clamping value is lower than for GRE tunnels because the physical interface sees IPsec-encrypted [packets ↗](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/), not TCP packets, and MSS clamping does not apply to those. * **Magic Transit ingress-only traffic (DSR):** * **On your edge router transit ports**: Set the TCP MSS clamp to 1,436 bytes maximum. * **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: On the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce its current value by 140 bytes. * **Magic Transit ingress + egress traffic:** * **On your edge router**: Apply this on your Magic Transit IPsec tunnel internal interface (that is, where the Magic Transit egress traffic will traverse). Your devices may do this automatically once the tunnel is configured, but it depends on your devices. Set the TCP MSS clamp to 1,360 bytes maximum. * **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: On the internal tunnel interface (most likely on a separate firewall behind the IPsec-terminating device in your premises) to reduce its current value by 140 bytes. Important Refer to your device documentation to check if it sets IPsec MSS clamping automatically. If not and you are using IPsec inside GRE, you must set MSS clamp manually. Refer to [Maximum transmission unit and maximum segment size](https://edgetunnel-b2h.pages.dev/magic-transit/reference/mtu-mss/) for more details. #### Clear Do not fragment (DF) If you are unable to set the MSS on your physical interfaces to a value lower than 1500 bytes, you can clear the `do not fragment` bit in the IP header. When this option is enabled, Cloudflare fragments [packets ↗](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) greater than 1500 bytes, and the packets are reassembled on your infrastructure after decapsulation. In most environments, enabling this option does not have a significant impact on traffic throughput. To enable this option for your network, contact your account team. Refer to [Maximum transmission unit and maximum segment size](https://edgetunnel-b2h.pages.dev/magic-transit/reference/mtu-mss/) for more details. ## Follow router vendor guidelines Instructions to adjust MSS by applying MSS clamps vary depending on the vendor of your router. The following table lists several commonly used router vendors with links to MSS clamping instructions: | Router device | URL | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Cisco | [TCP IP Adjust MSS ↗](https://www.cisco.com/en/US/docs/ios-xml/ios/ipapp/command/ip%5Ftcp%5Fadjust-mss%5Fthrough%5Fip%5Fwccp%5Fweb-cache%5Faccelerated.html#GUID-68044D35-A53E-42C1-A7AB-9236333DA8C4) | | Juniper | [TCP MSS - Edit System ↗](https://www.juniper.net/documentation/en%5FUS/junos/topics/reference/configuration-statement/tcp-mss-edit-system.html) | ## BGP for Magic Transit prefix advertisement control (optional) If you want to use [BGP for prefix advertisement control](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/advertise-prefixes/#bgp-prefix-advertisement-control-methods), notify your account team of the IPs and ASN for your customer premises equipment (CPE) to use for the BGP peerings. You should allow around five working days for Cloudflare to add this to our Route Reflectors. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/get-started/#page","headline":"Get started · Cloudflare Learning Paths","description":"Begin onboarding with Magic Transit.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/get-started/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/get-started/","name":"Get started"}}]} ``` --- --- title: Post prefix advertisement monitoring and fine tuning description: Learn about post prefix advertisement monitoring and fine tuning in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Post prefix advertisement monitoring and fine tuning On this page, you can find suggestions to monitor your prefix advertisements and fine-tune them. ## DDOS Managed Rules ### Adaptive DDOS rules [These rules](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/adaptive-protection/) are based on a seven-day rolling window. We recommend reviewing the logs from these adaptive rules in Network Analytics seven days after your last prefix advertisement. If you see matches for legitimate traffic, consider lowering the sensitivity of the rule and then review the logs again. Once you are satisfied that legitimate traffic is not being flagged, [create a DDoS override](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard/#create-a-ddos-override) for this rule with action as `DDOS Dynamic` or `Block`. ### Advanced TCP Protection and Advanced DNS Protection For both [Advanced TCP Protection](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) and [Advanced DNS Protection](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/), your Cloudflare account team will need to configure manual thresholds for your account, based on your ingress traffic. Once all your prefixes are advertised and/or once all your expected traffic is cut over to the Magic Transit prefixes, reach out to your Cloudflare account team to have the thresholds configured. You can then change the mode on your Advanced TCP and DNS protections from `monitoring` to `mitigation`. You can also create a filter for `monitoring` mode for any traffic flows for which you see false positives. Try to keep this specific so that the protection is enabled for other inbound traffic flows. ## Cloudflare Network Firewall rules We strongly encourage you to ensure you have a Cloudflare Network Firewall ruleset configured and customized to your environment to help stop unwanted and attack traffic. You can configure Cloudflare Network Firewall rules and keep them in `disabled` mode to review the traffic that would have matched, using `verdict = drop` and the rule ID within Network Analytics. Once you are satisfied that the rule is blocking/permitting the intended traffic, you can change the mode to `enabled`. Refer to Cloudflare Network Firewall's [best practices](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/best-practices/) for configuration guidance and suggestions. ## Alerts for Magic Tunnel health checks and DDoS * Ensure all teams/members needing to receive these are getting the alerts. * Check the Tunnel Health Check Alert configuration for Sensitivity and Alert interval and tunnels in-scope. * Refer to [Set up tunnel health alerts](https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/enable-notifications/#set-up-tunnel-health-alerts) and [DDoS alerts](https://edgetunnel-b2h.pages.dev/ddos-protection/reference/alerts/) for more details. ## Optional * Enable [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/) to your Security Information and Event Management (SIEM). * Enable Cloudflare Network Firewall's [Intrusion Detection System (IDS)](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/about/ids/). Requires Logpush and is only available for accounts with [Cloudflare Advanced Network Firewall](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/plans/#advanced-features). * Use [Network Flow](https://edgetunnel-b2h.pages.dev/network-flow/) (formerly Magic Network Monitoring) for visibility into traffic on your non-Magic Transit prefixes, using NetFlow or sFlow from your CPEs. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/post-prefix-fine-tuning/#page","headline":"Post prefix advertisement monitoring and fine tuning · Cloudflare Learning Paths","description":"Learn about post prefix advertisement monitoring and fine tuning in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/post-prefix-fine-tuning/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/post-prefix-fine-tuning/","name":"Post prefix advertisement monitoring and fine tuning"}}]} ``` --- --- title: Run pre-flight checks description: Verify readiness before Magic Transit activation. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Run pre-flight checks After setting up your Magic Transit product, Cloudflare validates: * Tunnel connectivity * Tunnel and endpoint [health checks](https://edgetunnel-b2h.pages.dev/magic-transit/reference/tunnel-health-checks/#types-of-health-checks) * Letter of Agency (LOA) * Internet Routing Registry (IRR) * Maximum segment size (MSS) configurations. Refer to [Get started](https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/get-started/) for information about the above topics. Configurations for Cloudflare global network are applied and take around one day to rollout. On your side, you should do the following: * Confirm that your upstream ISPs do not have [uRPF](https://edgetunnel-b2h.pages.dev/byoip/troubleshooting/#urpf-filtering-and-packet-loss) strict-mode enabled. If they do, ask them to change this setting to uRPF loose mode. Having strict-mode uRPF will result in packet loss when you advertise your prefix from Cloudflare and withdraw your prefix advertisement from your ISP. * Confirm you have adjusted MSS/MTU value on any IPsec or GRE tunnels with third parties that are configured on your Magic Transit prefix. * If you are using BGP for Magic Transit prefix advertisement, configure your own alerts/logs for the BGP peerings with Cloudflare route reflectors. Cloudflare will not notify you if these peerings go down, so you should enable this on your equipment using syslog or other event-alerting tools. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/run-pre-flight-checks/#page","headline":"Run pre-flight checks · Cloudflare Learning Paths","description":"Verify readiness before Magic Transit activation.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/run-pre-flight-checks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/run-pre-flight-checks/","name":"Run pre-flight checks"}}]} ``` --- --- title: Troubleshooting connectivity issues after prefix advertisement description: Learn about troubleshooting connectivity issues after prefix advertisement in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Troubleshooting connectivity issues after prefix advertisement ## For Magic Transit ingress-only with Direct Server Return ### Magic Transit devices cannot reach Internet IPs after cutover to Cloudflare. **Potential solutions**: * Run a traceroute from the Magic Transit prefix out to the destination IP on the Internet. * Verify on your CPE there is no uRPF strict mode or anti-spoofing which would drop this traffic. * Verify that your CPE is not enforcing uRPF strict mode or other anti-spoofing mechanisms that could drop this traffic. If they do, ask them to change this to loose mode. * Other workarounds: * If you have a less-specific prefix then you can continue to advertise this to your ISP while Cloudflare advertises a more-specific prefix. For example, Cloudflare advertises a `/24` to the Internet; you advertise its parent `/23` to your ISP. * You can continue advertising a `/24` to your ISP, but this is not recommended, as inbound traffic from your ISP would bypass Cloudflare and therefore not benefit from Magic Transit DDoS protection. ### Devices connected to the Magic Transit prefix cannot access Internet websites via TCP on ports `443` or `80` (HTTPS/HTTP) **Potential solutions**: * The MSS clamp is configured on all your CPE egress ports at the location where the Magic Transit prefix is configured. * Confirm the MSS values advertised in the TCP SYN-ACK by capturing packets at both ends of the traffic flow — for example, on the remote Internet IP and on your Magic Transit device. * To quickly test whether the issue is related to MTU or MSS settings, you can temporarily lower the MSS clamp on the LAN interface of a test device within the Magic Transit prefix. If this resolves the issue, it confirms that the MSS clamp setting needs to be fine-tuned for your prefix. Be sure to verify that the correct MSS clamp is applied on all egress interfaces of your edge CPE(s). ### Devices on the Internet cannot access a TCP service on Magic Transit prefix For example, devices cannot browse to a server which is hosted on the Magic Transit prefix. **Potential solutions**: * The MSS clamp is configured on all your CPE egress ports at the location where the Magic Transit prefix is configured. * Confirm the MSS values advertised in the TCP SYN-ACK by capturing packets at both ends of the traffic flow — for example, on the remote Internet IP and on your Magic Transit device. * To quickly test whether the issue is related to MTU or MSS settings, you can temporarily lower the MSS clamp on the LAN interface of a test device within the Magic Transit prefix. If this resolves the issue, it confirms that the MSS clamp setting needs to be fine-tuned for your prefix. Be sure to verify that the correct MSS clamp is applied on all egress interfaces of your edge CPE(s). ### Users report issues with IPsec or GRE traffic between Magic Transit and third parties **Potential solutions**: * The MSS clamp is properly applied to traffic traversing the IPsec/GRE tunnel. Use packet captures at both tunnel endpoints to inspect the MSS values advertised in the TCP SYN-ACK. * Verify the MSS setting on your firewall's IPsec internal tunnel interface connected to the Magic Transit prefix. Set it to approximately 1300 bytes to avoid fragmentation of inbound packets traversing the Magic Transit GRE tunnel (MTU 1476 bytes). For GRE tunnels, adjust the MSS by subtracting 24 bytes from the original value to account for GRE encapsulation overhead. * If this does not work, then you can reach out to Cloudflare to ask that we enable the `clear don't fragment` bit for a specific endpoint IP on your prefix which is having the problem, to see if that resolves the issue. ### Cloudflare might be dropping valid traffic to your Magic Transit prefix If you suspect that Cloudflare mitigations might be dropping legitimate traffic to your Magic Transit prefix: 1. Go to the Network analytics page. [ Go to **Network analytics** ](https://dash.cloudflare.com/?to=/:account/networking-insights/analytics/network-analytics/transport-analytics) 1. In the **All traffic** tab select **Add filter** to configure the filters for the traffic-flow in question — like source IP, destination IP and protocol/ports. 2. Check the analytics results to determine which Cloudflare mitigation system has dropped the traffic — for example, DDoS Managed Rules, Advanced TCP/DNS Protection or Network Firewall. 3. If the traffic was dropped by DDoS Managed Rules: * Check whether the rule that dropped the traffic is customizable. If it is, go to [DDoS Overrides](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard/#create-a-ddos-override). There, you can create/amend an existing override to ensure that this endpoint IP is added to the override with a lower sensitivity applied. * If this rule is not customizable and is part of Cloudflare's always-on standard DDoS mitigations, reach out to Cloudflare support team to request for assistance on this. 4. If the traffic was dropped by Advanced TCP Protection (ATP): * If the mode for the global rule is **Mitigation** you can set up a filter for `monitoring` so that ATP will not drop traffic for this particular traffic flow. * If you need further assistance, reach out to your Cloudflare support team who can adjust other backend configuration options for this mitigation system. 5. If the traffic was dropped by Advanced DNS Protection: * You can create a rule to apply on traffic received in a region or datacenter with a lower sensitivity setting. Once created, you can change the mode of the rule to `monitoring`. * Alternatively, you can change the mode for the global rule from `mitigation` to `monitoring`. 6. If the traffic was dropped by Network Firewall: * Check which configured Network Firewall rule caused the drop. * You can choose to edit the rule or disable it. You can also add a new rule to permit your traffic and ensure it is placed above the rule that is configured to drop the traffic. ## For Magic Transit ingress + egress ### Devices using your Magic Transit IP cannot reach any Internet sites via TCP, UDP, or ICMP **Potential solutions**: * If you are using Cloudflare Magic Transit leased IPs, ensure your CPE is correctly NATing to the Cloudflare leased IP and has policy-based Routing configured properly to forward egress traffic via the Magic Transit IPsec/GRE tunnel. * Check that the Network Firewall rules are configured to allow the egress traffic. As a reminder, Network Firewall is stateless, and configured rules will apply for both ingress and egress traffic. * Check that the egress traffic flow is visible inside Network Analytics. Also, check for the inbound traffic flow returning to the Magic Transit prefix. Verify if any mitigations are applied on the traffic. If the problem is seen for TCP only and UDP/ICMP are successful, check the MSS and MTU configuration on your CPE's GRE/IPsec tunnel. Perform a packet capture on the CPE/end-device to confirm the SYN-ACK values exchanged. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/troubleshooting/#page","headline":"Troubleshooting connectivity issues after prefix advertisement · Cloudflare Learning Paths","description":"Learn about troubleshooting connectivity issues after prefix advertisement in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/data-center-protection/troubleshooting/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/data-center-protection/troubleshooting/","name":"Troubleshooting connectivity issues after prefix advertisement"}}]} ``` --- --- title: Concepts description: Migrate and manage DNS on Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Migrating your DNS from an on-premises BIND solution to a cloud-based provider like Cloudflare can offer significant benefits in terms of performance, security, and manageability. However, a successful migration requires careful planning and execution. This guide outlines best practices to ensure a smooth transition. ## Objectives By the end of this module, you will be able to: * Plan and take inventory of your DNS migration. * Prepare for the migration with minimal downtime. * Learn how to make the actual switch to Cloudflare. * Verify and stabilize after your migration. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Migrate and manage DNS on Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/dns-best-practices/concepts/","name":"Concepts"}}]} ``` --- --- title: Phase 1: Planning & Inventory description: Plan and inventory your DNS migration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Phase 1: Planning & Inventory Detailed planning is the cornerstone of a successful DNS migration. ## 1\. Understand your current BIND setup 1. Identify all DNS zones currently hosted on your BIND servers. 2. Review all DNS records within each zone. Remove stale or unnecessary records and verify the accuracy of existing records. 3. BIND views (split DNS): If you use BIND views to provide different DNS responses to internal versus external resolvers, Cloudflare authoritative DNS does not replicate per-client views directly. * Continue to use an internal DNS resolver (for example, BIND, Active Directory, or another internal resolver) for internal-only names, while using Cloudflare authoritative DNS for public zones. * For policy-based internal DNS, consider Cloudflare Zero Trust features such as DNS policies and Internal DNS. For more details, refer to [Cloudflare DNS](https://edgetunnel-b2h.pages.dev/dns/) and [Internal DNS](https://edgetunnel-b2h.pages.dev/dns/internal-dns/). 4. BIND ACLs (access control lists): If you use ACLs in BIND to restrict which clients can query your authoritative DNS or perform zone transfers, plan how these controls will change: * **Authoritative DNS queries:** Cloudflare authoritative DNS nameservers are reachable on the public Internet and do not support per-resolver ACLs for standard DNS queries. * **HTTP and application access:** To restrict or filter HTTP(S) traffic to your applications, use Cloudflare security features such as the [Web Application Firewall (WAF)](https://edgetunnel-b2h.pages.dev/waf/) and other Application Security products. These operate at the HTTP layer, not at the DNS query layer. * Zone transfers (AXFR/IXFR): If you use AXFR/IXFR with BIND today, review Cloudflare’s zone transfer setups: * [Cloudflare as primary DNS](https://edgetunnel-b2h.pages.dev/dns/zone-setups/zone-transfers/cloudflare-as-primary/) * [Cloudflare as secondary DNS](https://edgetunnel-b2h.pages.dev/dns/zone-setups/zone-transfers/cloudflare-as-secondary/) These setups document how to restrict which IP addresses can perform zone transfers. 5. Dependencies: Identify any applications or services critically dependent on specific DNS behaviors of your BIND setup. ## 2\. Define scope and objectives Clearly list all domain names to be migrated and define success criteria for the migration. ## 3\. Cloudflare account and familiarization 1. [Create your Cloudflare account](https://edgetunnel-b2h.pages.dev/fundamentals/account/create-account/) if you have not already. 2. Familiarize yourself with the Cloudflare DNS dashboard and its features. 3. Consider the different [DNS record types](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/reference/dns-record-types/) you can manage on Cloudflare and how they map from BIND. ## 4\. DNSSEC strategy (critical) Determine if DNSSEC is currently enabled for your zones on BIND and at your domain registrar. Cloudflare supports two main migration approaches when DNSSEC is enabled: * Option 1 (recommended for most migrations): [Disable DNSSEC at your registrar](https://edgetunnel-b2h.pages.dev/dns/dnssec/#disable-dnssec) before changing nameservers. After the migration to Cloudflare is complete and stable, re-enable DNSSEC through the Cloudflare dashboard. * Option 2 (advanced): Perform an active migration using [multi-signer DNSSEC](https://edgetunnel-b2h.pages.dev/dns/dnssec/multi-signer-dnssec/setup/), where both providers sign the zone during the transition. This requires careful key management but allows you to migrate without disabling DNSSEC. For more information, refer to [Migrate an existing zone with DNSSEC enabled](https://edgetunnel-b2h.pages.dev/dns/dnssec/dnssec-active-migration/). **Disable-and-re-enable approach (safer for most teams):** 1. Log in to your registrar and remove the DS records associated with your on-prem BIND DNSSEC keys for each domain. 2. Plan to switch nameservers only after resolvers are no longer expecting the old DNSSEC chain. \*DS record TTL: If DNSSEC is active, note the Time To Live (TTL) of your DS records at the parent zone (managed by your registrar). This will determine how long you need to wait after removing DS records. As a rule of thumb, wait at least one full DS TTL and preferably up to 1.5 times the TTL before changing nameservers. For more information about DNSSEC on Cloudflare, refer to [DNSSEC](https://edgetunnel-b2h.pages.dev/dns/dnssec/). ## 5\. Choose migration window Select a period of low traffic and activity to minimize potential impact and inform stakeholders of the planned window. ## 6\. Develop communication and rollback plan * Communication: Plan how to communicate with stakeholders before, during, and after the migration. * Rollback Plan: Document steps to revert to your BIND servers if major issues arise. This primarily involves changing nameservers back at the registrar and potentially re-adding old DS records if DNSSEC was involved. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-1/#page","headline":"Phase 1: Planning & Inventory · Cloudflare Learning Paths","description":"Plan and inventory your DNS migration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-07-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/dns-best-practices/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/dns-best-practices/concepts/phase-1/","name":"Phase 1: Planning & Inventory"}}]} ``` --- --- title: Phase 2: Preparation description: Prepare for DNS migration with minimal downtime. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Phase 2: Preparation Careful preparation will minimize downtime and issues during the cutover. ## 1\. Reduce DNS record TTLs (Time To Live) At least 24-48 hours (or longer, ideally matching your longest current TTLs) before your planned migration window, lower the TTLs for all critical records in your BIND zone files. A common short TTL for migration is 300 seconds (5 minutes). This ensures that DNS resolvers worldwide will cache your old records for a shorter period, allowing changes to propagate more quickly when you switch to Cloudflare. * SOA Record: Also consider lowering the `MINIMUM` field in your SOA record, which dictates the TTL to be used for negative responses ([RFC 2308 ↗](https://www.rfc-editor.org/rfc/rfc2308.html#section-4)). ## 2\. Export zone files from BIND Obtain a clean and current export of your zone files from your BIND servers in standard BIND format and ensure these files are complete and accurate. ## 3\. Add domains to Cloudflare 1. Log in to your Cloudflare dashboard. [ Go to **Account home** ](https://dash.cloudflare.com/?to=/:account/home) 2. Add each domain you intend to migrate. Cloudflare will attempt to scan for existing DNS records. ## 4\. Import DNS Records into Cloudflare Use Cloudflare's **Import and Export** feature (under **DNS** \> **Records**) to upload your BIND zone files. [ Go to **Account home** ](https://dash.cloudflare.com/?to=/:account/home) * Verification (Crucial): * After import, meticulously compare the records in Cloudflare with your BIND zone files or a `dig` output of your current zone. * Pay close attention to `MX` records, `SRV` records, `TXT` records (especially for `SPF`, `DKIM`, `DMARC`), and any complex `CNAME` configurations. * Ensure FQDNs (Fully Qualified Domain Names) are correctly formatted (Cloudflare usually handles the trailing dot correctly on import, but verify). * Proxy status (orange vs grey cloud): * For `A`, `AAAA`, and `CNAME` records that point to HTTP or HTTPS services you want to proxy through Cloudflare (for example, websites and APIs), you can enable the orange cloud to use Cloudflare CDN and security features. * Some services and ports are not supported behind the proxy, and certain record types (for example, `MX` targets and many non-HTTP services) must remain **DNS only**. For a detailed list, refer to [Proxy status and limitations](https://edgetunnel-b2h.pages.dev/dns/proxy-status/limitations/). * Recommendation for initial migration: To isolate the DNS migration from potential proxy-related issues, consider setting all records to **DNS only** (grey cloud) initially. After you confirm that DNS resolution is working correctly, enable the proxy (orange cloud) for specific HTTP(S) records and test again. ## 5\. DNSSEC preparation (if currently enabled) Complete this step before you change your nameservers at the registrar. Note For more detailed guidance, refer to [DNSSEC](https://edgetunnel-b2h.pages.dev/dns/dnssec/). If during [Phase 1](https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-1/#4-dnssec-strategy-critical) you have opted for a multi-signer DNSSEC strategy, refer to [Migrate an existing zone with DNSSEC enabled](https://edgetunnel-b2h.pages.dev/dns/dnssec/dnssec-active-migration/). * **Action at registrar:** Log in to your domain registrar and delete the existing DS records associated with your on-prem BIND DNSSEC keys for each domain. * **Wait for DS TTL:** Wait at least the full DS record TTL published at the parent zone, and preferably up to 1.5 times that TTL, before you change nameservers. This ensures that validating resolvers stop expecting the old DNSSEC chain. The typical TTL duration for DS records is set to +24 hours (86,400 seconds). * **Impact of incorrect timing:** If you change nameservers while resolvers still expect the old DS record, DNSSEC validation will fail and your domain may become unreachable for validating resolvers. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-2/#page","headline":"Phase 2: Preparation · Cloudflare Learning Paths","description":"Prepare for DNS migration with minimal downtime.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/dns-best-practices/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/dns-best-practices/concepts/phase-2/","name":"Phase 2: Preparation"}}]} ``` --- --- title: Phase 3: Execution (Migration window) description: Execute the DNS nameserver cutover. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Phase 3: Execution (Migration window) Phase 3 is when you make the actual switch to Cloudflare. ## 1\. Final verification Complete one last check of all DNS records in your Cloudflare dashboard for accuracy and ensure your BIND servers are still operational as a fallback if needed. ## 2\. Update nameservers at your registrar 1. Log in to your domain registrar's control panel for each domain. 2. Navigate to the section for managing nameservers. 3. Replace your current on-prem BIND nameserver entries with your Cloudflare nameservers. 4. Add the Cloudflare nameservers assigned to your domain (Cloudflare will provide at least two). 5. Save the changes. ## 3\. Monitor propagation * DNS nameserver changes can take time to propagate globally, typically anywhere from a few minutes to 48 hours (though often much faster due to lowered TTLs). * Use the commands exemplified below, replacing `yourdomain.com` by your actual domain. * `dig yourdomain.com NS @8.8.8.8` (query Google's DNS) * `dig yourdomain.com NS @1.1.1.1` (query Cloudflare's DNS) * `whois yourdomain.com` * `dig yourdomain.com @tld.nameserver.com` (`tld.nameserver.com` is the nameserver of your domain's TLD. You can find this information by querying it as `dig com ns +short` where `.com` is the example.) You are looking for the Cloudflare nameservers to be reported consistently. ## 4\. Initial testing Once propagation appears to be widespread, perform basic resolution tests for critical records (for example, your website's `A` record and any `MX` records, if you had them set up). * `dig yourdomain.com A +short` * `dig yourdomain.com MX +short` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-3/#page","headline":"Phase 3: Execution (Migration window) · Cloudflare Learning Paths","description":"Execute the DNS nameserver cutover.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-3/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/dns-best-practices/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/dns-best-practices/concepts/phase-3/","name":"Phase 3: Execution (Migration window)"}}]} ``` --- --- title: Phase 4: Post-migration and DNSSEC Re-activation description: Verify and stabilize after DNS migration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Phase 4: Post-migration and DNSSEC Re-activation After the cutover, verify and stabilize. ## 1\. Thorough testing and validation 1. Test all services that rely on DNS: websites, email (sending and receiving), VPNs, APIs, etc. 2. Test from different networks and geographical locations if possible. 3. Monitor application logs for any DNS-related errors. ## 2\. Enable DNSSEC in Cloudflare (if disabled earlier) Enable DNSSEC only after you are confident that DNS is resolving correctly through Cloudflare and that nameserver changes have fully propagated. In practice, plan for at least one full DS TTL after you add new DS records at the registrar. **Action in Cloudflare:** 1. In the Cloudflare dashboard, go to your zone's **DNS Settings**. [ Go to **Settings** ](https://dash.cloudflare.com/?to=/:account/:zone/dns/settings) 2. Select **Enable DNSSEC**. Cloudflare will sign your zone and generate `DNSKEY` and `DS` record details. **Action at registrar:** 1. Log in to your domain registrar. 2. Navigate to the DNSSEC management section for your domain. 3. Add the `DS` record details provided by Cloudflare. After adding the `DS` record, allow time for propagation and then validate your configuration with tools such as [DNSViz ↗](https://dnsviz.net) or [Verisign's DNSSEC debugger ↗](https://dnssec-debugger.verisignlabs.com/). For more information, refer to [DNSSEC](https://edgetunnel-b2h.pages.dev/dns/dnssec/). Note If your domain uses Cloudflare Registrar, some DNSSEC steps can be simplified or automated. Refer to [Enable DNSSEC with Cloudflare Registrar](https://edgetunnel-b2h.pages.dev/registrar/get-started/enable-dnssec/) for registrar-specific instructions. ## 3\. Adjust TTLs in Cloudflare After the migration is stable and DNSSEC is active (if used), increase the TTLs for your DNS records from the short values used during the migration to more standard values (for example, 3600 seconds for frequently changing records or 86400 seconds for very stable records). Higher TTLs improve resolver cache efficiency and can reduce latency by allowing recursive resolvers to reuse cached answers for longer, at the cost of slower propagation when you make changes. ## 4\. Review and enable Cloudflare proxy features If you initially set records to **DNS Only** (grey cloud), now is a good time to enable Cloudflare's proxy (orange cloud) for HTTP/S records (`A`, `AAAA`, `CNAME`) to leverage [CDN](https://edgetunnel-b2h.pages.dev/cache/), [WAF](https://edgetunnel-b2h.pages.dev/waf/), and other security and performance features. Test thoroughly after enabling proxying. ## 5\. Decommission On-Prem BIND servers Only after a significant stabilization period (for example, several days to a week after full propagation and successful testing) and when you are fully confident in the Cloudflare setup, decommission the on-premise BIND servers. Ensure no resolvers are still pointing to the old BIND servers. This is especially important for internal resolvers, if they were not addressed separately. ## 6\. Update internal documentation and monitoring Update all internal IT documentation to reflect the new DNS infrastructure and ensure your monitoring systems are checking DNS resolution via Cloudflare. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-4/#page","headline":"Phase 4: Post-migration and DNSSEC Re-activation · Cloudflare Learning Paths","description":"Verify and stabilize after DNS migration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/phase-4/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-06-30","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/dns-best-practices/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/dns-best-practices/concepts/phase-4/","name":"Phase 4: Post-migration and DNSSEC Re-activation"}}]} ``` --- --- title: Key considerations and best practices summary description: Review DNS migration best practices summary. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Key considerations and best practices summary * Plan meticulously: Do not rush the planning and preparation phases. * Communicate clearly: Keep stakeholders informed. * Lower TTLs in advance: This is crucial for a faster cutover. * Disable DNSSEC before NS change (safest): Remove DS records at the registrar well before changing nameservers, then re-enable DNSSEC via Cloudflare. * Verify, verify, verify: Double-check record imports and functionality at each stage. * Test thoroughly: From multiple locations and for all critical services. * Have a rollback plan: Know how to revert if necessary. * Migrate during low traffic: Minimize potential user impact. * Address BIND Views/ACLs: Understand how Cloudflare will handle or replace this functionality. * Take advantage of Cloudflare features: Once stable, explore and implement Cloudflare's security and performance enhancements. By following these best practices, you can significantly increase the likelihood of a smooth and successful migration from your on-prem BIND DNS to Cloudflare. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/summary-considerations/#page","headline":"Key considerations and best practices summary · Cloudflare Learning Paths","description":"Review DNS migration best practices summary.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/dns-best-practices/concepts/summary-considerations/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/dns-best-practices/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/dns-best-practices/concepts/summary-considerations/","name":"Key considerations and best practices summary"}}]} ``` --- --- title: Overview description: Build real-time apps with Durable Objects. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Overview ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/#page","headline":"Overview · Cloudflare Learning Paths","description":"Build real-time apps with Durable Objects.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}}]} ``` --- --- title: Build the app frontend and UI description: Set up the video call frontend interface. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build the app frontend and UI * [ Watch this episode ](#tab-panel-9911) * [ Series overview ](#tab-panel-9912) In this video, we set up the frontend starter code (the starter code is located in the Veet GitHub repository), connect to Durable Objects using a call room ID, and display a local video preview. **Related content** For additional resources on learning Durable Objects with Cloudflare, refer to the following resources: * [Veet Github repository code ↗](https://github.com/megaconfidence/veet) * [Cloudflare Durable Objects documentation](https://edgetunnel-b2h.pages.dev/durable-objects/) * [Cloudflare TURN service documentation](https://edgetunnel-b2h.pages.dev/realtime/turn/) * [CLI command for creating new Workers and Pages projects](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [Hopscotch.io for local WebSocket testing ↗](https://hoppscotch.io/) * [Sign up for a Cloudflare account ↗](https://dash.cloudflare.com/sign-up) [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/#page","headline":"Build the app frontend and UI · Cloudflare Learning Paths","description":"Set up the video call frontend interface.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/build-the-app-frontend-5/","name":"Build the app frontend and UI"}}]} ``` --- --- title: Deploy your video call app description: Deploy the completed video call application. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Deploy your video call app * [ Watch this episode ](#tab-panel-9913) * [ Series overview ](#tab-panel-9914) We are almost done with the project, and in this final episode, we add the finishing touches, such as learning how to handle call disconnections, wiring up essential media controls like muting/unmuting and video toggling, and integrating a TURN server to ensure reliable connections even behind firewalls. By the end of this video, your app will be fully functional and ready for deployment. **Related content** For additional resources on learning Durable Objects with Cloudflare, refer to the following resources: * [Veet Github repository code ↗](https://github.com/megaconfidence/veet) * [Cloudflare Durable Objects documentation](https://edgetunnel-b2h.pages.dev/durable-objects/) * [Cloudflare TURN service documentation](https://edgetunnel-b2h.pages.dev/realtime/turn/) * [CLI command for creating new Workers and Pages projects](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [Hopscotch.io for local WebSocket testing ↗](https://hoppscotch.io/) * [Sign up for a Cloudflare account ↗](https://dash.cloudflare.com/sign-up) [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/#page","headline":"Deploy your video call app · Cloudflare Learning Paths","description":"Deploy the completed video call application.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/","name":"Deploy your video call app"}}]} ``` --- --- title: Introduction to the series description: Overview of the Durable Objects video series. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Introduction to the series * [ Watch this episode ](#tab-panel-9915) * [ Series overview ](#tab-panel-9916) In this episode, we present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/#page","headline":"Introduction to the series · Cloudflare Learning Paths","description":"Overview of the Durable Objects video series.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/introduction-to-series-1/","name":"Introduction to the series"}}]} ``` --- --- title: Make and answer WebRTC calls description: Implement peer-to-peer WebRTC video calls. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Make and answer WebRTC calls * [ Watch this episode ](#tab-panel-9917) * [ Series overview ](#tab-panel-9918) In this video, we build on the frontend we set up earlier by adding functionality for making and answering WebRTC video calls. You will learn how to create peer-to-peer connections, handle ICE candidates, and seamlessly send and receive video streams between users. **Related content** For additional resources on learning Durable Objects with Cloudflare, refer to the following resources: * [Veet Github repository code ↗](https://github.com/megaconfidence/veet) * [Cloudflare Durable Objects documentation](https://edgetunnel-b2h.pages.dev/durable-objects/) * [Cloudflare TURN service documentation](https://edgetunnel-b2h.pages.dev/realtime/turn/) * [CLI command for creating new Workers and Pages projects](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [Hopscotch.io for local WebSocket testing ↗](https://hoppscotch.io/) * [Sign up for a Cloudflare account ↗](https://dash.cloudflare.com/sign-up) [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/#page","headline":"Make and answer WebRTC calls · Cloudflare Learning Paths","description":"Implement peer-to-peer WebRTC video calls.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/","name":"Make and answer WebRTC calls"}}]} ``` --- --- title: Real-time messaging with WebSockets description: Broadcast real-time messages via WebSockets. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Real-time messaging with WebSockets * [ Watch this episode ](#tab-panel-9919) * [ Series overview ](#tab-panel-9920) Now, we'll take it a step further by enabling our server to receive and broadcast messages. In this video, you'll learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. By the end, you will have completed the backend for our video call app. **Related content** For additional resources on learning Durable Objects with Cloudflare, refer to the following resources: * [Veet Github repository code ↗](https://github.com/megaconfidence/veet) * [Cloudflare Durable Objects documentation](https://edgetunnel-b2h.pages.dev/durable-objects/) * [Cloudflare TURN service documentation](https://edgetunnel-b2h.pages.dev/realtime/turn/) * [CLI command for creating new Workers and Pages projects](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [Hopscotch.io for local WebSocket testing ↗](https://hoppscotch.io/) * [Sign up for a Cloudflare account ↗](https://dash.cloudflare.com/sign-up) [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/#page","headline":"Real-time messaging with WebSockets · Cloudflare Learning Paths","description":"Broadcast real-time messages via WebSockets.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/","name":"Real-time messaging with WebSockets"}}]} ``` --- --- title: Create a serverless websocket 'backend' description: Learn about create a serverless websocket backend in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a serverless websocket 'backend' * [ Watch this episode ](#tab-panel-9921) * [ Series overview ](#tab-panel-9922) In this video, we'll create a WebSocket backend using serverless technology, making the process simpler than ever before. You'll learn how to create your first Durable Object, set up a WebSocket server to coordinate connections, and keep track of connected clients. **Related content** For additional resources on learning Durable Objects with Cloudflare, refer to the following resources: * [Veet Github repository code ↗](https://github.com/megaconfidence/veet) * [Cloudflare Durable Objects documentation](https://edgetunnel-b2h.pages.dev/durable-objects/) * [Cloudflare TURN service documentation](https://edgetunnel-b2h.pages.dev/realtime/turn/) * [CLI command for creating new Workers and Pages projects](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [Hopscotch.io for local WebSocket testing ↗](https://hoppscotch.io/) * [Sign up for a Cloudflare account ↗](https://dash.cloudflare.com/sign-up) [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/#page","headline":"Create a serverless websocket 'backend' · Cloudflare Learning Paths","description":"Learn about create a serverless websocket backend in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/","name":"Create a serverless websocket 'backend'"}}]} ``` --- --- title: What are Durable Objects? description: Learn how Durable Objects provide stateful serverless. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What are Durable Objects? * [ Watch this episode ](#tab-panel-9923) * [ Series overview ](#tab-panel-9924) In this video, we show how Durable Objects work and start building a video call app together. **Related content** For additional resources on learning Durable Objects with Cloudflare, refer to the following resources: * [Veet Github repository code ↗](https://github.com/megaconfidence/veet) * [Cloudflare Durable Objects documentation](https://edgetunnel-b2h.pages.dev/durable-objects/) * [Cloudflare TURN service documentation](https://edgetunnel-b2h.pages.dev/realtime/turn/) * [CLI command for creating new Workers and Pages projects](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [Hopscotch.io for local WebSocket testing ↗](https://hoppscotch.io/) * [Sign up for a Cloudflare account ↗](https://dash.cloudflare.com/sign-up) [ Watch Episode 1: Introduction to the series ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/introduction-to-series-1/) We present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. [ Watch Episode 2: What are Durable Objects? ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/) We show how Durable Objects work and start building a video call app together. [ Watch Episode 3: Create a serverless websocket 'backend' ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/serverless-websocket-backend-3/) We create a WebSocket backend using serverless technology, making the process simpler than ever before. [ Watch Episode 4: Real-time messaging with WebSockets ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4/) We learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. [ Watch Episode 5: Build the app frontend and UI ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/build-the-app-frontend-5/) We configure the frontend starter code, connect to Durable Objects using a call room ID, and display a local video preview. [ Watch Episode 6: Make and answer WebRTC calls ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6/) We expand the frontend functionality by adding functionality for making and answering WebRTC video calls. [ Watch Episode 7: Deploy your video call app ](https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7/) In this final episode, we configure the remaining functionalities. By the end, your app will be fully functional and ready for deployment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/#page","headline":"What are Durable Objects? · Cloudflare Learning Paths","description":"Learn how Durable Objects provide stateful serverless.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/durable-objects-course/series/what-are-durable-objects-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/durable-objects-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/durable-objects-course/series/what-are-durable-objects-2/","name":"What are Durable Objects?"}}]} ``` --- --- title: Appendix description: Monitor and secure generative AI usage. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Appendix ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/appendix/#page","headline":"Appendix · Cloudflare Learning Paths","description":"Monitor and secure generative AI usage.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/appendix/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/appendix/","name":"Appendix"}}]} ``` --- --- title: Use Cloudflare Workers to create custom user coaching pages description: Build custom user coaching pages with Workers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use Cloudflare Workers to create custom user coaching pages Cloudflare Workers are an easy method to stand up custom user coaching pages. The customs status pages can be handled dynamically based on the information that Gateway sends about a blocked request. ## Example **JavaScript** ```js const COMPANY_NAME = "Your Company Inc."; const APPROVED_TOOL_URL = "https://chat.yourcompany.com"; // Your sanctioned AI tool URL const APPROVED_TOOL_NAME = "Corporate AI Assistant"; // The user-friendly name of your tool const IT_HELPDESK_EMAIL = "it-security@yourcompany.com"; // Email for the "report a problem" button const COMPANY_LOGO_URL = "Your_Logo.svg"; // A publicly accessible URL for your company logo. Replace with your own. export default { async fetch(request) { // 1. Get the blocked URL from the query string passed by Gateway. const url = new URL(request.url); const blockedUrlParam = url.searchParams.get("blocked_url"); // Decode and sanitize the blocked URL for display. let blockedHostname = "the requested site"; let fullBlockedUrl = "an unapproved external tool"; if (blockedUrlParam) { try { const decodedUrl = decodeURIComponent(blockedUrlParam); fullBlockedUrl = decodedUrl; blockedHostname = new URL(decodedUrl).hostname; } catch (e) { // If the URL is malformed, use the raw param safely. fullBlockedUrl = blockedUrlParam; blockedHostname = blockedUrlParam; } } // 2. Prepare the "Report a problem" mailto link. const mailtoSubject = `Business Justification for AI Tool: ${blockedHostname}`; const mailtoBody = `Hello IT/Security Team, I was attempting to access the following website and was redirected to this coaching page: ${fullBlockedUrl} My business justification for needing this specific tool is: [**Please describe your business need here**] Thank you, [Your Name]`; const mailtoLink = `mailto:${IT_HELPDESK_EMAIL}?subject=${encodeURIComponent(mailtoSubject)}&body=${encodeURIComponent(mailtoBody)}`; // 3. Generate the full HTML page. const html = generateHTML(blockedHostname, mailtoLink); // 4. Return the HTML as a response. return new Response(html, { headers: { "Content-Type": "text/html;charset=UTF-8", }, }); }, }; /** * Generates the full HTML for the coaching page. * @param {string} blockedHostname - The hostname of the site the user tried to access. * @param {string} mailtoLink - The pre-built mailto link for reporting an issue. * @returns {string} - The complete HTML document as a string. */ function generateHTML(blockedHostname, mailtoLink) { // Using a template literal for easy-to-read HTML with embedded variables. return ` AI Tool Usage Policy
${COMPANY_LOGO_URL}" alt="${COMPANY_NAME} Logo" class="logo">

Access to this AI Tool is Restricted

You were redirected to this page because your attempt to access ${blockedHostname} was blocked by our company's security policy.

To protect our company's confidential data, intellectual property, and customer information, we must ensure that AI tools are used responsibly. Unapproved tools may pose risks related to data privacy, security, and licensing.

We encourage you to use our officially approved and secure solution, the ${APPROVED_TOOL_NAME}, for your business needs.

${mailtoLink}" class="button button-secondary">Report a Problem ${APPROVED_TOOL_URL}" class="button button-primary">Use Approved Tool
`; } ``` If successful, your custom user coaching page will look like the image below. It will appear anytime a user attempts to access an unapproved AI tool. ![Example of a custom coaching page utilizing the code example above.](https://edgetunnel-b2h.pages.dev/_astro/custom-coaching-page.BN8XQVn6_ZKoGWg.webp) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/appendix/workers-create-custom-coaching-pages/#page","headline":"Use Cloudflare Workers to create custom user coaching pages · Cloudflare Learning Paths","description":"Build custom user coaching pages with Workers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/appendix/workers-create-custom-coaching-pages/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/appendix/","name":"Appendix"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/appendix/workers-create-custom-coaching-pages/","name":"Use Cloudflare Workers to create custom user coaching pages"}}]} ``` --- --- title: Build security policies for general AI use description: Monitor and secure generative AI usage. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build security policies for general AI use Once your monitoring tools have given you a clear picture of AI usage in your organization, you can begin building security policies to meet your objectives. The Gateway policy builder offers extensive options for both application categorization and function granularity to help you create policies that achieve your goals. You should build security policies based on the perceived risk level, potential for data leaks, and your organization's confidence in a tool. For instance, if you approved Google Gemini for your corporate use, you may apply different policies to it than you would to other AI applications. This section will detail the types of policies Cloudflare recommends for securing AI tools in your organization. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/build-security-policies/#page","headline":"Build security policies for general AI use · Cloudflare Learning Paths","description":"Monitor and secure generative AI usage.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/build-security-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/build-security-policies/","name":"Build security policies for general AI use"}}]} ``` --- --- title: Set policy based on approval status description: Create Gateway policies for AI tool governance. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Set policy based on approval status If you use specific AI tools within your organization, you may want to create policies to explicitly allow the usage of those tools while continuing to evaluate additional usage within your organization. ## Create a Gateway policy for monitoring and evaluating all AI tool usage 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **HTTP** tab, select **Add a policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow for AI at your organization. | Selector | Operator | Value | | ----------- | -------- | ------------------------- | | Application | in | _Artificial Intelligence_ | 5. For **Action**, select **Allow**. 6. Select **Create policy**. For more information, refer to [Block unauthorized applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/common-policies/#block-unauthorized-applications). ## Create a Gateway policy to redirect users towards approved AI tools Conversely, you can build policies that take specific actions based on an AI tool's approval status. For example, if you want to redirect users from unapproved applications to approved applications, you can create custom status pages to provide user coaching. User coaching is a valuable tool for encouraging employees to change their behavior. By redirecting users to a status page, you can help them understand the risks of using unsanctioned AI tools and educate them on the dangers of inputting sensitive data. Cloudflare Workers are an easy method to stand up custom user coaching pages. The customs status pages can be handled dynamically based on the information that Gateway sends about a blocked request. In the appendix of this document, you can find sample code for a Cloudflare Worker built for this purpose that you can test and adopt if desired. ## Redirect users towards approved AI tools 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **HTTP** tab, select **Add a policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow for AI at your organization. | Selector | Operator | Value | | ----------- | -------- | ------------------------- | | Application | in | _Artificial Intelligence_ | 5. For **Action**, select **Block**. 6. To **Modify the Gateway block behavior**, determine how you want to redirect your users. * Redirect users to a custom block page to coach the user: 1. Select **Use account-level block setting**. 2. Check **Add an additional message to your custom block page when traffic matches** this policy and enter your custom message. * Redirect users to an approved AI tool automatically: 1. Select **Override account setting with URL redirect**. 2. Enter the URL to the approved application you want to redirect the user to use instead. 7. Select **Create policy**. For more information, refer to [Configure policy block behavior](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#configure-policy-block-behavior). ## Capture prompts to prevent data loss You can build policies that enable Prompt Capture for AI applications in specific, complex scenarios. This gives you the flexibility to apply advanced functionality to certain applications, tool types, or user groups, such as contractors or new employees, especially if they pose a higher risk for using unsanctioned applications due to lack of awareness or training. 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **HTTP** tab, select **Add a policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow for AI at your organization. | Selector | Operator | Value | | ----------- | -------- | ------------------------- | | Application | in | _Artificial Intelligence_ | 5. Under **Identity**, build a logical express that defines the user identity you want to capture and log their prompts to review for data loss prevention. | Selector | Operator | API Value | | ----------- | -------- | ----------------------------------------------------------------------- | | Application | in | any(identity.groups.name\[\*\] in {\\"contractors\\" \\"cohort-224\\"}) | 6. For **Action**, select **Allow**. 7. Select **Create policy**. ## Configure Gateway to use ChatGPT workspace header If your organization uses [ChatGPT Business ↗](https://chatgpt.com/business/), you can configure a Gateway policy to enforce the use of your organization's workspace ID, ensuring all traffic to ChatGPT is correctly associated with your account. This will implement Gateway [tenant control](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tenant-control/), which lets you manage how users interact with specific applications. To create this policy, you will add a custom HTTP header to your Gateway policy. This header, `Chatgpt-Allowed-Workspace-Id`, ensures that only requests with your organization's unique workspace ID are permitted. 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **HTTP** tab, select **Add a policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow. | Selector | Operator | Value | | ----------- | -------- | --------- | | Application | in | _ChatGPT_ | 5. In **Action**, choose _Allow_. 6. In **Untrusted certificate action**, choose _Block_. 7. Under **Add headers to matched requests**, select **Add a header**. 8. Add the following values to each field: * **Custom header name**: `Chatgpt-Allowed-Workspace-Id` * **Custom header value**: Your organization's workspace ID 9. Select **Create policy**. For more information, refer to the [OpenAI documentation ↗](https://help.openai.com/articles/8798594-what-is-a-workspace-how-do-i-access-my-chatgpt-business-workspace). ## Order your policies for specific inspection and enforcement In most scenarios, Gateway evaluates HTTP policies in [top-down order](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/). Therefore, you can capture prompts in specific scenarios to gain visibility without disrupting your users' work, all while holistically protecting against sensitive data loss. For example, if you want to prevent sensitive data being shared with AI but want to allow all users to use AI but capture the prompts for specific identity-defined user groups, you would need to order your policies in the following way. 1. The policy that blocks sensitive data being shared would need to be ordered first in this policy group. This will allow it to be enforced before the next policy in the policy group. | Operator | Selector | Operator | Value | Action | | -------- | ----------- | -------- | ------------------------- | ------ | | | Application | in | _Artificial Intelligence_ | | | And | DLP Profile | in | _my-sensitive-data_ | Block | 2. Next, create the policy that allows the use of AI and specifies the prompt capture for specific user groups. | Selector | Operator | Value | | ----------- | -------- | ------------------------- | | Application | in | _Artificial Intelligence_ | 3. Under **Traffic**: | Selector | Operator | Value | | ----------- | -------- | ------------------------- | | Application | in | _Artificial Intelligence_ | 4. Under **Identity**: | Selector | Operator | API Value | Action | | ---------------- | -------- | ----------------------------------------------------------------------- | ------ | | User Group Names | in | any(identity.groups.name\[\*\] in {\\"contractors\\" \\"cohort-224\\"}) | Allow | By structuring your policies in this way, you ensure that any instance of sensitive data is blocked from AI applications, no matter which user group is involved. If Cloudflare does not detect sensitive data, it will allow the prompt while capturing it for the targeted user groups – in this case, users belonging to the `contractors` and `cohort-224` groups. If that same user group were to then use sensitive data in a prompt, it would be detected and blocked. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/build-security-policies/set-policy-approval/#page","headline":"Set policy based on approval status · Cloudflare Learning Paths","description":"Create Gateway policies for AI tool governance.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/build-security-policies/set-policy-approval/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/build-security-policies/","name":"Build security policies for general AI use"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/build-security-policies/set-policy-approval/","name":"Set policy based on approval status"}}]} ``` --- --- title: Concepts description: Monitor and secure generative AI usage. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts The goal of this learning path is to provide Cloudflare One users with the strategy and tools to securely adopt generative AI within their organizations. This guide will help address new security challenges and mitigate risks like shadow AI and data loss. ## Objectives * Determine risk tolerance: Identify areas of concern and risk tolerance for AI use to establish a baseline for your organization's AI security strategy. * Monitor AI usage: Utilize Cloudflare One's tools, such as the Shadow IT dashboard and API CASB integrations, to gain visibility into both sanctioned and unsanctioned AI application usage. * Build security policies: Create granular security policies using Cloudflare Gateway to control AI usage, prevent data loss with DLP, and manage user behavior through actions like blocking or redirecting. * Secure sanctioned models: Apply Zero Trust principles to sanctioned AI models and internal services like Model Context Protocol (MCP) servers to ensure secure access and protect sensitive data from being exposed. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Monitor and secure generative AI usage.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/","name":"Concepts"}}]} ``` --- --- title: What is Model Context Protocol (MCP)? description: Learn how MCP connects AI agents to data. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Model Context Protocol (MCP)? [Model Context Protocol (MCP) ↗](https://www.cloudflare.com/learning/ai/what-is-model-context-protocol-mcp/) is a standardized way for AI agents to get the information and tools they need to operate. Similar to how an API works, it is a protocol that allows AI programs to connect to external sources of information and take actions in the real world, going beyond the limits of their original training data. ## How does MCP work? MCP uses a client-server architecture where an AI agent acts as the client and sends requests to a server. This allows the AI agent to connect to multiple servers at once to get the information it needs. An MCP server is a program that exposes capabilities to AI agents, giving them access to new datasets or tools — like an email service to send messages on behalf of a user. ## What are the security concerns with MCP? MCP doesn't have native authentication, authorization, or encryption. Because it functions similarly to an API, many of the same security considerations apply. If developers do not proactively implement security measures like Transport Layer Security (TLS) and rate limiting, MCP servers can be vulnerable to attacks, data leaks, and unauthorized access. Organizations must ensure that they validate inputs and protect confidential data to secure their MCP implementations. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/mcp/#page","headline":"What is Model Context Protocol (MCP)? · Cloudflare Learning Paths","description":"Learn how MCP connects AI agents to data.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/mcp/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"},"keywords":["MCP"]} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/mcp/","name":"What is Model Context Protocol (MCP)?"}}]} ``` --- --- title: What is Shadow AI? description: Understand unauthorized AI tool usage risks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Shadow AI? Shadow AI is the use of any AI tool or application by employees without the formal approval or oversight of the IT department. A common example is an employee using a generative AI application like ChatGPT to draft a report or analyze data, unknowingly exposing the company to significant risks. While employees often turn to these tools to increase productivity, their use can lead to major issues with data security, compliance, and even a company's reputation. For IT and security leaders, the key to managing these risks is to create a robust AI strategy that includes clear policies and governance. ## Manage the risks of shadow AI Since it may not be feasible to eliminate all instances of shadow AI, organizations can manage the risks by taking a balanced approach. First, it is essential to foster collaboration and open communication between IT and other departments to understand why employees are using these tools. Next, implement guardrails by developing a flexible governance framework with clear guidelines on which types of AI systems can be used and how sensitive information should be handled. Finally, monitor AI usage with network tools to track what is being used and educate employees on the risks of unauthorized AI. To combat the risks associated with shadow AI, Cloudflare's API-driven CASB integrates with SaaS applications and cloud environments to scan for misconfigurations, unauthorized user activity, shadow IT, and other data security issues that can occur after a user has successfully logged in. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/shadow-ai/#page","headline":"What is Shadow AI? · Cloudflare Learning Paths","description":"Understand unauthorized AI tool usage risks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/shadow-ai/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/shadow-ai/","name":"What is Shadow AI?"}}]} ``` --- --- title: What is Shadow IT? description: Understand unauthorized IT usage risks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Shadow IT? Shadow IT is the use of IT hardware, software, or services by employees or departments without the knowledge or approval of the company's IT and security teams. This can include anything from cloud services and apps to hardware, like personal laptops or servers. The biggest driver of shadow IT today is the widespread adoption of cloud services, especially software-as-a-service (SaaS). Employees are accustomed to downloading and using apps to boost productivity, but this behavior often bypasses traditional IT oversight, creating a significant security blind spot. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/shadow-it/#page","headline":"What is Shadow IT? · Cloudflare Learning Paths","description":"Understand unauthorized IT usage risks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/concepts/shadow-it/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/concepts/shadow-it/","name":"What is Shadow IT?"}}]} ``` --- --- title: Get started description: Monitor and secure generative AI usage. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Get started Businesses are eager to realize the potential boosts to productivity and efficiency promised by Generative AI. But with AI adoption, comes new security challenges. LLMs, chatbots, and institutional adoption of GenAI are quickly reshaping the landscape for data and user security. IT and security leaders are often asked to address risks and deal with increasing challenges like the use of shadow AI before they have an AI security strategy. Cloudflare One offers a diverse, comprehensive set of solutions to secure your applications, workforce, and data from emerging generative AI threats. This learning path will provide a path to securely adopt AI use cases within your organization. It includes recommendations and strategies to monitor AI usage, protect against shadow AI, safeguard your sensitive data, and manage Model Context Protocol (MCP) servers effectively. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/get-started/#page","headline":"Get started · Cloudflare Learning Paths","description":"Monitor and secure generative AI usage.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/get-started/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/get-started/","name":"Get started"}}]} ``` --- --- title: Additional setup for AI security solutions in Zero Trust description: Complete additional Zero Trust setup for AI security. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Additional setup for AI security solutions in Zero Trust To use the recommended AI security solutions in this learning path, you will need to complete some additional setup for your Zero Trust deployment, such as turning on [Shadow IT Discovery](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/shadow-it-discovery/#turn-on-shadow-it-discovery). Note If you are new to securing your Internet traffic, refer to [Secure your Internet traffic and SaaS apps](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/concepts/) to get started and then return to this learning path to continue securing your organizations. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/get-started/additional-setup/#page","headline":"Additional setup for AI security solutions in Zero Trust · Cloudflare Learning Paths","description":"Complete additional Zero Trust setup for AI security.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/get-started/additional-setup/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/get-started/","name":"Get started"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/get-started/additional-setup/","name":"Additional setup for AI security solutions in Zero Trust"}}]} ``` --- --- title: Define your company's AI risk tolerance and strategy description: Set AI security goals and risk boundaries. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Define your company's AI risk tolerance and strategy Before you can secure AI, you need to understand your organization's goals and concerns for your users and data. This first step is crucial for anyone new to AI security because it helps you align on your overall risk tolerance for generative AI. The level of risk you are willing to accept will determine how quickly you need to act and how deeply you need to implement security measures. Your specific concerns will then guide the exact security approaches you take to monitor and control AI usage. To begin, consider these questions to help shape your strategy: * Sanctioned versus shadow AI: Are your employees already using approved AI services, or are you primarily concerned with shadow AI — unapproved applications that may pose a risk? Note: Some approved vendors may offer embedded AI functionality. Consider whether those AI services are a risk, too. * Data sensitivity: What types of sensitive data do you currently monitor, classify, and protect? This will help you identify what you need to safeguard when employees interact with AI. If you have not determined this yet, refer to [Define your sensitive data](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/data-loss-prevention/#define-your-sensitive-data) to learn more. * Encouraging user behavior: Do you want to encourage or limit user engagement with AI? How much do you expect your employees to use AI in a controlled, sanctioned way? ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/get-started/define-ai-risk-tolerance/#page","headline":"Define your company's AI risk tolerance and strategy · Cloudflare Learning Paths","description":"Set AI security goals and risk boundaries.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/get-started/define-ai-risk-tolerance/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-06-05","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/get-started/","name":"Get started"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/get-started/define-ai-risk-tolerance/","name":"Define your company's AI risk tolerance and strategy"}}]} ``` --- --- title: Monitor AI usage at your organization description: Monitor and secure generative AI usage. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Monitor AI usage at your organization Monitoring AI usage is one of the first steps in assessing holistic risk. Cloudflare provides a number of ways to understand both sanctioned and unsanctioned use of AI and chat applications within your Zero Trust deployment. Reviewing your detected usage should give you a sense of which AI apps are used in your organization as well as what type of policies you need to create based on what should be supported versus restricted. After you begin to understand your organization's AI usage, you should develop a balanced perspective on what constitutes sanctioned use of a tool. A good practice is to review applications in phases and then apply security policies based on those phases. For example, you can apply different security policies to applications that are considered approved, unapproved, unreviewed, or in review until they pass your corporate security standards and data privacy reviews. This section will detail options for assessing and understanding that risk by using inline (client) and out-of-band (API CASB) based methods. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/#page","headline":"Monitor AI usage at your organization · Cloudflare Learning Paths","description":"Monitor and secure generative AI usage.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/","name":"Monitor AI usage at your organization"}}]} ``` --- --- title: Monitor prompts and responses description: Inspect AI prompts using TLS decryption. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Monitor prompts and responses When you enable [TLS decryption](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/#turn-on-tls-decryption), you can review the prompts and responses for supported AI applications. This allows you to understand three key things about AI application usage: * The sanctioned and unsanctioned AI tools your users are engaging with. * How they are interacting with them. * What information they are sharing. ![Log entry for a prompt detected using AI prompt protection.](https://edgetunnel-b2h.pages.dev/_astro/gateway-prompt-log.CZ61RAFw_lrWfS.webp) You can use this in conjunction with [DLP profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/) to detect sensitive data potentially being used in prompts, with or without explicitly blocking the action. You can use DLP to log AI prompt topics by turning on [Capture generative AI prompt content in logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#turn-on-ai-prompt-content-logging-for-a-dlp-policy) for the policy. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/monitor-prompts-responses/#page","headline":"Monitor prompts and responses · Cloudflare Learning Paths","description":"Inspect AI prompts using TLS decryption.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/monitor-prompts-responses/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/","name":"Monitor AI usage at your organization"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/monitor-prompts-responses/","name":"Monitor prompts and responses"}}]} ``` --- --- title: Review inline AI use description: Monitor AI application usage via Shadow IT. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Review inline AI use To review how your organization uses AI apps, start with the Cloudflare [Shadow IT dashboard](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/shadow-it-discovery/). You can filter the dashboard by application type and sort by Artificial Intelligence, which allows you to take several valuable actions, such as: * Reviewing application usage: See which applications your users are engaging with and how often, based on traffic from connected devices or sites. * Accessing application details: Learn more about the applications in use by reviewing their entries in the App Library. * Designating application status: Use a [status marker](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/shadow-it-discovery/#approval-status) to categorize applications, so you can apply specific security policies to them. ![Shadow IT dashboard showing utilization of application statuses \(Approved, Unapproved, In Review, Unreviewed\).](https://edgetunnel-b2h.pages.dev/_astro/shadowit-dashboard-ai-apps.Dbzn4dka_Z277Qkf.webp) This approach is most relevant for applications that your organization has not yet sanctioned. For example, if your business uses Google Workspace and its primary AI tool is Gemini, you would likely mark Gemini as _Approved_. While you can configure more specific data loss policies later, you can also target approved applications with greater specificity to detect risks unique to your organization. ![The App Library filtered to show some of the supported Artificial Intelligence applications.](https://edgetunnel-b2h.pages.dev/_astro/ai-app-type-app-library.C5AB815M_Z2MW3F.webp) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/review-inline-ai-use/#page","headline":"Review inline AI use · Cloudflare Learning Paths","description":"Monitor AI application usage via Shadow IT.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/review-inline-ai-use/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/","name":"Monitor AI usage at your organization"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/review-inline-ai-use/","name":"Review inline AI use"}}]} ``` --- --- title: Review out-of-band AI use description: Detect AI usage with CASB integrations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Review out-of-band AI use If your organization does not use the Cloudflare device client, or does not proxy HTTP traffic, you can still get valuable data about shadow AI usage if you use the [Google Workspace](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/google-workspace/), [Microsoft 365](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/microsoft-365/), or [GitHub](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/github/) integrations for the Cloudflare Cloud Access Security Broker (CASB). The CASB provides detailed information about your SaaS environment, including changes to sensitive data, content, and application settings. It works even if your users do not have the Cloudflare device client installed. By using CASB integrations with your core Single Sign-On (SSO) provider, you can see if users have authenticated to any third-party applications. This offers a clear, non-invasive way to understand tool usage across your organization without needing to deploy a client. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/review-out-of-band-ai/#page","headline":"Review out-of-band AI use · Cloudflare Learning Paths","description":"Detect AI usage with CASB integrations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/monitor-ai-use/review-out-of-band-ai/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/","name":"Monitor AI usage at your organization"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/holistic-ai-security/monitor-ai-use/review-out-of-band-ai/","name":"Review out-of-band AI use"}}]} ``` --- --- title: Secure approved AI models and tools description: Monitor and secure generative AI usage. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Secure approved AI models and tools ## Manage posture and use within trusted AI tools As you decide which AI tools to sanction within your organization, you can develop security controls with the expectation of consistent use. Cloudflare supports API-based cloud access security broker (CASB) integrations with popular AI services like [OpenAI (ChatGPT)](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/openai/), [Anthropic (Claude)](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/anthropic/), and [Google Gemini](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/google-workspace/gemini/). These integrations allow you to report on AI tool usage and flag sensitive data with Data Loss Prevention (DLP) Profiles. Since these integrations are out-of-bound connections to SaaS applications, they do not require inline user traffic to create detections. This means you can immediately gain visibility into how your employees are using sanctioned AI tools without having to install the Cloudflare device client on every user's machine. ![OpenAI API CASB Integration showing riskier features that are toggled on, security posture risks like unused admin credentials, and an uploaded attachment with a DLP profile match.](https://edgetunnel-b2h.pages.dev/_astro/casb-posture-findings-openai.BuSWwM-8_1IPO5K.webp) ## Manage findings from your CASB integrations [CASB](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/) **Posture Findings** allow you to report on misconfigurations, unauthorized user activity, and other data security issues. You can use it to get insights into issues like: * Misconfigured sharing settings: See who in your organization has access to your tenant. * API key management: Ensure you are following best practices. * Anomalous and suspicious activity: Detect things like pending invites and file uploads. By combining this with DLP profiles, you can report on data exposure within an AI tool without capturing and decrypting inline user traffic. For example, you can detect sensitive data or specific patterns (regex) within user prompts. For more information, refer to [Scan for sensitive data](https://edgetunnel-b2h.pages.dev/cloudflare-one/cloud-and-saas-findings/casb-dlp/). ## Secure access to MCP servers for your organization The Model Context Protocol (MCP) is an emerging standard that allows AI agents to communicate with both public and private APIs. An MCP server acts as a translation layer, which enables these AI agents to understand datasets, perform actions, and develop context beyond their original training. Cloudflare has been an early supporter of the MCP standard. Many of our customers are already building custom MCP servers and use cases, and our engineering teams have worked to deliver MCP functionality for our public API. You can review our [changelog](https://edgetunnel-b2h.pages.dev/changelog/product-group/ai/) to see some of the MCP servers we have already released. Just like an API, an MCP server is a primary entry point for AI agents to interact with and manipulate your structured data. Since anyone can build and host an MCP server, it is crucial to have a comprehensive secure access strategy as your business starts to adopt these new agentic workflows. As with any new technology, it can be difficult to manage the growing use of MCP servers among your employees. This space will continue to expand, but your first step should always be to gain visibility and understand usage before developing a security strategy to control inputs and outputs. This section will discuss the process of consolidating and securing access to your internal MCP servers, while introducing logging for user prompts. ### Use Cloudflare Access as your OAuth provider The Model Context Protocol supports [OAuth 2.1 for authorization ↗](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization). You can configure your MCP server to use Cloudflare Access as its OAuth provider. This allows you to secure the MCP server with Access policies, using signals from your existing identity providers (IdPs), device posture providers, and other rules to control who can log in to the server. Once the user is authenticated through Access, Access passes an OAuth ID token to the MCP server. You can then implement server-side access controls based on the user identity attributes included in the token. For example, you may wish to limit access to specific tools based on user emails. To set up the Cloudflare Access OAuth integration, refer to [Secure MCP servers with Access for SaaS](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/secure-mcp-servers/). ### Consolidate MCP servers into a portal MCP server portals allow you to centralize management of your MCP servers and tools. An MCP server portal is added as an Access application on one of your Cloudflare domains. Users log in to the configured portal URL (for example, `https://./mcp`) from an MCP client and gain access to all MCP servers in the portal that they are allowed to access. MCP server portals support both unauthenticated MCP servers and MCP servers secured with any OAuth provider. We recommend using [Cloudflare Access as your server's OAuth provider](#use-cloudflare-access-as-your-oauth-provider) if you want the full security benefits of Cloudflare Access on top of the ergonomic benefits provided by MCP portals. To define user access to your systems, you can configure Access policies for a portal as a whole while maintaining granular access control for the MCP servers that a user sees in their portals. Additionally, you can turn on or off the individual tools available through the portal and only expose the tools relevant for your specific use case. Prompts and responses made using the portal are logged in Cloudflare Access, providing you with visibility into how users are interacting with your MCP servers. To get started with MCP server portals, refer to [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/secure-approved-ai-models-tools/#page","headline":"Secure approved AI models and tools · Cloudflare Learning Paths","description":"Monitor and secure generative AI usage.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/holistic-ai-security/secure-approved-ai-models-tools/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/holistic-ai-security/secure-approved-ai-models-tools/","name":"Secure approved AI models and tools"}}]} ``` --- --- title: Concepts description: Distribute traffic across servers with load balancing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Learn the concepts behind load balancing, whether you are using Cloudflare or another provider. ## Objectives By the end of this module, you will be able to: * Explain what load balancing is. * Describe the differences between load balancers, pools, and servers. * Explain what pool health is and how it affects load balancer traffic. * List the different ways your traffic can be routed. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Distribute traffic across servers with load balancing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/concepts/","name":"Concepts"}}]} ``` --- --- title: Monitors and health checks description: Monitor server health with periodic health checks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Monitors and health checks There's more to a load balancer than just distributing traffic, however. After all, what good would it be if your load balancer and pools send a request to a server that's offline? Or one that's already overloaded with traffic? Ideally, your load balancer should only forward requests that a server can take care of. That's where another part of the load balancing equation comes in: monitors and health checks. flowchart RL accTitle: Load balancing monitor flow accDescr: Monitors issue health monitor requests, which validate the current status of servers within each pool. Monitor -- Health Monitor ----> Endpoint2 Endpoint2 -- Response ----> Monitor subgraph Pool Endpoint1((Endpoint 1)) Endpoint2((Endpoint 2)) end ## How it works A monitor issues health checks periodically to evaluate the health of each server within a pool. Requests issued by a monitor at regular interval and — depending on the monitor settings — return a **pass** or **fail** value to make sure an endpoint is still able to receive traffic. Each health monitor request is trying to answer two questions: 1. **Is the endpoint offline?**: Does the endpoint respond to the health monitor request at all? If so, does it respond quickly enough (as specified in the monitor's **Timeout** field)? 2. **Is the endpoint working as expected?**: Does the endpoint respond with the expected HTTP response codes? Does it include specific information in the response body? If the answer to either of these questions is "No", then the endpoint fails the health monitor request. This system of request and response ensures that a load balancer knows which servers can handle incoming requests. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/health-checks/#page","headline":"Monitors and health checks · Cloudflare Learning Paths","description":"Monitor server health with periodic health checks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/health-checks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/concepts/health-checks/","name":"Monitors and health checks"}}]} ``` --- --- title: Components of a load balancer description: Understand pools, endpoints, and load balancers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Components of a load balancer At it's most basic, load balancing is made up of three components: * **Pools**: Which contain one or more endpoints. * **Endpoints**: Which respond to individual requests. * **A load balancer**: Which decides which traffic goes to each pool. ## How it works Normally, requests to your application would go to individual servers directly. With a load balancer, requests first go through the load balancer. Your load balancer then routes requests to specific pools. flowchart LR accTitle: Load balancing flow accDescr: Load balancing involves a load balancer, pools, endpoints, monitors, and health monitors. B[Request 1] --> A C[Request 2] --> A D[Request 3] --> A A[Load balancer] -- Request 1 --> P1 A -- Request 2 --> P2 A -- Request 3 --> P3 subgraph P1 [Pool 1] Endpoint1((Endpoint 1)) Endpoint2((Endpoint 2)) end subgraph P2 [Pool 2] Endpoint3((Endpoint 3)) Endpoint4((Endpoint 4)) end subgraph P3 [Pool 3] Endpoint5((Endpoint 5)) Endpoint6((Endpoint 6)) end Within each pool, requests then go to individual endpoints. And that endpoint is what responds to the request. flowchart LR accTitle: Pool traffic flow accDescr: When an incoming request reaches a pool, it then goes to an endpoint within the pool. A[Request 1] --Routed by pool--> Endpoint2 subgraph P1 [Pool] Endpoint1((Endpoint 1)) Endpoint2((Endpoint 2)) end This progression of load balancer --> pool --> endpoint is the core part of how a load balancer works. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/load-balancer-components/#page","headline":"Components of a load balancer · Cloudflare Learning Paths","description":"Understand pools, endpoints, and load balancers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/load-balancer-components/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/concepts/load-balancer-components/","name":"Components of a load balancer"}}]} ``` --- --- title: What is load balancing? description: Distribute traffic across multiple servers efficiently. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is load balancing? On the Internet, load balancing is where you spread traffic across many servers. This process reduces the strain on each server, making it more efficient and faster to respond to requests. ## How it works Imagine a checkout line at the grocery store. If only one register is open, the line is going to be long and move slowly. Additionally, the employee at the register is going to be stressed. They have a lot of work to do, likely without any breaks and with increasingly frustrated customers. As the store manager, you could solve the problem by opening more checkout lines. Customers can spread out to different lines and move faster. And your employees can do their job without as much stress. Much in the same way, a load balancer distributes traffic across many servers. Without load balancing, too many requests might hit the same server and make it work too hard. ![Too much traffic can overload one of your servers](https://edgetunnel-b2h.pages.dev/_astro/without-load-balancing-diagram.CA4vGt0s_Z1ng0lJ.webp) A load balancer spreads requests across your servers, which prevents any one server from working too hard. Load balancing also makes your servers more efficient and lets them respond faster to incoming requests. ![A load balancer distributes traffic across your servers](https://edgetunnel-b2h.pages.dev/_astro/with-load-balancing-diagram.J1vO69li_1zwJ7g.webp) ## Related resources For more background information on load balancers, refer to our [Learning Center ↗](https://www.cloudflare.com/learning/performance/what-is-load-balancing/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/load-balancing/#page","headline":"What is load balancing? · Cloudflare Learning Paths","description":"Distribute traffic across multiple servers efficiently.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/load-balancing/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/concepts/load-balancing/","name":"What is load balancing?"}}]} ``` --- --- title: Routing traffic description: Control how traffic routes to pools and servers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Routing traffic Before, we covered how requests move from load balancers to pools and then from pools to individual servers. What we did not mention, however, was _how_ the load balancer and pools make those decisions. This is a concept known as routing. ## How it works Generally, there are five questions involved with routing: 1. By default, how does the load balancer distribute requests to pools? 2. By default, how do pools distribute requests to individual servers? 3. Within a pool, which servers are healthy? 4. Within a load balancer, which pools are healthy? 5. Are there any specialized routing rules? ### Distributing requests to pools A load balancer's [traffic steering policy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/) controls how the load balancer distributes requests to pools. Routing decisions can be based on proximity, pool performance, geography, and more. ### Distributing requests within pools Once the request reaches a pool, that pool's [endpoint steering policy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/origin-level-steering/) controls how each pool distributes requests to the servers in the pool. These decisions can be based on default percentages of traffic sent to individual servers (also known as the **Weight**), aspects of the request (such as source IP address), or both. ### Endpoint health If an endpoint fails a health check - which would mark it as unhealthy - its pool will adjust routing according to its endpoint steering policy. Both new and existing requests will go to healthy endpoints in the pool, ignoring the unhealthy endpoint. ### Pool health With enough unhealthy endpoints, the pool itself may be considered unhealthy as well. When a pool reaches **Critical** health, your load balancer will begin diverting traffic according to its [Traffic steering policy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/): * **Off**: * If the active pool becomes unhealthy, traffic goes to the next pool in order. * If an inactive pool becomes unhealthy, traffic continues to go to the active pool (but would skip over the unhealthy pool in the failover order). * **All other methods**: Traffic is distributed across all remaining pools according to the traffic steering policy. #### Fallback pools Often, load balancers have a special pool known as the **Fallback Pool**, which receives traffic no matter what. This pool is meant to be the pool of last resort, meaning that its health is not taken into account when directing traffic. Fallback pools are important because traffic still might be coming to your load balancer even when all the pools are unreachable (disabled or unhealthy). Your load balancer needs somewhere to route this traffic, so it will send it to the fallback pool. ### Specialized routing Finally, specific settings can also affect the ways a load balancer distributes traffic, such as: * Routing based on [specific aspects](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-balancing-rules/) of the request. * Sending all requests from a [specific end user](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/) to the same server, preserving information about their user session like items in a shopping cart. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/routing/#page","headline":"Routing traffic · Cloudflare Learning Paths","description":"Control how traffic routes to pools and servers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/concepts/routing/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/concepts/routing/","name":"Routing traffic"}}]} ``` --- --- title: Planning your load balancer description: Distribute traffic across servers with load balancing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Planning your load balancer Explore the configuration choices available for your Cloudflare load balancer. ## Objectives By the end of this module, you will be able to: * Describe the difference between load balancing at different layers of the network stack. * Identify when a load balancer should utilize session affinity. * Describe the different policies for endpoint steering and traffic steering. * List the different options available to monitor server health. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/#page","headline":"Planning your load balancer · Cloudflare Learning Paths","description":"Distribute traffic across servers with load balancing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}}]} ``` --- --- title: Custom load balancing rules description: Learn about custom load balancing rules in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Custom load balancing rules Custom load balancing rules let you customize the behavior of your load balancer based on the characteristics of a request. For example, you can use URL-based routing, or create a rule that selects a pool based on the URI path of an HTTP request. For more details, refer to [Custom load balancing rules](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-balancing-rules/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/custom-rules/#page","headline":"Custom load balancing rules · Cloudflare Learning Paths","description":"Learn about custom load balancing rules in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/custom-rules/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/planning/custom-rules/","name":"Custom load balancing rules"}}]} ``` --- --- title: Account-level load balancing description: Learn about account-level load balancing in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Account-level load balancing If you want to set up load balancing for multiple hostnames or domains within your account, your approach would depend on the requirements for each hostname. ## Shared configurations If you want to share a load balancing configuration across multiple hostnames, you can use the same load balancer through `CNAME` routing. 1. When you [set up](https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/) the load balancer, create the load balancer on a new hostname (`lb.example.com`). 2. When you are ready to [route production traffic](https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/production-traffic/), [create](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/how-to/create-dns-records/#create-dns-records) a `CNAME` record on a hostname that points to the load balancer created in step 1 (`lb.example.com`). 3. Repeat steps 1 and 2 with all other hostnames. Note You could also achieve the same goal or create more advanced routing decisions by setting up DNS Overrides within [Origin Rules](https://edgetunnel-b2h.pages.dev/rules/origin-rules/) on each hostname that override the hostname to `lb.example.com`. ## Unique configurations If each zone needs unique load balancer configurations (failover order, routing), you should create separate load balancers. Since pools and monitors are configured at the account level, even different load balancers can share the same pools and monitors. For simpler routing, create a load balancer on each hostname. For more advanced routing, create multiple load balancers and then set up [Origin Rules](https://edgetunnel-b2h.pages.dev/rules/origin-rules/) to route traffic to each load balancer based on specific characteristics of the request. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/multiple-zones/#page","headline":"Account-level load balancing · Cloudflare Learning Paths","description":"Learn about account-level load balancing in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/multiple-zones/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/planning/multiple-zones/","name":"Account-level load balancing"}}]} ``` --- --- title: Endpoint steering policies description: Configure how pools distribute requests to servers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Endpoint steering policies Endpoint steering customizes how each [pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/) distributes requests to its associated endpoints. These distributions are a combination of two properties: * The endpoint steering [policy](#policies) chosen for your pool. * The [weights](#weights) assigned to each endpoint. Note If an endpoint [becomes unhealthy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/health-details/), your pool will also re-balance traffic according to its endpoint steering policy. --- ## Policies When you [create a pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/create-pool/), you have to choose an option for **Endpoint Steering**. --- ## Weights The weight assigned to an endpoint controls the percentage of pool traffic sent to that endpoint. By default, all endpoints within a pool have a weight of **1**. If you leave each endpoint with the default setting and choose a **Random** endpoint steering policy, each endpoint will receive the same percentage of traffic. If you use a **Hash** policy, that percentage will vary based on the IP distribution of your requests. ### Customize weights To customize weights when you [create or edit a pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/create-pool/), set the **Weight** to a number between 0 and 1 (expressed in increments of .01). Cloudflare will then send traffic to that pool based on a combination of your endpoint steering policy and the following formula. ```txt % of traffic to endpoint = endpoint weight ÷ sum of all weights in the pool ``` Endpoint weight example Here’s an example applying weights to three endpoints with a **Random** endpoint steering policy: * **Weights:** Endpoint A = 0.25; Endpoint B = 0.25; Endpoint C = 0.50 * **When all endpoints are healthy**, each endpoint will receive the following proportion of total traffic: A = 25%; B = 25%; C = 50%. * **When one endpoint is unhealthy** (such as endpoint C), each healthy endpoint will receive the following proportion of total traffic: A = 50%; B=50%. A significant amount of traffic is required for the distribution to converge on the expected values. An endpoint with a weight of **0** should not receive any traffic sent to that pool (though the endpoint will still receive health monitor requests). You can also see this value in the **Percent** field when creating or editing a pool in the dashboard. Note: If an endpoint is used in multiple pools and has multiple weights assigned, the total traffic sent to that pool will differ from the percentage specified in each individual pool. ### Limitations If you choose **Hash** for your **Endpoint Steering** or enable [session affinity](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/), these options can affect traffic distribution. Additionally, session affinity takes precedence over any selected weight or endpoint steering policy. When using [DNS-only load balancing](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/proxy-modes/#dns-only-load-balancing), DNS resolvers may cache resolved IPs for clients and affect traffic distribution. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/origin-steering-policies/#page","headline":"Endpoint steering policies · Cloudflare Learning Paths","description":"Configure how pools distribute requests to servers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/origin-steering-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/planning/origin-steering-policies/","name":"Endpoint steering policies"}}]} ``` --- --- title: Server and pool health description: Customize server and pool health thresholds. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Server and pool health As discussed before, a monitor issues health checks periodically to evaluate the health of each server within a pool. flowchart RL accTitle: Load balancing monitor flow accDescr: Monitors issue health monitor requests, which validate the current status of servers within each pool. Monitor -- Health Monitor ----> Endpoint2 Endpoint2 -- Response ----> Monitor subgraph Pool Endpoint1((Endpoint 1)) Endpoint2((Endpoint 2)) end Requests issued by a monitor at regular interval and — depending on the monitor settings — return a **pass** or **fail** value to make sure an endpoint is still able to receive traffic. Each health monitor request is trying to answer two questions: 1. **Is the endpoint offline?**: Does the endpoint respond to the health monitor request at all? If so, does it respond quickly enough (as specified in the monitor's **Timeout** field)? 2. **Is the endpoint working as expected?**: Does the endpoint respond with the expected HTTP response codes? Does it include specific information in the response body? If the answer to either of these questions is "No", then the endpoint fails the health monitor request. --- ## Customizations Based on the characteristics of your server pools, you have several customization options that affect how and whether a server is considered unhealthy. ### Pool-level settings #### Health threshold The Health Threshold is the number of healthy endpoints for the pool as a whole to be considered _Healthy_ and receive traffic based on pool order in a load balancer. Increasing this number makes the pool more reliable, but also more likely to become unhealthy. #### Health monitor regions For each option selected in a pool's **Health Monitor Regions**, Cloudflare sends health monitor requests from three separate data centers in that region. ![Health monitor requests come from three data centers within each selected region.](https://edgetunnel-b2h.pages.dev/_astro/health-check-component.wo0_f7k-_Z1C61Ll.webp) If the majority of data centers for that region pass the health monitor requests, that region is considered healthy. If the majority of regions is healthy, then the endpoint itself will be considered healthy. ##### Configurations **All Data Centers (Enterprise only)** Health monitor probes are sent from every single data center in Cloudflare’s network to the endpoints within the associated pool. This allows probes to hit each endpoint during intervals set by the customer. **All Regions (Enterprise only)** Three health monitor probes per region are sent to each endpoint in the associated pool. There are a total of 13 regions, resulting in 39 probes. **Regional** Three health monitor probes are sent from each specified region within the pool configuration. Warning Because of how Cloudflare checks health from [multiple regions](#health-monitor-regions), adding multiple regions — or choosing to check health from **All Data Centers** — can send a lot of traffic to your endpoint. The same problem can occur when setting low values for a monitor's **Interval**. --- ### Monitor-level settings When you [create a monitor](https://edgetunnel-b2h.pages.dev/load-balancing/monitors/create-monitor/), there are several configuration settings you can adjust based on the characteristics of the attached pools: Basic settings * **Type**: The protocol to use for health monitors * _Non-enterprise customers_: Choose **HTTP**, **HTTPS**, or **TCP**. * _Enterprise customers_: Choose **HTTP**, **HTTPS**, **TCP**, **UDP ICMP**, **ICMP Ping**, or **SMTP**. * **Path**: The endpoint path to run health monitor requests against * **Port**: The destination port for health monitors Advanced settings * **Interval**: * By increasing the default, you can improve failover time, but you may also increase load on your endpoints. * Minimum time in seconds is 60 (Pro), 15 (Business), and 10 (Enterprise). * **Timeout** and **Retries**: * The health monitor request will return unhealthy if it exceeds the duration specified in **Timeout** (and exceeds this duration more times than the specified number of **Retries**). * **Expected Code(s)**: The expected HTTP response codes listed individually (`200`, `302`) or as a range (for example, entering `2xx` would cover all response codes in the `200` range). * **Response Body**: * Looks for a case-insensitive substring in the response body. * Make sure that the value is relatively static and within the first 10 KB of the HTML page. * **Simulate Zone**: * It is recommended to use the same zone in which the Load Balancer exists. * Changes the egress zone settings of a health monitor request to ensure compatibility with features like [Authenticated Origin Pulls (mTLS)](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/), [Argo Smart Routing](https://edgetunnel-b2h.pages.dev/argo-smart-routing/), [Bring your own CA (mTLS)](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/), [Dedicated CDN Egress IPs](https://edgetunnel-b2h.pages.dev/smart-shield/configuration/dedicated-egress-ips/), and [HTTP/2 to Origin](https://edgetunnel-b2h.pages.dev/speed/optimization/protocol/http2-to-origin/). * **Follow Redirects**: * Instead of reporting a `301` or `302` code as unhealthy, the health monitor request follows redirects to the final endpoint. * **Configure Request Header(s)**: * Useful if your endpoints are expecting specific incoming headers. * **Header**: * The HTTP request headers to send in the health monitor. It is recommended that you set a Host header by default. The User-Agent header cannot be overridden. This parameter is only valid for HTTP and HTTPS monitors. Note To increase confidence in pool status, you can also increase the `consecutive_up` and `consecutive_down` fields when [creating a monitor with the API](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/subresources/monitors/methods/create/). To become healthy or unhealthy, monitored endpoints must pass this health monitor request the consecutive number of times specified in these parameters. --- ### Fallback pool You also need to decide which of the associated pools in a load balancer should be the fallback pool. This pool is meant to be the pool of last resort, meaning that its health is not taken into account when directing traffic. Fallback pools are important because traffic still might be coming to your load balancer even when all the pools are unreachable (disabled or unhealthy). Your load balancer needs somewhere to route this traffic, so it will send it to the fallback pool. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/server-pool-health/#page","headline":"Server and pool health · Cloudflare Learning Paths","description":"Customize server and pool health thresholds.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/server-pool-health/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/planning/server-pool-health/","name":"Server and pool health"}}]} ``` --- --- title: Session affinity description: Maintain user sessions on the same server. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Session affinity When you enable session affinity, your load balancer directs all requests from a particular end user to a specific endpoint. This continuity preserves information about the user session — such as items in their shopping cart — that might otherwise be lost if requests were spread out among multiple servers. Session affinity can also help reduce network requests, leading to savings for customers with usage-based billing. Note Session Affinity is only supported by Public Load Balancers. ## How it works Session affinity automatically directs requests from the same client to the same endpoint: 1. When a client makes its first request, Cloudflare sets a `__cflb` cookie on the client (to track the associated endpoint). 2. Subsequent requests by the same client are forwarded to that endpoint for the duration of the cookie and as long as the endpoint remains healthy. 3. If the cookie expires or the endpoint becomes unhealthy, Cloudflare sets a new cookie tracking the new failover endpoint. flowchart LR accTitle: Session affinity process accDescr: Session affinity directs requests from the same client to the same server. A[Client] --Request--> B{__cflb cookie set?} B -->|Yes| C[Route to previous endpoint] C --> O2 B ---->|No| E[Follow normal routing] E --> O2 E --Set __cflb cookie--> A subgraph P1 [Pool 1] O1[Endpoint 1] O2[Endpoint 2] end All cookie-based sessions default to 23 hours unless you set a custom session _Time to live_ (TTL). The session cookie is secure when [Always Use HTTPS](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/additional-options/always-use-https/) is enabled. Additionally, HttpOnly is always enabled for the cookie to prevent cross-site scripting attacks. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/session-affinity/#page","headline":"Session affinity · Cloudflare Learning Paths","description":"Maintain user sessions on the same server.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/session-affinity/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/planning/session-affinity/","name":"Session affinity"}}]} ``` --- --- title: Types of load balancers description: Compare Layer 7, DNS-only, and Layer 4 balancing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Types of load balancers With Cloudflare, you can choose between three types of load balancers: * [Layer 7 (HTTP/HTTPS)](#layer-7-load-balancing) (most common) * [DNS-only](#dns-only-load-balancing) * [Layer 4 (TCP)](#layer-4-load-balancing) --- ## Layer 7 load balancing Layer 7 load balancers direct traffic to specific endpoints based on information present in each HTTP/HTTPS request (HTTP headers, URI, cookies, type of data, etc.). When a client visits your application, Cloudflare directs their request to a healthy endpoint (determined by your [traffic steering policy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/) and [endpoint weights](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/origin-level-steering/#weights)). Cloudflare performs layer 7 load balancing when traffic to your hostname is **proxied** through Cloudflare. In the **Load Balancing** dashboard, these load balancers are marked with an orange cloud. ![DNS-only load balancers are marked with an orange cloud](https://edgetunnel-b2h.pages.dev/_astro/proxied-load-balancer.BMq3VCyA_1BeaMW.webp) Note that if a [DNS-only (grey cloud)](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) CNAME record points to a proxied load balancer, the IP returned for it would be endpoint IP and a HTTP request sent to it would not be proxied. ### Benefits In comparison to DNS-only load balancing, layer 7 load balancing: * Protects endpoints from DDoS attacks by hiding their IP addresses. * Offers faster failover and more accurate routing, which can otherwise be affected by DNS caching. * Integrates with other Cloudflare features such as caching, Workers, and the WAF. * Reduces authoritative queries against Cloudflare, which can potentially save money for customers with usage-based billing. * Supports customized [session affinity](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/) and [endpoint drain](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/#endpoint-drain). * More accurately geo-locates traffic, using the data center associated with the user making the request instead of the data center associated with a user's recursive resolver. * Supports private IP addresses with [Private Network Load Balancing](https://edgetunnel-b2h.pages.dev/load-balancing/private-network/). --- ## DNS-only load balancing DNS-only load balancers route traffic by returning specific IP addresses in response to a client's DNS query. When a client visits your application, Cloudflare provides the address for a healthy endpoint (determined by your [traffic steering policy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/) and [endpoint-level steering policy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/origin-level-steering/)). However, Cloudflare relies on DNS resolvers respecting the short TTL to re-query Cloudflare's DNS for an updated list of healthy addresses. If a client has a cached DNS response, they will go to their previous destination, potentially ignoring your load balancer. Cloudflare performs DNS-only load balancing when traffic to your hostname is **not proxied** through Cloudflare. In the **Load Balancing** dashboard, these load balancers are marked with a gray cloud. ![DNS-only load balancers are marked with a gray cloud](https://edgetunnel-b2h.pages.dev/_astro/dns-only-load-balancer.DI9EgD6m_1nkQpb.webp) Note Note that if a load balancer endpoint is a [proxied (orange-cloud)](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) CNAME record on Cloudflare, the IP returned for it would be Cloudflare's and a HTTP request sent to it would be proxied accordingly. ### Benefits If your load balancer is attached to a hostname used for an [MX or SRV record](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/additional-dns-records/) — and not an `A`, `AAAA`, or `CNAME` record — its proxy mode should be **DNS-only**. ### Limitations In comparison to proxied, layer 7 load balancing, DNS-only load balancing: * Does not hide the IP addresses of your endpoints, leaving them vulnerable to DDoS attacks. * Performs slower failover and less accurate routing, because it has to rely on DNS resolvers and cache settings. * Cannot integrate with other Cloudflare features such as caching, Workers, and the WAF. * Increases authoritative queries against Cloudflare, which can potentially cost more for customers with usage-based billing. * Does not support [session affinity](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/). Alternatively, you can use [DNS persistence](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/dns-persistence/). * Geo-locates traffic based on the data center associated with the ECS source address, if available. If not available, geo-locates based on a user's recursive resolver, which can sometimes cause issues with [latency-based steering](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/dynamic-steering/). * Does not support [Private Network Load Balancing](https://edgetunnel-b2h.pages.dev/load-balancing/private-network/). --- ## Layer 4 load balancing Layer 4 load balancers route traffic by forwarding traffic to certain ports or IP addresses. Cloudflare currently only supports layer 4 load balancing as part of [Cloudflare Spectrum](https://edgetunnel-b2h.pages.dev/spectrum/about/load-balancer/). Note Since Spectrum operates at the TCP level, it does not have the information to support features like [session affinity](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/), [custom rules](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-balancing-rules/), or caching. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/types-load-balancers/#page","headline":"Types of load balancers · Cloudflare Learning Paths","description":"Compare Layer 7, DNS-only, and Layer 4 balancing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/planning/types-load-balancers/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/planning/","name":"Planning your load balancer"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/planning/types-load-balancers/","name":"Types of load balancers"}}]} ``` --- --- title: Setup description: Distribute traffic across servers with load balancing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Setup Create a load balancer that monitors endpoint health and intelligently routes traffic. ## Objectives By the end of this module, you will be able to: * Configure a monitor and health checks. * Create a pool. * Create a load balancer. * Analyze traffic patterns. ## Prerequisites * Multiple endpoints, either physical or cloud-based. * Access to Load Balancing, available as an [add-on](https://edgetunnel-b2h.pages.dev/load-balancing/get-started/enable-load-balancing/) for any type of account. * Two hostnames, one for test traffic and the other for production traffic. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/#page","headline":"Setup · Cloudflare Learning Paths","description":"Distribute traffic across servers with load balancing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}}]} ``` --- --- title: Check pool health description: Verify pool and server health status. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Check pool health Before directing any traffic to your pools, make sure that your pools and monitors are set up correctly. The status of your health check will be _unknown_ until the results of the first check are available. * [ Dashboard ](#tab-panel-9925) * [ API ](#tab-panel-9926) To confirm pool health using the dashboard: 1. Go to **Load Balancing**. 2. Select the **Pools** tab. 3. For pools and individual endpoints, review the values in the **Health** and **Endpoint Health** columns. For more information on pool and endpoint health statuses, refer to [How a pool becomes unhealthy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/health-details/#how-a-pool-becomes-unhealthy). To fetch the latest health status of all pools, use the [List Pools](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/subresources/pools/methods/list/) command, paying attention to the `healthy` value for pools and origins (endpoints). For troubleshooting a specific pool's health, use the [Pool Health Details](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/subresources/pools/subresources/health/methods/get/) command. ## Unexpected health status If you notice that healthy pools are being marked unhealthy: * Review [how endpoints and pools become unhealthy](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/health-details/). * Refer to the [Troubleshooting section](https://edgetunnel-b2h.pages.dev/load-balancing/troubleshooting/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/check-pool-health/#page","headline":"Check pool health · Cloudflare Learning Paths","description":"Verify pool and server health status.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/check-pool-health/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/check-pool-health/","name":"Check pool health"}}]} ``` --- --- title: Create monitor description: Learn about create monitor in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create monitor Instead of starting on your production domain, you likely should create a load balancer on a test or staging domain. This may involve temporary changes to your monitors and pools, depending on your infrastructure setup. Starting with a test domain allows you to verify everything is working correctly before routing production traffic. * [ Dashboard ](#tab-panel-9927) * [ API ](#tab-panel-9928) **Set up the monitor** You can create a monitor within the [load balancer workflow](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/create-load-balancer/) or in the **Monitors** tab: 1. Go to **Load Balancing**. 2. Select the **Monitors** tab. 3. Select **Create monitor**. 4. Add the following information: * **Type**: The protocol to use for health monitors * _Non-enterprise customers_: Choose **HTTP**, **HTTPS**, or **TCP**. * _Enterprise customers_: Choose **HTTP**, **HTTPS**, **TCP**, **UDP ICMP**, **ICMP Ping**, or **SMTP**. * **Path**: The endpoint path to run health monitor requests against * **Port**: The destination port for health monitors 5. For additional settings, select **Advanced health monitor settings**: * **Interval**: * By increasing the default, you can improve failover time, but you may also increase load on your endpoints. * Minimum time in seconds is 60 (Pro), 15 (Business), and 10 (Enterprise). * **Timeout** and **Retries**: * The health monitor request will return unhealthy if it exceeds the duration specified in **Timeout** (and exceeds this duration more times than the specified number of **Retries**). * **Expected Code(s)**: The expected HTTP response codes listed individually (`200`, `302`) or as a range (for example, entering `2xx` would cover all response codes in the `200` range). * **Response Body**: * Looks for a case-insensitive substring in the response body. * Make sure that the value is relatively static and within the first 10 KB of the HTML page. * **Simulate Zone**: * It is recommended to use the same zone in which the Load Balancer exists. * Changes the egress zone settings of a health monitor request to ensure compatibility with features like [Authenticated Origin Pulls (mTLS)](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/), [Argo Smart Routing](https://edgetunnel-b2h.pages.dev/argo-smart-routing/), [Bring your own CA (mTLS)](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/), [Dedicated CDN Egress IPs](https://edgetunnel-b2h.pages.dev/smart-shield/configuration/dedicated-egress-ips/), and [HTTP/2 to Origin](https://edgetunnel-b2h.pages.dev/speed/optimization/protocol/http2-to-origin/). * **Follow Redirects**: * Instead of reporting a `301` or `302` code as unhealthy, the health monitor request follows redirects to the final endpoint. * **Configure Request Header(s)**: * Useful if your endpoints are expecting specific incoming headers. * **Header**: * The HTTP request headers to send in the health monitor. It is recommended that you set a Host header by default. The User-Agent header cannot be overridden. This parameter is only valid for HTTP and HTTPS monitors. 6. Select **Save**. Note To increase confidence in pool status, you can also increase the `consecutive_up` and `consecutive_down` fields when [creating a monitor with the API](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/subresources/monitors/methods/create/). To become healthy or unhealthy, monitored endpoints must pass this health monitor request the consecutive number of times specified in these parameters. **Prepare your servers** Make sure that your firewall or web server does not block or rate limit your configured health monitors or requests associated with [Cloudflare IP addresses ↗](https://www.cloudflare.com/ips). Each health monitor has the HTTP user-agent of `"Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/; pool-id: $poolid)"`, where the `$poolid` is the first 16 characters of the [associated pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/). Warning If you know that your endpoint is healthy but Load Balancing is reporting it as unhealthy, refer to our [Monitor troubleshooting guide](https://edgetunnel-b2h.pages.dev/load-balancing/troubleshooting/load-balancing-faq/#why-is-my-endpoint-or-pool-considered-unhealthy). **Set up the monitor** For a full list of monitor properties, refer to [Create Monitor](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/subresources/monitors/methods/create/). If you need help with API authentication, refer to [Cloudflare API documentation](https://edgetunnel-b2h.pages.dev/fundamentals/api/). Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Load Balancing: Monitors and Pools Write` **Create Monitor** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/load_balancers/monitors" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "type": "https", "description": "Login page monitor", "method": "GET", "path": "/health", "header": { "Host": [ "example.com" ], "X-App-ID": [ "abc123" ] }, "port": 8080, "timeout": 3, "retries": 0, "interval": 90, "expected_body": "alive", "expected_codes": "2xx", "follow_redirects": true, "allow_insecure": true, "consecutive_up": 3, "consecutive_down": 2, "probe_zone": "example.com" }' ``` The response contains the complete definition of the new monitor. **Response** ```json { "success": true, "errors": [], "messages": [], "result": { "id": ":monitor-id", "created_on": "2021-01-01T05:20:00.12345Z", "modified_on": "2021-01-01T05:20:00.12345Z", "type": "https", "description": "Login page monitor", "method": "GET", "path": "/health", "header": { "Host": [ "example.com" ], "X-App-ID": [ "abc123" ] }, "port": 8080, "timeout": 3, "retries": 0, "interval": 90, "expected_body": "alive", "expected_codes": "2xx", "follow_redirects": true, "allow_insecure": true, "consecutive_up": 3, "consecutive_down": 2, "probe_zone": "example.com" } } ``` **Prepare your servers** Make sure that your firewall or web server does not block or rate limit your configured health monitors or requests associated with [Cloudflare IP addresses ↗](https://www.cloudflare.com/ips). Each health monitor has the HTTP user-agent of `"Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/; pool-id: $poolid)"`, where the `$poolid` is the first 16 characters of the [associated pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/). Warning If you know that your endpoint is healthy but Load Balancing is reporting it as unhealthy, refer to our [Monitor troubleshooting guide](https://edgetunnel-b2h.pages.dev/load-balancing/troubleshooting/load-balancing-faq/#why-is-my-endpoint-or-pool-considered-unhealthy). Example monitor configuration | Field | Value | | ---------------- | --------- | | Type | HTTP | | Path | / | | Port | 80 | | Interval | 60 | | Method | GET | | Timeout | 5 seconds | | Retries | 2 | | Expected Code(s) | 200 | ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/create-monitor/#page","headline":"Create monitor · Cloudflare Learning Paths","description":"Learn about create monitor in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/create-monitor/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/create-monitor/","name":"Create monitor"}}]} ``` --- --- title: Create pools description: Create server pools for load balancing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create pools Instead of starting on your production domain, you likely should create a load balancer on a test or staging domain. This may involve temporary changes to your monitors and pools, depending on your infrastructure setup. Starting with a test domain allows you to verify everything is working correctly before routing production traffic. * [ Dashboard ](#tab-panel-9929) * [ API ](#tab-panel-9930) You can create a pool within the [load balancer workflow](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/create-load-balancer/) or in the **Pools** tab: 1. Go to **Load Balancing**. 2. Select the **Pools** tab and then **Create pool**. 3. For your pool, enter the following information: * A name (must be unique) * A description to provide more detail on the name * A choice for [**Endpoint Steering**](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/origin-level-steering/), which affects how your pool routes traffic to each endpoint 4. For each endpoint, enter the following information: * A name (must be unique) * The endpoint address or associated hostname * (Optional) A [**Virtual Network**](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/). Required when the endpoint has a private IP address. * A [**Weight**](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/origin-level-steering/#weights) * (Optional) A [hostname](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/override-http-host-headers/) by clicking **Add host header** * (Optional) The destination port to which the traffic will be served. Note If your endpoint is a website or application hosted on [Cloudflare Pages](https://edgetunnel-b2h.pages.dev/pages/), you will need to fill in the host header field with the project domain for it to resolve correctly. 1. Repeat this process for additional endpoints in the pool. 2. (Optional) Set up coordinates for [Proximity Steering](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/proximity-steering/) on the pool. 3. On the pool, update the following information: * **Health Threshold**: The Health Threshold is the number of healthy endpoints for the pool as a whole to be considered _Healthy_ and receive traffic based on pool order in a load balancer. Increasing this number makes the pool more reliable, but also more likely to become unhealthy. * **Monitor**: Attach a [monitor](https://edgetunnel-b2h.pages.dev/load-balancing/monitors/create-monitor/) * **Health Monitor Regions**: Choose whether to check pool health from [multiple locations](https://edgetunnel-b2h.pages.dev/load-balancing/monitors/#health-monitor-regions), which increases accuracy but can lead to probe traffic to your endpoint * **Pool Notifications**: You can set up new alerts - and view existing alerts - to be notified when pools are enabled or disabled, or pools or endpoints have changes in their [health status](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/health-details/). 4. When finished, select **Save**. For a full list of properties, refer to [Create Pool](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/subresources/pools/methods/create/). If you need help with API authentication, refer to [Cloudflare API documentation](https://edgetunnel-b2h.pages.dev/fundamentals/api/). Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Load Balancing: Monitors and Pools Write` **Create Pool** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/load_balancers/pools" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "description": "Primary data center - Provider XYZ", "name": "primary-dc-1", "enabled": false, "load_shedding": { "default_percent": 0, "default_policy": "random", "session_percent": 0, "session_policy": "hash" }, "minimum_origins": 2, "monitor": "f1aba936b94213e5b8dca0c0dbf1f9cc", "check_regions": [ "WEU", "ENAM" ], "origins": [ { "name": "app-server-1", "address": "0.0.0.0", "enabled": true, "weight": 0.56, "header": { "Host": [ "example.com" ] } } ], "origin_steering": { "policy": "random" }, "notification_filter": { "origin": { "disable": false, "healthy": null }, "pool": { "disable": false, "healthy": null } } }' ``` The response contains the complete definition of the new pool. **Response** ```json { "success": true, "errors": [], "messages": [], "result": { "id": "17b5962d775c646f3f9725cbc7a53df4", "created_on": "2021-01-01T05:20:00.12345Z", "modified_on": "2021-01-01T05:20:00.12345Z", "description": "Primary data center - Provider XYZ", "name": "primary-dc-1", "enabled": false, "load_shedding": { "default_percent": 0, "default_policy": "random", "session_percent": 0, "session_policy": "hash" }, "minimum_origins": 2, "monitor": "f1aba936b94213e5b8dca0c0dbf1f9cc", "check_regions": [ "WEU", "ENAM" ], "origins": [ { "name": "app-server-1", "address": "0.0.0.0", "enabled": true, "weight": 0.56, "header": { "Host": [ "example.com" ] } } ], "origin_steering": { "policy": "random" }, "notification_filter": { "origin": { "disable": false, "healthy": null }, "pool": { "disable": false, "healthy": null } } } } ``` After creating the pool, you would also want to [create a new notification](https://edgetunnel-b2h.pages.dev/api/resources/alerting/subresources/policies/methods/create/) with the following parameters specified: ```json "alert_type": "load_balancing_health_alert", "filters": { "pool_id": <>, "new_health": <> ["Unhealthy", "Healthy"], "event_source": <> ["pool", "origin"] } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/create-pools/#page","headline":"Create pools · Cloudflare Learning Paths","description":"Create server pools for load balancing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/create-pools/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/create-pools/","name":"Create pools"}}]} ``` --- --- title: Hostname preparation description: Prepare hostnames for load balancer setup. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Hostname preparation Before setting up anything related to your load balancer, make sure you test that production hostnames meet the following criteria: * Based on the [priority order](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/dns-records/#priority-order) of DNS records, they will receive the intended amount of traffic. * Each hostname is covered by an [SSL/TLS certificate](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/dns-records/#ssltls-coverage). After confirming each of these conditions are met, you can proceed with setting up your load balancer. ## Routing strategy Depending on your preferences and infrastructure, you might route traffic to your load balancer in different ways: * For most customers, it's simpler to create the load balancer on the hostname directly (`www.example.com`). * However, you could also create the load balancer on another hostname (`lb.example.com`) and then route traffic using a `CNAME` record on `test.example.com` that points to `lb.example.com`. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/hostname-preparation/#page","headline":"Hostname preparation · Cloudflare Learning Paths","description":"Prepare hostnames for load balancer setup.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/hostname-preparation/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/hostname-preparation/","name":"Hostname preparation"}}]} ``` --- --- title: Next steps description: Explore advanced load balancing configurations. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Next steps Your load balancer should be receiving production traffic (and you can confirm this by reviewing the [analytics](https://edgetunnel-b2h.pages.dev/load-balancing/reference/load-balancing-analytics/)). Though your product is officially set up, you may want to consider the following suggestions. ## Usage-based notifications Since this is a service with [usage-based billing](https://edgetunnel-b2h.pages.dev/billing/understand/usage-based-billing/), Cloudflare recommends that you set up usage-based billing notifications to avoid unexpected bills. To set up those notifications: 1. In the Cloudflare dashboard, go to the **Notifications** page. [ Go to **Notifications** ](https://dash.cloudflare.com/?to=/:account/notifications) 2. On **Alert Type** of **Usage Based Billing**, click **Select**. 3. Fill out the following information: * **Name** * **Product** * **Notification limit** (exact metric will vary based on product) * **Notification email** Note Some plans also have access to alerts through [PagerDuty](https://edgetunnel-b2h.pages.dev/notifications/get-started/configure-pagerduty/) and [Webhooks](https://edgetunnel-b2h.pages.dev/notifications/get-started/configure-webhooks/). 4. Select **Save**. ## Additional configuration options You may want to further customize how your load balancer routes traffic or integrate your load balancer with other Cloudflare products: * [ Additional DNS records ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/additional-dns-records/) * [ Cloudflare Tunnel (published applications) ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/cloudflare-tunnel/) * [ Spectrum ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/spectrum/) * [ Perform planned maintenance ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/planned-maintenance/) * [ Load shedding ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-shedding/) * [ DNS persistence ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/dns-persistence/) * [ Load Balancing with the China Network ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-balancing-china/) * [ Override HTTP Host headers ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/override-http-host-headers/) * [ Custom load balancing rules ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-balancing-rules/) * [ Integrate with PagerDuty ](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/pagerduty-integration/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/next-steps/#page","headline":"Next steps · Cloudflare Learning Paths","description":"Explore advanced load balancing configurations.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/next-steps/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/next-steps/","name":"Next steps"}}]} ``` --- --- title: Route production traffic description: Learn about route production traffic in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Route production traffic Now that you have set up your load balancer and verified everything is working correctly, you can put the load balancer on a live domain or subdomain: 1. If you update your pools and monitors, review the pool health again to make sure everything is working as expected. 2. Confirm that your production hostname has the correct [priority order](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/dns-records/#priority-order) of DNS records and is covered by an [SSL/TLS certificate](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/dns-records/#ssltls-coverage). 3. Configure your load balancer to receive production traffic, which could involve either: * Editing the **Hostname** of your existing load balancer. * Updating the `CNAME` record sending traffic to your load balancer. Note If you have an Enterprise account, also evaluate your application for any excluded paths. For example, you might not want the load balancer to distribute requests directed at your `/admin` path. For any exceptions, set up an [origin rule](https://edgetunnel-b2h.pages.dev/rules/origin-rules/features/#dns-record). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/production-traffic/#page","headline":"Route production traffic · Cloudflare Learning Paths","description":"Learn about route production traffic in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/production-traffic/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/production-traffic/","name":"Route production traffic"}}]} ``` --- --- title: Create load balancer on test domain description: Learn about create load balancer on test domain in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create load balancer on test domain Instead of starting on your production domain, you likely should create a load balancer on a test or staging domain. This may involve temporary changes to your monitors and pools, depending on your infrastructure setup. Starting with a test domain allows you to verify everything is working correctly before routing production traffic. ## Create a load balancer * [ Dashboard ](#tab-panel-9931) * [ API ](#tab-panel-9932) To create a Public or a Private load balancer in the dashboard: ### Create a Public load balancer 1. Go to **Load Balancing** and select **Create load balancer**. 2. On the **Load Balancer Setup**, select **Public load balancer** 3. Choose the website to which you want to add this load balancer. 4. On the **Hostname** page: * Enter a **Hostname**, which is the DNS name at which the load balancer is available. For more details on record priority, refer to [DNS records for load balancing](https://edgetunnel-b2h.pages.dev/load-balancing/load-balancers/dns-records/). * From the **Data Localization** dropdown, select the [region](https://edgetunnel-b2h.pages.dev/data-localization/how-to/load-balancing/#regional-services) you would like to use on your domain. * Toggle the orange cloud icon to update the [proxy mode](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/proxy-modes/), which affects how traffic is routed and which IP addresses are advertised. * Add a description for your load balancer. * If you want [session-based load balancing](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/session-affinity/), toggle the **Session Affinity** switch. * If you want [Adaptive Routing](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/adaptive-routing/), toggle the **Adaptive Routing** switch. 5. Select **Next**. 6. On the **Add a Pool** page: * Select one or more existing pools or [create a new pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/create-pool/#create-a-pool). * If you are going to set [traffic steering](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/standard-options/) to **Off**, re-order the pools in your load balancer to adjust the fallback order. * If needed, update the [**Fallback Pool**](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/health-details/#fallback-pools). * If you choose to set traffic steering to **Random**, you can set [Weights](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/standard-options/#random-steering) (via the API) to your pools to determine the percentage of traffic sent to each pool. 7. Select **Next**. 8. On the **Monitors** page: * Review the monitors attached to your pools. * If needed, you can attach an existing monitor or [create a new monitor](https://edgetunnel-b2h.pages.dev/load-balancing/monitors/create-monitor/#create-a-monitor). 9. Select **Next**. 10. On the **Traffic Steering** page, choose an option for [Traffic steering](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/) and select **Next**. 11. On the **Custom Rules** page, select an existing rule or [create a new rule](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/load-balancing-rules/). 12. Select **Next**. 13. On the **Review** page: * Review your configuration and make any changes. * Choose whether to **Save as Draft** or **Save and Deploy**. ### Create a Private load balancer 1. Go to **Load Balancing** and select **Create load balancer**. 2. On the **Load Balancer Setup**, select **Private load balancer** 3. Associate your load balancer with either a Cloudflare private IP or a specified IP address and create a description for your load balancer. 4. On the **Add a Pool** page: * Select one or more existing pools or [create a new pool](https://edgetunnel-b2h.pages.dev/load-balancing/pools/create-pool/#create-a-pool). * If you are going to set [traffic steering](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/standard-options/) to **Off**, re-order the pools in your load balancer to adjust the fallback order. * If needed, update the [**Fallback Pool**](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/health-details/#fallback-pools). * If you choose to set traffic steering to **Random**, you can set [Weights](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/standard-options/#random-steering) (via the API) to your pools to determine the percentage of traffic sent to each pool. 5. Select **Next**. 6. On the **Monitors** page: * Review the monitors attached to your pools. * If needed, you can attach an existing monitor or [create a new monitor](https://edgetunnel-b2h.pages.dev/load-balancing/monitors/create-monitor/#create-a-monitor). 7. Select **Next**. 8. On the **Traffic Steering** page, choose an option for [Traffic steering](https://edgetunnel-b2h.pages.dev/load-balancing/understand-basics/traffic-steering/steering-policies/) and select **Next**. 9. Select **Next**. 10. On the **Review** page: * Review your configuration and make any changes. * Choose whether to **Save as Draft** or **Save and Deploy**. For a full list of properties, refer to [Create Load Balancer](https://edgetunnel-b2h.pages.dev/api/resources/load%5Fbalancers/methods/create/). If you need help with API authentication, refer to [Cloudflare API documentation](https://edgetunnel-b2h.pages.dev/fundamentals/api/). Note Since load balancers only exist on a zone — and not an account — you may need to get the zone `id` with the [List Zones](https://edgetunnel-b2h.pages.dev/api/resources/zones/methods/list/) command. Required API token permissions At least one of the following [token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/) is required: * `Load Balancers Write` **Create Load Balancer** ```bash curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/load_balancers" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "description": "Load Balancer for lb.example.com", "name": "lb.example.com", "enabled": true, "ttl": 30, "fallback_pool": "17b5962d775c646f3f9725cbc7a53df4", "default_pools": [ "17b5962d775c646f3f9725cbc7a53df4", "9290f38c5d07c2e2f4df57b1f61d4196", "00920f38ce07c2e2f4df50b1f61d4194" ], "proxied": true, "steering_policy": "random_steering", "session_affinity": "cookie", "session_affinity_attributes": { "samesite": "Auto", "secure": "Auto", "drain_duration": 100, "zero_downtime_failover": "sticky" }, "session_affinity_ttl": 5000, "adaptive_routing": { "failover_across_pools": true }, "location_strategy": { "prefer_ecs": "always", "mode": "resolver_ip" }, "random_steering": { "pool_weights": { "de90f38ced07c2e2f4df50b1f61d4194": 0.3, "9290f38c5d07c2e2f4df57b1f61d4196": 0.5 }, "default_weight": 0.2 } }' ``` The response contains the complete definition of the new load balancer. **Response** ```json { "success": true, "errors": [], "messages": [], "result": { "id": "699d98642c564d2e855e9661899b7252", "created_on": "2021-01-01T05:20:00.12345Z", "modified_on": "2021-01-01T05:20:00.12345Z", "description": "Load Balancer for lb.example.com", "name": "lb.example.com", "enabled": true, "ttl": 30, "fallback_pool": "17b5962d775c646f3f9725cbc7a53df4", "default_pools": [ "17b5962d775c646f3f9725cbc7a53df4", "9290f38c5d07c2e2f4df57b1f61d4196", "00920f38ce07c2e2f4df50b1f61d4194" ], "proxied": true, "steering_policy": "random_steering", "session_affinity": "cookie", "session_affinity_attributes": { "samesite": "Auto", "secure": "Auto", "drain_duration": 100, "zero_downtime_failover": "sticky" }, "session_affinity_ttl": 5000, "random_steering": { "pool_weights": { "de90f38ced07c2e2f4df50b1f61d4194": 0.3, "9290f38c5d07c2e2f4df57b1f61d4196": 0.5 }, "default_weight": 0.2 } } } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/test-load-balancer/#page","headline":"Create load balancer on test domain · Cloudflare Learning Paths","description":"Learn about create load balancer on test domain in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/test-load-balancer/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/test-load-balancer/","name":"Create load balancer on test domain"}}]} ``` --- --- title: Send traffic and review analytics description: Learn about send traffic and review analytics in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Send traffic and review analytics As you send sample requests to your test domain, review the [load balancing analytics](https://edgetunnel-b2h.pages.dev/load-balancing/reference/load-balancing-analytics/) page to make sure your load balancer is distributing requests like you were expecting. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/traffic-analytics/#page","headline":"Send traffic and review analytics · Cloudflare Learning Paths","description":"Learn about send traffic and review analytics in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/load-balancing/setup/traffic-analytics/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/load-balancing/setup/","name":"Setup"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/load-balancing/setup/traffic-analytics/","name":"Send traffic and review analytics"}}]} ``` --- --- title: Introducing mTLS description: Implement mutual TLS authentication with Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Introducing mTLS [Mutual TLS (mTLS)](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) authentication is a common security practice that uses client certificates to ensure traffic between client and server is bidirectionally secure and trusted. mTLS also allows requests that do not authenticate via an identity provider — such as Internet-of-things (IoT) devices — to demonstrate they can reach a given resource. [TLS (Transport Layer Security) ↗](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) is a widely-used protocol to ensure secure communication over a network. It ensures confidentiality and integrity by encrypting data and validating the server using digital certificates. Mutual TLS (mTLS) adds an extra layer by authenticating both parties involved in the communication. The client presents a certificate to the server (in this case Cloudflare) and vice versa. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/concepts/#page","headline":"Introducing mTLS · Cloudflare Learning Paths","description":"Implement mutual TLS authentication with Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/concepts/","name":"Introducing mTLS"}}]} ``` --- --- title: Benefits of mTLS description: Learn about benefits of mtls in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Benefits of mTLS * **Stronger authentication**: mTLS ensures mutual verification between the client and server, confirming that both parties are who they claim to be. This two-way authentication mechanism prevents impersonation and man-in-the-middle attacks, significantly enhancing the overall security. * **End-to-end encryption**: All communication between the client and server is encrypted, providing robust protection against eavesdropping and interception. Even if the data is captured by unauthorized parties, it remains secure and unreadable due to encryption. * **Preserved data integrity**: mTLS ensures that data remains unaltered during transit. The protocol verifies the integrity of transmitted information, protecting it from tampering or manipulation by malicious actors, ensuring the data's authenticity. * **Defense against insider threats**: mTLS strengthens internal network security by adding protection against insider threats. Unlike traditional "castle-and-moat" networking, which trusts anything inside the perimeter, mTLS enforces mutual authentication, ensuring all internal communications are verified and secure. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/concepts/benefits/#page","headline":"Benefits of mTLS · Cloudflare Learning Paths","description":"Learn about benefits of mtls in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/concepts/benefits/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/concepts/","name":"Introducing mTLS"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/mtls/concepts/benefits/","name":"Benefits of mTLS"}}]} ``` --- --- title: Use mTLS with Cloudflare protected resources description: Learn about use mtls with cloudflare protected resources in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use mTLS with Cloudflare protected resources In this implementation guide we will be focusing on the L7 / Application Layer security for HTTP/S requests targeting [proxied](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) hostnames, including the [first connection](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/ssl-modes/) between client and Cloudflare. Some common mTLS use cases are: * Protect and verify legitimate API traffic by verifying Client Certificates provided during TLS/SSL handshakes. * Check IoT devices' identity by verifying Client Certificates they provide during TLS/SSL handshakes. There are two main ways to use mTLS at Cloudflare, either by using the Application Security offering (optionally including [API Shield](https://edgetunnel-b2h.pages.dev/api-shield/)) or [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/). Below is a non-exhaustive overview table of their differences: | Feature | Application Security (Client Certificate + WAF) | Cloudflare Access (mTLS) | | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Mainly used for | External Authentication (that is, APIs) | Internal Authentication (that is, employees) | | Availability | By default, 100 Client Certificates per Zone are included for free. For more certificates or [API Shield features](https://edgetunnel-b2h.pages.dev/api-shield/), contact your account team. | Zero Trust Enterprise only feature. | | [Certificate Authority (CA)](https://edgetunnel-b2h.pages.dev/ssl/concepts/#certificate-authority-ca) | Cloudflare-managed or customer-uploaded (BYO CA). There's a soft-limit of up to [five customer-uploaded CAs](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/#availability). | Customer-uploaded only (BYO CA). There's a soft-limit of up to [50 CAs](https://edgetunnel-b2h.pages.dev/cloudflare-one/account-limits/#access). | | Client Certificate Details | Forwarded to the origin server via [Cloudflare API](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/forward-a-client-certificate/#cloudflare-api), [Cloudflare Workers](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/forward-a-client-certificate/#cloudflare-workers), and [Managed Transforms](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/forward-a-client-certificate/#managed-transforms). | Forwarded to the origin server via [Cloudflare API](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#cloudflare-api), [Cloudflare Workers](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#cloudflare-workers), and [Managed Transforms](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#managed-transforms). Client Certificate headers and [Cf-Access-Jwt-Assertion](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/) JWT header can be forwarded to the origin server. | | Client Certificates Revocation | Use the WAF [Custom Rules](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) to check for [_cf.tls\_client\_auth.cert\_revoked_](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/revoke-client-certificate/), which only applies to Cloudflare-managed CA. For BYO CAs, it would be the same approach as with Cloudflare Access. | Generate a [Certificate Revocation List (CRL)](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#create-a-crl) and enforce the revocation in a Cloudflare Worker. | ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/concepts/mtls-cloudflare/#page","headline":"Use mTLS with Cloudflare protected resources · Cloudflare Learning Paths","description":"Learn about use mtls with cloudflare protected resources in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/concepts/mtls-cloudflare/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/concepts/","name":"Introducing mTLS"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/mtls/concepts/mtls-cloudflare/","name":"Use mTLS with Cloudflare protected resources"}}]} ``` --- --- title: mTLS with Application Security description: Implement mutual TLS authentication with Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # mTLS with Application Security Note This implementation requires an active [Zone](https://edgetunnel-b2h.pages.dev/fundamentals/concepts/accounts-and-zones/#zones), a valid [Edge Certificate](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/), and [proxied](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) hostname. API Shield is not required to use mTLS. By default, mTLS uses Client Certificates issued by a Cloudflare-managed CA and set at account-level. If you have an Enterprise account, you also have the option to [bring your own CA](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/). ## 1\. Enable mTLS 1. Go to your Cloudflare dashboard and select your account and domain. 2. Go to **SSL/TLS** \> **[Client Certificates](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/)** and, on the **Hosts** section, select **Edit** to add the hostnames you want to [enable mTLS](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/enable-mtls/) for. Example host: `mtls-test.example.com` 3. Select **Add Certificate**. The Cloudflare-managed CA is the default **Certificate Authority**. 4. Fill in the required fields. You can choose one of the following options: * Generate a private key (usually referred to as Private Certificate) and Certificate Signing Request (CSR) with Cloudflare (which includes the Public Certificate). * Use your own private key and CSR which allows you to also [label client certificates](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/label-client-certificate/). To generate and use your own CSR, you can run a command like the following: ```sh openssl req -new -newkey rsa:2048 -nodes -keyout client1.key -out client1.csr -subj '/C=GB/ST=London/L=London/O=Organization/CN=CommonName' ``` Or use a script like this one from [GitHub ↗](https://github.com/erfianugrah/rootcatest/blob/main/fullgenerator.py). Do not forget to copy the values shown when creating the certificate as they become unavailable after creation. ## 2\. Install the client certificate In order for a client to utilize the Client Certificate you created, it must be on the devices that you want to use them on. You will want to place them in the same directory as your process / script that targets your APIs / hostnames. We generally recommended using one Client Certificate per device. Configuring your system to actually use the Public and Private Certificates is especially important. An example is to [add both certificates to the Keychain ↗](https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac) on a MacBook laptop. Another example is to generate a [PKCS12 (P12) certificate ↗](https://en.wikipedia.org/wiki/PKCS%5F12) file and then [add it to your browser ↗](https://www.ibm.com/docs/en/engineering-lifecycle-management-suite/lifecycle-management/7.0.2?topic=dashboards-importing-certificates-configuring-browsers): ```sh openssl pkcs12 -export -out certificate.p12 -inkey private-cert.pem -in cert.pem ``` Use the values from the previous step. Example using cURL command: ```sh curl -v --cert cert.pem --key private-cert.pem ``` Use the values from the previous step. ## 3\. Validate the client certificate in the WAF mTLS is verified and checked in the [Cloudflare WAF phase](https://edgetunnel-b2h.pages.dev/waf/reference/phases/). This is done by creating WAF [Custom Rules](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) using the dynamic fields. All Client Certificate details can be found in the [cf.tls\_\*](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/?field-category=mTLS&field-category=SSL/TLS) fields in the [Cloudflare Ruleset Engine](https://edgetunnel-b2h.pages.dev/ruleset-engine/). Example WAF Custom Rule with action block: ![Example of a WAF custom rule with an action block in the Cloudflare dashboard during the validate client certificate step](https://edgetunnel-b2h.pages.dev/_astro/waf-custom-rule-action-block.BKAq1FqM_14UKW4.webp) Note When using [CNAME records](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/reference/dns-record-types/#cname), enforce mTLS on the specific hostname where it should be checked. It is not enough to have it set on the CNAME target. ## Demo Note Ensure you are not using a VPN that could interfere with certificates or TLS decryption. If needed, enable [Split Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) for specific hostnames to bypass the VPN for trusted services, such as the mTLS hostnames. With the Public and Private Certificates in the same directory, with this cURL command, we will gain access: ```sh curl -I --cert cert.pem --key private-cert.pem https://mtls-test.example.com/mtls-test ``` ```txt HTTP/2 200 server: cloudflare ``` Without the certificates, the terminal will display the following: ```sh curl -I https://mtls-test.example.com/mtls-test ``` ```txt HTTP/2 403 server: cloudflare ``` ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-app-security/#page","headline":"mTLS with Application Security · Cloudflare Learning Paths","description":"Implement mutual TLS authentication with Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-app-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/mtls-app-security/","name":"mTLS with Application Security"}}]} ``` --- --- title: mTLS related features description: Learn about mtls related features in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # mTLS related features ## Label Client Certificates To make it easier to differentiate between Client Certificates, you can generate your own private key and CSR, and enter information that will be incorporated into your certificate request, essentially [labeling your Client Certificates](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/label-client-certificate/). ## Certificate Revocation In cases of noticing excessive traffic, anomalous traffic (strange sequences of requests), or generally too many attack attempts registered from specific devices using your Client Certificates, it is best to [revoke](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/revoke-client-certificate/) those. Additionally, ensure to have a WAF [Custom Rule](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) in place to block [revoked](https://edgetunnel-b2h.pages.dev/api-shield/security/mtls/configure/#check-for-revoked-certificates) Client Certificates. Review the available [cf.tls\_\*](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/?field-category=mTLS&field-category=SSL/TLS) fields. Example WAF Custom Rule with action block: ![Example expression for certification revocation using a WAF custom rule in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/certification-revocation-custom-rule.Dl80dwDN_J2GCH.webp) ```text (cf.tls_client_auth.cert_revoked) ``` A better approach may be to check for unverified or revoked client certificates: ```txt (not cf.tls_client_auth.cert_verified) or cf.tls_client_auth.cert_revoked ``` Generally, ensure client certificates are rotated regularly and safely to reduce the risk of compromise. ## Forward a client certificate There are multiple ways to [forward a client certificate](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/forward-a-client-certificate/) to your origin server. ## Bring your own CA for mTLS If you already have mTLS implemented, client certificates are already installed on devices, and therefore you would like to use your own Certificate Authority (CA), this is possible by [bringing your own CA for mTLS](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/). You can associate your uploaded CAs with specific hostnames via the dashboard or the [Replace Hostname Associations API endpoint](https://edgetunnel-b2h.pages.dev/api/resources/certificate%5Fauthorities/subresources/hostname%5Fassociations/methods/update/). Note Each Enterprise account can upload up to five CAs. This quota is shared across [API Shield](https://edgetunnel-b2h.pages.dev/api-shield/security/mtls/configure/), [Workers mTLS](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/bindings/mtls/), and [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/). Contact your account team to request an increase. ## Client Certificate Deployment There are different ways to safely and securely deploy Client Certificates across devices. Some of the most used methods are [embedding](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/configure-your-mobile-app-or-iot-device/#3-embed-the-client-certificate-in-your-mobile-app) the Client Certificate into an application and allowing user devices to download and install that app, or use mobile device management (MDM) to distribute certificates across devices, or to allow user devices to directly download and install the Client Certificate into a device's Certificate Store. Issuing a certificate is an important step, so if possible, perform thorough client verification. In complex microservices environments, you can leverage Service Mesh to automate and enforce mTLS at scale. For example, Cloudflare services can handle external traffic security, while Service Mesh technologies enforce mTLS for east-west traffic within your network. This ensures that external traffic is secured by Cloudflare, while internal microservice communication is protected using mTLS via the Service Mesh. ## Customize Cipher Suites It is generally recommended to [customize the cipher suites](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/additional-options/cipher-suites/customize-cipher-suites/) of your Cloudflare [Edge Certificates](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/). This only applies to the Edge Certificates, not Client Certificates. The recommended TLS versions for mTLS are: * TLS 1.2: still broadly compatible and secure. * TLS 1.3: preferred for new implementations due to its enhanced security and efficiency. Using outdated versions like TLS 1.0 or 1.1 is not recommended due to known vulnerabilities. Note For modern mTLS implementations, Elliptic Curve Cryptography (EC) and [modern cipher suites](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/additional-options/cipher-suites/supported-cipher-suites/) are recommended because it offers faster handshakes and better performance, uses smaller key sizes which result in reduced computational overhead while maintaining strong security, and EC is more scalable for large-scale deployments, such as in cloud-native applications, microservices, and mobile networks. RSA is only recommended if you have legacy systems that cannot support EC or if you require compatibility with systems that only work with RSA. ## TLS Session Resumption Browsers connecting to a domain with a [wildcard](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/reference/wildcard-dns-records/) [Edge Certificate](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/) in place, connecting to the same domain's mTLS subdomain could cause a non-authentication event, due to TLS Session Resumption, or also called [Connection Resumption](https://edgetunnel-b2h.pages.dev/speed/optimization/protocol/0-rtt-connection-resumption/). It is generally not recommended to use wildcard certificates. Review the [troubleshooting documentation](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/troubleshooting/) for more info. ## TLS Session Renegotiation Note Resumption and renegotiation are essentially opposites. Resumption re-establishes a previous TLS session over a new TCP connection, keeping the same TLS parameters. In contrast, renegotiation updates certain TLS parameters within an existing session, continuing over the same TCP connection. If you need to use Client Certificates after the TLS handshake via renegotiation, you will need to use a prior TLS version than 1.3\. This is because TLS 1.3 does not support renegotiation. For example, if you are using mTLS and you are restricting requests to certain folders, based on a URL path in the request, rather than all content on your origin server, a TLS renegotiation may be triggered. Connections using TLS 1.3 do not support renegotiation. ## Chain of Trust Customers create Client Certificates and select the option to _use my private key and CSR_. The customer provides the CSR supplied by end-customers to generate the client certificates shared with end-customers. However, if your end-customers request the Certificate Chain, this can potentially be shared by the Cloudflare account team. Contact your account team for more information. ## WAF for Client Certificates Note [Revoked](https://edgetunnel-b2h.pages.dev/api-shield/security/mtls/configure/#check-for-revoked-certificates) Client Certificates are not automatically blocked unless you have an active WAF Custom Rule specifically checking for and blocking them. This check only applies to Client Certificates issued by the Cloudflare-managed CA. Cloudflare currently does not check certificate revocation lists (CRL) for CAs that have been uploaded by the customer ([BYO CA](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/)). One can opt for Workers to manage a custom business logic and block revoked Client Certificates. See the [Workers section](https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-workers/) for more information. In order to effectively implement mTLS with Cloudflare, it is strongly recommended to properly configure the [Cloudflare WAF](https://edgetunnel-b2h.pages.dev/waf/). Review the available [cf.tls\_\*](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/?field-category=mTLS&field-category=SSL/TLS) fields. Example WAF Custom Rule with action block: ![Example expression for configure a WAF Custom Rule with action block ](https://edgetunnel-b2h.pages.dev/_astro/configure-waf-custom-rule.BGsSBYj1_Otwj6.webp) ```txt (http.host in {"mtls.example.com" "mtls2.example.com"} and (not cf.tls_client_auth.cert_verified or cf.tls_client_auth.cert_revoked)) ``` This expression will check if the request is coming from one of the hostnames and will block the request if the Client Certificate is either not verified or revoked. Another example WAF Custom Rule with action block, using the [cf.tls\_client\_auth.cert\_fingerprint\_sha256](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/cf.tls%5Fclient%5Fauth.cert%5Ffingerprint%5Fsha256/) field, for a specific Client Certificate (replace `ADD_STRING_OF_CLIENT_CERT_SHA256_FINGERPRINT`): ![Example expression of a WAF Custom Rule with action block using the cf.tls_client_auth.cert_fingerprint_sha256 field](https://edgetunnel-b2h.pages.dev/_astro/waf-client-certificates-fingerprint.BqsBG7GT_hgTk0.webp) ```txt (http.request.uri.path in {"/headers"} and http.host in {"mtls.example.com" "mtls2.example.com"} and not cf.tls_client_auth.cert_verified and cf.tls_client_auth.cert_fingerprint_sha256 ne "ADD_STRING_OF_CLIENT_CERT_SHA256_FINGERPRINT") ``` Here is another example of a WAF custom rule to associate a serial number with a hostname: ![Example expression of a WAF Custom Rule to associate a serial number with a hostname](https://edgetunnel-b2h.pages.dev/_astro/waf-custom-rule.BVo7j0Y-_CKTwN.webp) ```txt (http.host in {"mtls.example.com" "mtls2.example.com"} and cf.tls_client_auth.cert_serial ne "ADD_STRING_OF_CLIENT_CERT_SERIAL") ``` This expression will check for a specific [Client Certificate serial number](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/cf.tls%5Fclient%5Fauth.cert%5Fserial/) linked to specific hostnames, allowing for more granular control. ## Rate Limiting by Client Certificates By enabling [forwarding a certificate](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/forward-a-client-certificate/#cloudflare-api) via the Cloudflare API, every request of an mTLS connection will include the following headers: * `Cf-Client-Cert-Der-Base64` (raw certificate in DER format, encoded as base64) * `Cf-Client-Cert-Sha256` (SHA256 fingerprint of the certificate) The header `Cf-Client-Cert-Sha256` can be used within the [Rate Limiting characteristics](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/parameters/#with-the-same-characteristics) "Header value of". Example [Rate Limiting Rule](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/): ![Example exmpression of a rate limiting rule from the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/rate-limiting-rule.DDXdodgO_1uReTg.webp) ```txt (http.host in {"mtls.example.com" "mtls2.example.com"} and cf.tls_client_auth.cert_verified) With the same characteristics... "Header value of": "Cf-Client-Cert-Sha256" ``` ## Cloudflare API Shield In addition to mTLS, customers can purchase [API Shield](https://edgetunnel-b2h.pages.dev/api-shield/) features, such as API Discovery, API Routing, Volumetric Abuse Detection, Sequence Mitigation, JWT Validation, Schema Validation, and more. ## Cloudflare Workers Cloudflare Workers can provide details around the Client Certificate, such as returning information via headers to the client or to the origin server. Learn more in the [mTLS with Workers section](https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-workers/) below. Note Snippets do not support any [Bindings](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/bindings/) and do not work with mTLS. However, you can [validate JSON web tokens (JWT)](https://edgetunnel-b2h.pages.dev/rules/snippets/examples/jwt-validation/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-app-security/related-features/#page","headline":"mTLS related features · Cloudflare Learning Paths","description":"Learn about mtls related features in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-app-security/related-features/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-07","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/mtls-app-security/","name":"mTLS with Application Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/mtls/mtls-app-security/related-features/","name":"mTLS related features"}}]} ``` --- --- title: mTLS with Cloudflare Access description: Implement mutual TLS authentication with Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # mTLS with Cloudflare Access Note This requires an active Enterprise [Account](https://edgetunnel-b2h.pages.dev/fundamentals/concepts/accounts-and-zones/) with Cloudflare Access enabled. Setting up [mTLS](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/) with [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) can help in cases where the customer: * Already has existing Client Certificates on devices. * Needs to protect Access applications with [Bring Your Own CA (BYOCA)](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/). * Needs to integrate with a Zero Trust solution. ## 1\. Create a CA The CA certificate can be from a publicly trusted CA or self-signed. In case you want to [create your own CA](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#test-mtls-using-cloudflare-pki) from scratch, you can follow these example steps and adapt the information to your own needs: 1. Create a JSON file called `ca-csr.json`: ```json { "CN": "Cloudflare Access Testing CA", "key": { "algo": "rsa", "size": 4096 }, "names": [ { "C": "US", "L": "LA", "O": "Access Testing", "OU": "CA", "ST": "California" } ] } ``` 1. Create a JSON file called `ca-config.json`: ```json { "signing": { "default": { "expiry": "8760h" }, "profiles": { "server": { "usages": ["signing", "key encipherment", "server auth"], "expiry": "8760h" }, "client": { "usages": ["signing", "key encipherment", "client auth"], "expiry": "8760h" } } } } ``` 1. Run the following [cfssl](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#test-mtls-using-cloudflare-pki) command to generate the CA certificate `ca.pem`: ```txt cfssl gencert -initca ca-csr.json | cfssljson -bare ca ``` ## 2\. Create Client Certificates 1. In order to create the Client Certificates, you need to prepare the following JSON file called `client-csr.json`: ```json { "CN": "mtls-access.example.com", # replace with your own hostname "hosts": ["mtls-access.example.com"], # replace with your own hostname "key": { "algo": "rsa", "size": 4096 }, "names": [ { "C": "US", "L": "Austin", "O": "Access", "OU": "Access Admins", "ST": "Texas" } ] } ``` 1. Now you can run the following command to generate the Client Certificates, which will output the files `client.pem`, `client-key.pem` and `client.csr`: ```sh cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client-csr.json | cfssljson -bare client ``` ## 3\. Add mTLS CA certificate to Cloudflare Access Follow the steps outlined in the [developer documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration). Using the example from Step 2: upload the `ca.pem` to your Cloudflare Access account via the [dashboard](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration) or [Cloudflare API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/access/subresources/certificates/methods/create/). Do not forget to enter the fully-qualified domain names (FQDN / associated hostnames) that will use this CA certificate. Customers can identify which client sends the Client Certificates by [forwarding client certificate headers](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#forward-a-client-certificate) to the origin server. Customers can then store and use the certificate information such as Common Name (CN), Serial number, and other fields along with the device number to perform additional checks or logics. Additionally, authenticated requests also send the `Cf-Access-Jwt-Assertion\` JWT header to the origin server. To decode the header value, you can use [jwt.io ↗](https://jwt.io/). ## 4\. Create the self-hosted applications Finally, the hostname you want to protect with mTLS needs to be added as a [self-hosted app](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) in Cloudflare Access, defining an [Access Policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) which uses the action [Service Auth](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#service-auth) and the Selector _"Valid Certificate"_, or simply requiring an [IdP](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) authentication. You can also take advantage of extra requirements, such as the "Common Name" (CN), which expects the indicated hostname, and more [Selectors](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#selectors). Alternatively, one can also [extend ZTNA with external authorization and serverless computing](https://edgetunnel-b2h.pages.dev/reference-architecture/diagrams/sase/augment-access-with-serverless/). ## Demo Note Make sure that you are not using any VPN that could interfere with the certificates or TLS decryption. With the Public and Private Client Certificates in the same directory, with this cURL command, we will gain access: ```sh curl -IXGET --cert client.pem --key client-key.pem https://mtls-access.example.com/ ``` ```txt HTTP/2 200 server: cloudflare ``` Without the certificates, we would see the following: ```sh curl -I https://mtls-access.example.com/mtls-test ``` ```txt HTTP/2 401 server: cloudflare ``` ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-cloudflare-access/#page","headline":"mTLS with Cloudflare Access · Cloudflare Learning Paths","description":"Implement mutual TLS authentication with Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-cloudflare-access/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/mtls-cloudflare-access/","name":"mTLS with Cloudflare Access"}}]} ``` --- --- title: Types of mTLS implementation description: Implement mutual TLS authentication with Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Types of mTLS implementation There are different ways to implement mTLS authentication. The most common ones are: ## Option 1: mTLS Device Authentication This version of mTLS is for device certificates, primarily focused on the number of IoT devices, not user devices. Here we recommend using [mTLS with Application Security](https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-app-security/). ## Option 2: mTLS User Authentication When a user wants to establish a secure connection with a server, they present their certificate to the server, which verifies its authenticity. Once the certificate is authenticated, an encrypted connection is established between the user and the server, and all data transmitted between them is encrypted to protect against interception by third parties. mTLS user authentication is included with Cloudflare Access and depends on the number of users. ## Option 3: mTLS Service Authentication The hostnames are used to look up the certificates and verify their authenticity. Once the connection is established, all data transmitted between the hosts is encrypted, ensuring that it cannot be intercepted and read by third parties. Here the main driver is the number of hostnames. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-implementation/#page","headline":"Types of mTLS implementation · Cloudflare Learning Paths","description":"Implement mutual TLS authentication with Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-implementation/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/mtls-implementation/","name":"Types of mTLS implementation"}}]} ``` --- --- title: mTLS with Workers description: Implement mutual TLS authentication with Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # mTLS with Workers Note Cloudflare Workers runs after the Cloudflare WAF and Cloudflare Access. Review the [Traffic Sequence ↗](https://blog.cloudflare.com/traffic-sequence-which-product-runs-first/) visible on the Cloudflare dashboard. [mTLS for Workers](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/bindings/mtls/) can be used for requests made to services that are [not proxied](https://edgetunnel-b2h.pages.dev/dns/proxy-status/#dns-only-records) on Cloudflare, or alternatively used to gain visibility into certificate details and optionally add your own programmatic logic for further checks or actions. ## Expose mTLS headers All Client Certificate details can be found in the [tlsClientAuth](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/request#incomingrequestcfproperties) object in Cloudflare Workers. Refer to [Client certificate variables](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/client-certificate-variables/) for a full list of available properties. Example Cloudflare Workers code to return all headers and gain visibility, including [Client Certificate headers](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/forward-a-client-certificate/#cloudflare-workers): * [ Module Worker ](#tab-panel-9933) * [ Service Worker ](#tab-panel-9934) **JavaScript** ```js export default { async fetch(request, env, ctx) { const { tlsClientAuth = {} } = request.cf || {}; const tlsHeaders = { 'X-CERT-ISSUER-DN': tlsClientAuth.certIssuerDN, 'X-CERT-SUBJECT-DN': tlsClientAuth.certSubjectDN, 'X-CERT-ISSUER-DN-L': tlsClientAuth.certIssuerDNLegacy, 'X-CERT-SUBJECT-DN-L': tlsClientAuth.certSubjectDNLegacy, 'X-CERT-SERIAL': tlsClientAuth.certSerial, 'X-CERT-FINGER': tlsClientAuth.certFingerprintSHA1, 'X-CERT-VERIFY': tlsClientAuth.certVerify, 'X-CERT-NOTBE': tlsClientAuth.certNotBefore, 'X-CERT-NOTAF': tlsClientAuth.certNotAfter }; const headers = Object.fromEntries(request.headers); return new Response(JSON.stringify({ ...headers, ...tlsHeaders }, null, 2), { headers: { 'Content-Type': 'application/json' } }); } } ``` Service Workers are deprecated Service Workers are deprecated, but still supported. We recommend using [Module Workers](https://edgetunnel-b2h.pages.dev/workers/reference/migrate-to-module-workers/) instead. New features may not be supported for Service Workers. **JavaScript** ```js addEventListener('fetch', event => { event.respondWith( (async request => { const { tlsClientAuth = {} } = request.cf || {}; const tlsHeaders = { 'X-CERT-ISSUER-DN': tlsClientAuth.certIssuerDN, 'X-CERT-SUBJECT-DN': tlsClientAuth.certSubjectDN, 'X-CERT-ISSUER-DN-L': tlsClientAuth.certIssuerDNLegacy, 'X-CERT-SUBJECT-DN-L': tlsClientAuth.certSubjectDNLegacy, 'X-CERT-SERIAL': tlsClientAuth.certSerial, 'X-CERT-FINGER': tlsClientAuth.certFingerprintSHA1, 'X-CERT-VERIFY': tlsClientAuth.certVerify, 'X-CERT-NOTBE': tlsClientAuth.certNotBefore, 'X-CERT-NOTAF': tlsClientAuth.certNotAfter }; const headers = Object.fromEntries(request.headers); return new Response(JSON.stringify({ ...headers, ...tlsHeaders }, null, 2), { headers: { 'Content-Type': 'application/json' } }); })(event.request) ); }); ``` The response when using the browser with a P12 Certificate to visit the mTLS hostname would look similar to this example: ![Example response after exposing an mTLS header with Cloudflare Workers](https://edgetunnel-b2h.pages.dev/_astro/expose-mtls-workers.CZtg7nI7_2kyLoG.webp) ```txt { "X-CERT-ISSUER-DN": "CN=Managed CA abcdefghijklmnopq123456789,OU=www.cloudflare.com,O=Cloudflare\\, Inc.,L=San Francisco,ST=California,C=US", "X-CERT-SUBJECT-DN": "CN=Cloudflare,C=US", "X-CERT-ISSUER-DN-L": "/C=US/ST=California/L=San Francisco/O=Cloudflare, Inc./OU=www.cloudflare.com/CN=Managed CA abcdefghijklmnopq123456789", "X-CERT-SUBJECT-DN-L": "/C=US/CN=Cloudflare", "X-CERT-SERIAL": "37C52778E2F1820CC6342172A0E0ED33A4555F8B", "X-CERT-FINGER": "161e3a2089add0b2134ec43c9071f460e9f4b898", "X-CERT-NOTBE": "May 25 23:11:00 2024 GMT", "X-CERT-NOTAF": "May 23 23:11:00 2034 GMT" } ``` Note The client certificate serial number is a unique identifier assigned to each certificate by the CA, ensuring that no two certificates issued by the same CA have the same serial number. This can be useful to track and monitor certificate usage or abuse. This approach can also be useful to handle additional checks and logic on the mTLS via the Cloudflare Workers. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-workers/#page","headline":"mTLS with Workers · Cloudflare Learning Paths","description":"Implement mutual TLS authentication with Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/mtls/mtls-workers/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/mtls/mtls-workers/","name":"mTLS with Workers"}}]} ``` --- --- title: Advanced DDoS protection description: Prevent and mitigate DDoS attacks on applications. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Advanced DDoS protection Learn how to customize and augment Cloudflare’s DDoS protection. ## Objectives By the end of this module, you will be able to: * Audit DNS records to prevent accidental IP address exposures. * Optimize caching and security to reduce incoming traffic (whether malicious or legitimate). * Augment Cloudflare's default analytics to examine attacks in more detail. * Evaluate different ways to restrict external connections to your origin server. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/#page","headline":"Advanced DDoS protection · Cloudflare Learning Paths","description":"Prevent and mitigate DDoS attacks on applications.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/","name":"Advanced DDoS protection"}}]} ``` --- --- title: Customize Cloudflare security description: Learn about customize cloudflare security in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Customize Cloudflare security Another way of reducing origin traffic is customizing the Cloudflare WAF and other security features. The fewer malicious requests that reach your application, the fewer that could reach (and overwhelm) your origin. To reduce incoming malicious requests, you could: * Create [WAF custom rules](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) for protection based on specific aspects of incoming requests. * Adjust DDoS rules to handle [false negatives and false positives](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/http/http-overrides/override-examples/). * Build [rate limiting rules](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/) to protect against specific patterns of requests. * Enable [bot protection](https://edgetunnel-b2h.pages.dev/bots/get-started/) or set up [Bot Management for Enterprise](https://edgetunnel-b2h.pages.dev/bots/get-started/bot-management/) to protect against automated abuse. * Explore [network-layer DDoS attack protection](https://edgetunnel-b2h.pages.dev/ddos-protection/managed-rulesets/network/). * Review the rest of Cloudflare's [security options](https://edgetunnel-b2h.pages.dev/learning-paths/application-security/account-security/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/customize-security/#page","headline":"Customize Cloudflare security · Cloudflare Learning Paths","description":"Learn about customize cloudflare security in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/customize-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/","name":"Advanced DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/customize-security/","name":"Customize Cloudflare security"}}]} ``` --- --- title: Augment default analytics description: Learn about augment default analytics in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Augment default analytics Cloudflare provides analytics for [security events](https://edgetunnel-b2h.pages.dev/waf/analytics/security-events/), [traffic patterns](https://edgetunnel-b2h.pages.dev/analytics/account-and-zone-analytics/zone-analytics/), and more according to the level of your zone's plan. To augment these default analytics and gather more information about potential DDoS attacks, explore the following options. ## Restore visitor IP addresses When traffic [proxied through Cloudflare](https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/proxy-dns-records/) reaches your origin server, it will come from Cloudflare's IP addresses. If needed, you can [restore the original visitor's IP address](https://edgetunnel-b2h.pages.dev/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/) so you can have that information in your server logs. ## Cloudflare Logs Enterprise customers can set up [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/) jobs to regularly send Cloudflare logs to the SIEM system of their choice. This data can help when looking at long-term DDoS attack trends or when you need custom visualizations. ## Bot Management For more detailed analytics about potential bot attacks, Enterprise customers can also purchase [Bot Management](https://edgetunnel-b2h.pages.dev/bots/get-started/bot-management/). For a full tour of Bot Analytics, see [our blog post ↗](https://blog.cloudflare.com/introducing-bot-analytics/). At a high level, the tool includes: * **Requests by bot score**: View your total domain traffic and segment it vertically by traffic type. Keep an eye on _automated_ and _likely automated_ traffic. * **Bot score distribution**: View the number of requests assigned a bot score 1 through 99. * **Bot score source**: Identify the most common detection engines used to score your traffic. Hover over a tooltip to learn more about each engine. * **Top requests by attribute**: View more detailed information on specific IP addresses and other characteristics. Bot Analytics shows up to one week of data at a time and can display data up to 30 days old. Bot Analytics displays data in real time in most cases. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/improve-analytics/#page","headline":"Augment default analytics · Cloudflare Learning Paths","description":"Learn about augment default analytics in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/improve-analytics/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/","name":"Advanced DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/improve-analytics/","name":"Augment default analytics"}}]} ``` --- --- title: Optimize caching description: Optimize caching to reduce origin load. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Optimize caching The more content is cached, the fewer requests go back to your origin server (whether due to legitimate or illegitimate traffic). A few ways to optimize Cloudflare caching include: * Creating [cache rules](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-rules/) to customize the cache properties of specific HTTP requests. * Enabling the [Tiered Cache](https://edgetunnel-b2h.pages.dev/cache/how-to/tiered-cache/) feature, which dramatically increases cache hit ratios. * Reviewing our other various [configuration options](https://edgetunnel-b2h.pages.dev/cache/get-started/), which may vary based on your plan and application setup. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/optimize-caching/#page","headline":"Optimize caching · Cloudflare Learning Paths","description":"Optimize caching to reduce origin load.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/optimize-caching/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/","name":"Advanced DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/optimize-caching/","name":"Optimize caching"}}]} ``` --- --- title: Restrict external connections description: Learn about restrict external connections in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Restrict external connections To fully secure your origin, you should limit or restrict external connections to your origin server. These suggestions vary in their level of completeness and complexity and depend on your application and origin setup. ## Application layer Cloudflare Tunnel (HTTP / WebSockets) [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) connects your resources to Cloudflare without a publicly routable IP address, by creating an outbound-only connections to Cloudflare’s global network. * **Security**: Very secure. * **Availability**: All customers. * **Challenges**: Requires installing the `cloudflared` daemon on origin server or virtual machine. HTTP Header Validation Only allow traffic with specific (and secret) HTTP headers. * **Security**: Moderately secure. * **Availability**: All customers. * **Challenges**: * Requires more configuration efforts on application- and server-side to accept those headers. * Basic authentication is vulnerable to replay attacks. Because basic authentication does not encrypt user credentials, it is important that traffic always be sent over an encrypted SSL session. * There might be valid use cases for a mismatch in SNI / Host headers such as through [Origin or Page Rules](https://edgetunnel-b2h.pages.dev/rules/origin-rules/features/), [Load Balancing](https://edgetunnel-b2h.pages.dev/load-balancing/additional-options/override-http-host-headers/), or [Workers](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/request/), which all offer HTTP Host Header overrides. * **Process**: 1. Use [Transform rules](https://edgetunnel-b2h.pages.dev/rules/transform/request-header-modification/) or [Workers](https://edgetunnel-b2h.pages.dev/workers/examples/alter-headers/) to add an HTTP Auth Header. 2. Configure your origin server to restrict access based on the [HTTP Auth Header](https://edgetunnel-b2h.pages.dev/workers/examples/auth-with-headers/) (or perform [HTTP Basic Authentication](https://edgetunnel-b2h.pages.dev/workers/examples/basic-auth/)). 3. Configure your origin server to restrict access based on the [HTTP Host Header ↗](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Host). Specifically, only allow requests which contain expected HTTP Host Header values, and reject all other requests. JSON Web Tokens (JWT) Validation Only allow traffic with the appropriate JWT. * **Security**: Very secure. * **Availability**: Some customers. * **Challenges**: * Requires either installing incremental software or modifying application code. * Lots of manual work. * **Resources**: * [Validate JWTs for an Access application](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/) * [Validate JWTs for an API](https://edgetunnel-b2h.pages.dev/api-shield/security/jwt-validation/) ## Transport Layer Authenticated Origin Pulls [Authenticated Origin Pulls](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/) helps ensure requests to your origin server come from the Cloudflare network. * **Security**: Very secure. * **Availability**: All customers. * **Challenges**: * Requires [Full](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/ssl-modes/full/) or [Full (strict)](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/ssl-modes/full-strict/) encryption modes. * Requires more configuration efforts for application and server, such as uploading a certificate and configuring the server to use it. * For more strict security, you should upload your own certificate. Although Cloudflare provides you a certificate for easy configuration, this certificate only guarantees that a request is coming from the Cloudflare network. * Not scalable for large numbers of origin servers. Cloudflare Tunnel (SSH / RDP) [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) connects your resources to Cloudflare without a publicly routable IP address, by creating an outbound-only connections to Cloudflare’s global network. * **Security**: Very secure. * **Availability**: All customers. * **Challenges**: Requires installing the `cloudflared` daemon on origin server or virtual machine. ## Network Layer Allowlist Cloudflare IP addresses Explicitly block all traffic that does not come from [Cloudflare IP addresses](https://edgetunnel-b2h.pages.dev/fundamentals/concepts/cloudflare-ip-addresses/) (or the IP addresses of your trusted partners, vendors, or applications). * **Security**: Moderately secure. * **Availability**: All customers. * **Challenges**: * Requires allowlisting Cloudflare IP ranges at your origin server. * Vulnerable to IP spoofing. Cloudflare Magic Transit [Cloudflare Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/) is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. * **Security**: Very secure. * **Availability**: Enterprise-only. * **Challenges** * Client's routers must: * Support anycast tunneling. * Allow configuration of at least one tunnel per Internet service provider (ISP). * Support maximum segment size (MSS) clamping. Cloudflare Network Interconnect [Cloudflare Network Interconnect](https://edgetunnel-b2h.pages.dev/network-interconnect/) allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience. * **Security**: Very secure. * **Availability**: Enterprise-only. * **Challenges** * Requires some networking knowledge. * Only applies to some customer use cases. Dedicated CDN Egress IPs [Smart Shield Advanced](https://edgetunnel-b2h.pages.dev/smart-shield/get-started/#packages-and-availability) provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 [WAF](https://edgetunnel-b2h.pages.dev/waf/) and CDN services, as well as [Spectrum](https://edgetunnel-b2h.pages.dev/spectrum/). The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing a small list of IP addresses through your layer 3 firewall. * **Security**: Very secure. * **Availability**: Enterprise-only. * **Challenges**: Requires network-level firewall policies. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/prevent-external-connections/#page","headline":"Restrict external connections · Cloudflare Learning Paths","description":"Learn about restrict external connections in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/prevent-external-connections/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/","name":"Advanced DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/prevent-external-connections/","name":"Restrict external connections"}}]} ``` --- --- title: Protect origin IP address description: Learn about protect origin ip address in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Protect origin IP address Though Cloudflare automatically hides your origin server IP address when you [proxy your DNS records](https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/proxy-dns-records/), there are other ways to discover an IP address. To prevent attackers from discovering your origin's IP address, review the following suggestions. ## Rotate IP addresses DNS records are in the public domain, meaning that - even though your IP addresses are hidden once you proxy your DNS records - someone could uncover historical records of your addresses. For additional security, you could rotate the IP addresses of your origin server, which would also require [updating your DNS records](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/how-to/create-dns-records/#edit-dns-records) within Cloudflare. ## Review unproxied DNS records Unproxied DNS records - also known as **DNS-only** records - can sometimes contain origin IP information, especially those used for FTP or SSH. Review these records to make sure they do not contain origin IP information or use [Cloudflare Spectrum](https://edgetunnel-b2h.pages.dev/spectrum/) to proxy these records. ## Conceal unproxied DNS records If you need to have **DNS-only** records that contain origin IP information, use non-standard names for these records. This action makes dictionary scans of your DNS less likely to expose your origin IP address. For example, instead of `ftp.example.com`, you could use `827450184590183489.example.com` or `cloudflare-docs-are-great.example.com`. ## Evaluate mail infrastructure If possible, do not host a mail service on the same server as the web resource you want to protect, since emails sent to non-existent addresses get bounced back to the attacker and reveal the mail server IP address. Cloudflare recommends using non-contiguous IPs from different IP ranges. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/protect-origin-ip/#page","headline":"Protect origin IP address · Cloudflare Learning Paths","description":"Learn about protect origin ip address in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/advanced/protect-origin-ip/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/","name":"Advanced DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/advanced/protect-origin-ip/","name":"Protect origin IP address"}}]} ``` --- --- title: Baseline DDoS protection description: Prevent and mitigate DDoS attacks on applications. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Baseline DDoS protection Get world-class DDoS protection with a few simple steps. ## Objectives By the end of this module, you will be able to: * List the built-in DDoS protection measures provided by Cloudflare. * Implement a few, simple customizations to improve DDoS protection. * Set up DDoS-related notifications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/#page","headline":"Baseline DDoS protection · Cloudflare Learning Paths","description":"Prevent and mitigate DDoS attacks on applications.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/","name":"Baseline DDoS protection"}}]} ``` --- --- title: Enable WAF description: Enable the Web Application Firewall. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Enable WAF Once you [proxy your DNS records](https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/proxy-dns-records/), you should enable rulesets for Cloudflare's [Web Application Firewall (WAF)](https://edgetunnel-b2h.pages.dev/waf/). The available rulesets depend on your zone's plan, but all customers have access at least to the Cloudflare Free Managed Ruleset, which provides mitigations against high and wide-impacting vulnerabilities. For more details and potential customizations, refer to [Managed rulesets](https://edgetunnel-b2h.pages.dev/waf/managed-rules/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/enable-waf/#page","headline":"Enable WAF · Cloudflare Learning Paths","description":"Enable the Web Application Firewall.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/enable-waf/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/","name":"Baseline DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/enable-waf/","name":"Enable WAF"}}]} ``` --- --- title: Proxy DNS records description: Proxy DNS records through Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Proxy DNS records The first - and often easiest - step of DDoS protection is making sure your DNS records are [proxied](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) through Cloudflare. ## How it works ### Without Cloudflare Without Cloudflare, DNS lookups for your application's URL return the IP address of your [origin server ↗](https://www.cloudflare.com/learning/cdn/glossary/origin-server/). | URL | Returned IP address | | ----------- | ------------------- | | example.com | 192.0.2.1 | When using Cloudflare with [unproxied DNS records](https://edgetunnel-b2h.pages.dev/dns/proxy-status/), DNS lookups for unproxied domains or subdomains also return your origin's IP address. Another way of thinking about this concept is that visitors directly connect with your origin server. flowchart LR accTitle: Connections without Cloudflare A[Visitor] <-- Connection --> B[Origin server] ### With Cloudflare With Cloudflare — meaning your domain or subdomain is using [proxied DNS records](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) — DNS lookups for your application's URL will resolve to [Cloudflare anycast IPs ↗](https://www.cloudflare.com/ips/) instead of their original DNS target. | URL | Returned IP address | | ----------- | ------------------- | | example.com | 104.16.77.250 | All requests intended for proxied hostnames are directed to Cloudflare first and then forwarded to your origin server. flowchart LR accTitle: Connections with Cloudflare A[Visitor] <-- Connection --> B[Cloudflare global network] <-- Connection --> C[Origin server] Cloudflare assigns specific anycast IPs to your domain dynamically and these IPs may change at any time. This is an expected part of the operation of our anycast network and does not affect the proxy behavior described above. ## How it helps ### DDoS protection When your traffic is proxied through Cloudflare, Cloudflare can automatically stop [DDoS attacks](https://edgetunnel-b2h.pages.dev/ddos-protection/about/) from ever reaching your application (and your origin server). ### Caching Proxied traffic also benefits from the default optimizations of the Cloudflare [cache](https://edgetunnel-b2h.pages.dev/cache/). Cloudflare caches [certain types of resources](https://edgetunnel-b2h.pages.dev/cache/concepts/default-cache-behavior/#default-cached-file-extensions) automatically, which both speeds up your application's performance and reduces the overall number of requests. ### Hides origin IP address Proxying your DNS records in Cloudflare also hides the IP address of your origin server (because requests to your application resolve to Cloudflare anycast IP addresses instead). This obscurity makes it harder for someone to connect directly to your origin, which - by extension - also makes it harder to target your origin with a DDoS attack. ## How to do it Before proxying your records, you should likely [allow Cloudflare IP addresses](https://edgetunnel-b2h.pages.dev/fundamentals/concepts/cloudflare-ip-addresses/) at your origin to prevent requests from being blocked. Then, [update your Cloudflare DNS records](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/how-to/create-dns-records/#edit-dns-records) so their **Proxy status** is **Proxied**. ![Proxy status affects how Cloudflare treats traffic intended for specific DNS records](https://edgetunnel-b2h.pages.dev/_astro/proxy-status-screenshot.uxgurbGi_2igVHO.webp) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/proxy-dns-records/#page","headline":"Proxy DNS records · Cloudflare Learning Paths","description":"Proxy DNS records through Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/proxy-dns-records/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/","name":"Baseline DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/proxy-dns-records/","name":"Proxy DNS records"}}]} ``` --- --- title: Set up alerts description: Configure DDoS attack alert notifications. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Set up alerts Another part of preparing for DDoS attacks is knowing when your application is being attacked. Cloudflare offers notifications for DDoS attacks, which you can set up on your account. To set up a notification: 1. In the Cloudflare dashboard, go to the **Notifications** page. [ Go to **Notifications** ](https://dash.cloudflare.com/?to=/:account/notifications) 2. Select **Add**. 3. Select one of the [available DDoS alerts](https://edgetunnel-b2h.pages.dev/ddos-protection/reference/alerts/#alert-types) depending on your plan and services: * HTTP DDoS Attack Alert * Layer 3/4 DDoS Attack Alert * Advanced HTTP DDoS Attack Alert * Advanced Layer 3/4 DDoS Attack Alert 4. Enter a notification name and (optionally) a description. 5. Configure a delivery method for the notification. The available delivery methods depend on your Cloudflare plan. For more information, refer to [Cloudflare Notifications](https://edgetunnel-b2h.pages.dev/notifications/). 6. If you are creating a notification for one of the advanced DDoS attack alerts, select **Next** and define the parameters that will filter the notifications you will receive. 7. Select **Save**. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/set-up-alerts/#page","headline":"Set up alerts · Cloudflare Learning Paths","description":"Configure DDoS attack alert notifications.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/set-up-alerts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/","name":"Baseline DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/set-up-alerts/","name":"Set up alerts"}}]} ``` --- --- title: Update TLS versions description: Learn about update tls versions in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Update TLS versions In some circumstances - specifically when an application allows client-initiated SSL/TLS renegotiation - previous versions of SSL/TLS can be more vulnerable to DDoS attacks. When you use an SSL/TLS certificate issued by Cloudflare[1](#user-content-fn-1), you can reduce the impact of this vulnerability by: * Updating the [Minimum TLS Version](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/additional-options/minimum-tls/) accepted by your application. * Allowing [TLS 1.3](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/additional-options/tls-13/). ## Additional resources For more details on this vulnerability, refer to [Secure Server- and Client-Initiated SSL Renegotiation ↗](https://crashtest-security.com/secure-client-initiated-ssl-renegotiation/). ## Footnotes 1. Meaning either [Universal](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/universal-ssl/) or [Advanced](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/advanced-certificate-manager/) certificates. [↩](#user-content-fnref-1) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/tls-versions/#page","headline":"Update TLS versions · Cloudflare Learning Paths","description":"Learn about update tls versions in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/baseline/tls-versions/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/","name":"Baseline DDoS protection"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/baseline/tls-versions/","name":"Update TLS versions"}}]} ``` --- --- title: Concepts description: Prevent and mitigate DDoS attacks on applications. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Learn the concepts behind DDoS attacks and protection, whether you are using Cloudflare or another provider. ## Objectives By the end of this module, you will be able to: * Explain what a DDoS attack is and how it could affect your application. * List the common ways to prevent DDoS attacks. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Prevent and mitigate DDoS attacks on applications.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/concepts/","name":"Concepts"}}]} ``` --- --- title: What is a DDoS attack? description: Learn about what is a ddos attack? in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is a DDoS attack? A distributed denial-of-service (DDoS) attack is where a large number of computers or devices, usually controlled by a single attacker, attempt to access a website or online service all at once. This flood of traffic can overwhelm the website's origin servers, causing the site to slow down or even crash. sequenceDiagram; participant User; participant Website; participant Server; participant Botnet; User->>Website: Requests to access site Website->>Origin Server: Processes user requests Botnet->>Origin Server: Sends a flood of traffic Origin Server-->>Website: Slows down due to traffic overload Origin Server-->>User: Unable to respond to user requests To understand this, imagine a candy store with only a few employees. Normally, the employees can handle a steady stream of customers coming in to buy candy. However, if a large crowd of kids rush in all at once, it would be chaos. The employees may struggle to keep up with the demand and the store could become disorganized and overwhelmed. Similarly, a website's origin servers are designed to handle a certain amount of traffic at any given time, but a DDoS attack can cause an abnormally high amount of traffic to flood the servers all at once. This can cause the website to become unresponsive, leaving legitimate users unable to access the site. DDoS attacks can be devastating for businesses and organizations that rely on their websites or online services to operate. It can lead to lost revenue, damage to reputation, and potential security risks if the attack is used as a cover for more nefarious activity. ## Additional resources For more resources on DDoS attacks and how they work, refer to our [Learning Center ↗](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/ddos-attacks/#page","headline":"What is a DDoS attack? · Cloudflare Learning Paths","description":"Learn about what is a ddos attack? in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/ddos-attacks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/concepts/ddos-attacks/","name":"What is a DDoS attack?"}}]} ``` --- --- title: How to prevent DDoS attacks description: Learn about how to prevent ddos attacks in this guide. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # How to prevent DDoS attacks Since DDoS attacks target your web servers, the way to prevent them is to reduce requests reaching those servers. flowchart TD; A[Malicious device]-->|Request to application|CDN; CDN -->|Sends remaining requests|Origin; subgraph CDN WAF Cache end A --Prevent external connections---x Origin Requests can come to your origin server in two ways, from your web application and from direct connections to the server itself. --- ## Reduce application requests to the origin ### Caching A cache stores copies of frequently accessed resources (images, CSS files). When a resource is cached - either on a user's browser or Content Delivery Network (CDN) server - requests for that resource do not have to go to your origin server. Instead, these resources are served directly by the cache. flowchart TD; User-->|Sends Request|Cloudflare; Cloudflare-->B>Has cached content?]; B-->|Yes - Requested content|User; B-->|No|Origin; Origin-->|Requested content|User; In the context of DDoS attacks, caching reduces the number of requests going to your origin server, which makes it harder for your server to get overwhelmed by traffic. ### Web Application Firewall (WAF) A Web Application Firewall (WAF) creates a shield between a web app and the Internet. This shield checks incoming web requests and filters undesired traffic to help mitigate many common attacks. flowchart TD; User-->|Sends Request|WAF; WAF-->|Filters Request|Application; Application-->|Sends Request|OriginServer; OriginServer-->|Serves Content|Application; Application-->|Serves Content|User; ## Prevent external connections Generally, your origin server should only accept requests coming from your web application. This is a general best practice for security, but especially important in the context of DDoS attacks. Any traffic that bypasses your web application will also bypass any WAF or caching and has a stronger chance of overwhelming your origin. sequenceDiagram participant Client participant DDoS_Protection_Service participant Origin_Server Client->>+DDoS_Protection_Service: Request Note right of DDoS_Protection_Service: Filtered traffic DDoS_Protection_Service->>+Origin_Server: Request Origin_Server-->>-DDoS_Protection_Service: Response DDoS_Protection_Service-->>Client: Response Client->>+Origin_Server: Direct connection Note over Origin_Server: Potential DDoS Attack Origin_Server-->>-Client: Error response ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/ddos-prevention/#page","headline":"How to prevent DDoS attacks · Cloudflare Learning Paths","description":"Learn about how to prevent ddos attacks in this guide.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/ddos-prevention/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/prevent-ddos-attacks/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/prevent-ddos-attacks/concepts/ddos-prevention/","name":"How to prevent DDoS attacks"}}]} ``` --- --- title: Overview description: Store and manage data with Cloudflare R2. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Overview ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/#page","headline":"Overview · Cloudflare Learning Paths","description":"Store and manage data with Cloudflare R2.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/r2-intro/series/","name":"Overview"}}]} ``` --- --- title: Getting started with R2 description: Cloudflare R2 is an object storage solution designed to handle your data and files efficiently. It is ideal for various use cases, such as storing large media files, creating data lakes, or delivering web assets. R2 offers a flexible architecture to suit your needs, all with zero egress fees, meaning you don't have to worry about unexpected costs when moving your data. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Getting started with R2 * [ Watch this episode ](#tab-panel-9935) * [ Series overview ](#tab-panel-9936) Cloudflare R2 is an object storage solution designed to handle your data and files efficiently. It is ideal for various use cases, such as storing large media files, creating data lakes, or delivering web assets. R2 offers a flexible architecture to suit your needs, all with zero egress fees, meaning you don't have to worry about unexpected costs when moving your data. **Related content** If you want to dive into detail, refer to the following pages: * [Create new buckets](https://edgetunnel-b2h.pages.dev/r2/buckets/create-buckets/) * [Bucket-level operations](https://edgetunnel-b2h.pages.dev/r2/buckets/create-buckets/#bucket-level-operations) [ Watch Episode 1: Getting started with R2 ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/) In this video, you'll learn how to use Cloudflare R2 to store and manage data with no egress fees, supporting use cases like media, web assets, backups, and static site hosting. [ Watch Episode 2: Public buckets ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/) This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain or a Cloudflare managed subdomain. [ Watch Episode 3: S3 API compatibility ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/) In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. [ Watch Episode 4: Migrating your bucket data ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/) In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. [ Watch Episode 5: Accessing your bucket from Cloudflare Workers ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/) In this video, you will build a serverless file API using Cloudflare Workers and R2 by setting up a project, securing uploads, enabling caching, and deploying the application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/#page","headline":"Getting started with R2 · Cloudflare Learning Paths","description":"Cloudflare R2 is an object storage solution designed to handle your data and files efficiently. It is ideal for various use cases, such as storing large media files, creating data lakes, or delivering web assets. R2 offers a flexible architecture to suit your needs, all with zero egress fees, meaning you don't have to worry about unexpected costs when moving your data.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/r2-intro/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/r2-intro/series/r2-1/","name":"Getting started with R2"}}]} ``` --- --- title: Public buckets description: This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain for greater control over content management and security, or using a Cloudflare-managed subdomain for a simpler configuration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Public buckets * [ Watch this episode ](#tab-panel-9937) * [ Series overview ](#tab-panel-9938) This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain for greater control over content management and security, or a Cloudflare managed subdomain for a simpler configuration. **Related content** If you want to dive into detail, refer to the following pages: * [Public buckets](https://edgetunnel-b2h.pages.dev/r2/buckets/public-buckets/) * [Custom domains](https://edgetunnel-b2h.pages.dev/r2/buckets/public-buckets/#connect-a-bucket-to-a-custom-domain) [ Watch Episode 1: Getting started with R2 ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/) In this video, you'll learn how to use Cloudflare R2 to store and manage data with no egress fees, supporting use cases like media, web assets, backups, and static site hosting. [ Watch Episode 2: Public buckets ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/) This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain or a Cloudflare managed subdomain. [ Watch Episode 3: S3 API compatibility ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/) In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. [ Watch Episode 4: Migrating your bucket data ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/) In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. [ Watch Episode 5: Accessing your bucket from Cloudflare Workers ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/) In this video, you will build a serverless file API using Cloudflare Workers and R2 by setting up a project, securing uploads, enabling caching, and deploying the application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/#page","headline":"Public buckets · Cloudflare Learning Paths","description":"This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain for greater control over content management and security, or using a Cloudflare-managed subdomain for a simpler configuration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/r2-intro/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/r2-intro/series/r2-2/","name":"Public buckets"}}]} ``` --- --- title: S3 API compatibility description: In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # S3 API compatibility * [ Watch this episode ](#tab-panel-9939) * [ Series overview ](#tab-panel-9940) In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. **Related content** If you want to dive into detail, refer to the following pages: * [S3 API compatibility](https://edgetunnel-b2h.pages.dev/r2/api/s3/api/) * [Authenticate against R2 API using auth tokens](https://edgetunnel-b2h.pages.dev/r2/examples/authenticate-r2-auth-tokens/) * [Pre-signed URLs](https://edgetunnel-b2h.pages.dev/r2/api/s3/presigned-urls/) [ Watch Episode 1: Getting started with R2 ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/) In this video, you'll learn how to use Cloudflare R2 to store and manage data with no egress fees, supporting use cases like media, web assets, backups, and static site hosting. [ Watch Episode 2: Public buckets ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/) This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain or a Cloudflare managed subdomain. [ Watch Episode 3: S3 API compatibility ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/) In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. [ Watch Episode 4: Migrating your bucket data ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/) In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. [ Watch Episode 5: Accessing your bucket from Cloudflare Workers ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/) In this video, you will build a serverless file API using Cloudflare Workers and R2 by setting up a project, securing uploads, enabling caching, and deploying the application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/#page","headline":"S3 API compatibility · Cloudflare Learning Paths","description":"In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/r2-intro/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/r2-intro/series/r2-3/","name":"S3 API compatibility"}}]} ``` --- --- title: Migrating your bucket data description: In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. The video will demonstrate the step-by-step process of setting up and executing a data migration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Migrating your bucket data * [ Watch this episode ](#tab-panel-9941) * [ Series overview ](#tab-panel-9942) In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2\. The video will demonstrate the step-by-step process of setting up and executing a data migration. **Related content** If you want to dive into detail, refer to the following pages: * [Data migration overview](https://edgetunnel-b2h.pages.dev/r2/data-migration/) * [Migration strategies](https://edgetunnel-b2h.pages.dev/r2/data-migration/migration-strategies/) * [Super Slurper](https://edgetunnel-b2h.pages.dev/r2/data-migration/super-slurper/) * [Sippy](https://edgetunnel-b2h.pages.dev/r2/data-migration/sippy/) [ Watch Episode 1: Getting started with R2 ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/) In this video, you'll learn how to use Cloudflare R2 to store and manage data with no egress fees, supporting use cases like media, web assets, backups, and static site hosting. [ Watch Episode 2: Public buckets ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/) This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain or a Cloudflare managed subdomain. [ Watch Episode 3: S3 API compatibility ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/) In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. [ Watch Episode 4: Migrating your bucket data ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/) In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. [ Watch Episode 5: Accessing your bucket from Cloudflare Workers ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/) In this video, you will build a serverless file API using Cloudflare Workers and R2 by setting up a project, securing uploads, enabling caching, and deploying the application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/#page","headline":"Migrating your bucket data · Cloudflare Learning Paths","description":"In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. The video will demonstrate the step-by-step process of setting up and executing a data migration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/r2-intro/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/r2-intro/series/r2-4/","name":"Migrating your bucket data"}}]} ``` --- --- title: Accessing your bucket from Cloudflare Workers description: In this video, you will set up a Cloudflare Workers project and connect it to an existing or new R2 bucket. You will secure file uploads using authentication tokens, configure the Wrangler settings, and enable Smart Tiered Cache for optimal performance. Finally, you will deploy and test your serverless API to upload and retrieve files such as podcast episodes. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Accessing your bucket from Cloudflare Workers * [ Watch this episode ](#tab-panel-9943) * [ Series overview ](#tab-panel-9944) In this video, you will set up a Cloudflare Workers project and connect it to an existing or new R2 bucket. You will secure file uploads using authentication tokens, configure the Wrangler settings, and enable Smart Tiered Cache for optimal performance. Finally, you will deploy and test your serverless API to upload and retrieve files such as podcast episodes. **Related content** If you want to dive into detail, refer to the following pages: * [C3 CLI](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) * [AWS CLI example](https://edgetunnel-b2h.pages.dev/r2/examples/aws/aws-cli/) * [Wrangler configuration file](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/) [ Watch Episode 1: Getting started with R2 ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-1/) In this video, you'll learn how to use Cloudflare R2 to store and manage data with no egress fees, supporting use cases like media, web assets, backups, and static site hosting. [ Watch Episode 2: Public buckets ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-2/) This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain or a Cloudflare managed subdomain. [ Watch Episode 3: S3 API compatibility ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-3/) In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. [ Watch Episode 4: Migrating your bucket data ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-4/) In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. [ Watch Episode 5: Accessing your bucket from Cloudflare Workers ](https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/) In this video, you will build a serverless file API using Cloudflare Workers and R2 by setting up a project, securing uploads, enabling caching, and deploying the application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/#page","headline":"Accessing your bucket from Cloudflare Workers · Cloudflare Learning Paths","description":"In this video, you will set up a Cloudflare Workers project and connect it to an existing or new R2 bucket. You will secure file uploads using authentication tokens, configure the Wrangler settings, and enable Smart Tiered Cache for optimal performance. Finally, you will deploy and test your serverless API to upload and retrieve files such as podcast episodes.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/r2-intro/series/r2-5/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/r2-intro/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/r2-intro/series/r2-5/","name":"Accessing your bucket from Cloudflare Workers"}}]} ``` --- --- title: Build secure access policies description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build secure access policies With Cloudflare Zero Trust, you can apply granular security policies to all traffic proxied from the user device to your private network. Policies can key off of domain name, user identity, device posture, SNI, IP address, port, protocol, and other attributes. Building simple, well-structured policies is an important factor in having a secure organization with a manageable workflow. ## Objectives By the end of this module, you will be able to: * Create Zero Trust policies to secure access to your private network. * Enforce Cloudflare One Client session timeouts. * Display custom block messages. * Discover Shadow IT within your private network. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/#page","headline":"Build secure access policies · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}}]} ``` --- --- title: Gateway block page description: Set up custom Gateway block pages. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Gateway block page With Cloudflare Zero Trust, you can deliver actionable feedback to users when they are blocked by a Gateway policy. Custom block messages can reduce user confusion and decrease your IT ticket load. There are two different ways to surface block messages: * [Custom block page](#custom-block-page) * [Cloudflare One Client block notifications](#cloudflare-one-client-block-notifications) ## Custom block page You can display a custom block page in the browser when users are blocked by a Gateway DNS or HTTP policy. This is a static page that educates users on why they were blocked and how to contact IT. The custom block page has a few drawbacks: * To display the block page, you must install a [user-side certificate](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/enable-tls-decryption/#configure-user-side-certificates) on the end user device. * The block page does not appear when users are blocked by a Gateway network policy. * The custom block page only displays when the user loads a site in a browser. If, for instance, the user is allowed to visit a site but not allowed to upload a file, the file upload would fail silently and the user would not get a block page. To work around these limitations, we recommend using [Cloudflare One Client block notifications](#cloudflare-one-client-block-notifications). Note The Gateway custom block page is a different concept from [Access custom block pages](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-block-page/), which are used in conjunction with Cloudflare Access policies. ### Enable the block page for DNS policies For DNS policies, you will need to enable the block page on a per-policy basis. * [ Dashboard ](#tab-panel-9947) * [ Terraform (v5) ](#tab-panel-9948) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies** \> **DNS**. 2. Select **Add a policy** to create a new policy, or choose the policy you want to customize and select **Edit**. You can only edit the block page for policies with a Block action. 3. Under **Configure policy settings**, turn on **Modify Gateway block behavior**. 4. Choose your block behavior: * **Use account-level block setting**: Use the global block page setting configured in your account settings. The global setting can be the default Gateway block page, an [HTTP redirect](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page), or a [custom Gateway block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#customize-the-block-page). * **Override account setting with URL redirect**: Redirect users with a `307` HTTP redirect to a URL you specify on a policy level. 5. (Optional) If your account-level block page setting uses a custom Gateway block page, you can turn on **Add an additional message to your custom block page when traffic matches this policy** to add a custom message to your custom block page when traffic is blocked by this policy. This option will replace the **Message** field. 6. Select **Save policy**. Depending on your settings, Gateway will display a block page in your users' browsers or redirect them to a specified URL when they are blocked by this policy. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Choose a DNS policy with a Block action. 3. In the policy's [rule\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fpolicy), turn on `block_page_enabled`. If you have configured a [custom Gateway block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#customize-the-block-page), you can optionally show an additional `block_reason` when traffic is blocked by this policy. ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_block_security_categories" { name = "Block DNS Security Categories" enabled = true account_id = var.cloudflare_account_id description = "Managed by Terraform - Generic security policy based on Cloudflare Threat Intelligence categories." precedence = 101 action = "block" filters = ["dns"] /* Categories being enabled here: - 80: "Command and Control & Botnet" - 83: "Cryptomining" - 117: "Malware" - 131: "Phishing" - 153: "Spyware" - 175: "DNS Tunneling" - 176: "DGA Domains" - 178: "Brand Embedding" */ traffic = "any(dns.security_category[*] in {80 83 117 131 153 175 176 178})" identity = "" rule_settings = { block_page_enabled = true block_reason = "This domain has been flagged as a potential security risk." // Adds an additional message to the custom block page. Requires enabling custom block page in cloudflare_zero_trust_gateway_settings. } } ``` ### Customize the block page You can customize the Cloudflare-hosted block page by making global changes that Gateway will display every time a user reaches your block page. Customizations will apply regardless of the type of policy (DNS or HTTP) that blocks the traffic. To customize your block page: * [ Dashboard ](#tab-panel-9945) * [ Terraform (v5) ](#tab-panel-9946) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Custom pages**. 2. Under **Account Gateway block page**, select **Customize**. 3. Choose **Custom Gateway block page**. Gateway will display a preview of your custom block page. Available customizations include: * Your organization's name * [Logo](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#add-a-logo-image) * Header text * Global block message, which will be displayed above the policy-specific block message * [Mailto link](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#allow-users-to-email-an-administrator) * Background color 4. Select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. In [cloudflare\_zero\_trust\_gateway\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fsettings), configure the `block_page` argument with your customizations: ```tf resource "cloudflare_zero_trust_gateway_settings" "team_name" { account_id = var.cloudflare_account_id settings = { block_page = { enabled = true //do not use the default Gateway block page mode = "customized_block_page" //use a custom block page name = "Cloudflare" logo_path = "https://logos.com/a.png" header_text = "--header--" footer_text = "--footer--" mailto_address = "admin@example.com" mailto_subject = "Blocked Request" background_color = "#ffffff" suppress_footer = false } } } ``` Gateway will now display a custom Gateway block page when your users visit a blocked website. ## Cloudflare One Client block notifications Note Only available on Enterprise plans. For more granular user feedback, you can enable Cloudflare One Client block notifications on any Gateway DNS or Network _Block_ policy. Blocked users will receive an operating system notification from the Cloudflare One Client with a custom message you set. Client notifications provide additional functionality over the [custom block page](#custom-block-page): * Client notifications work with network policies, which means you can surface feedback for all partial actions on user traffic including blocking a specific port, file upload, or protocol. * Client notifications allow you to direct users to a unique link per individual policy. For example, you could link users to your organization's acceptable use policy, data protection policy, or any existing IT troubleshooting infrastructure. If no infrastructure for this exists within your organization, you can quickly deploy an HTML site on [Cloudflare Pages](https://edgetunnel-b2h.pages.dev/pages/), put the site behind a [Cloudflare Access policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/), and provide dynamic feedback based on the identity and device posture values found in the user's [Access JWT](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/block-page/#page","headline":"Gateway block page · Cloudflare Learning Paths","description":"Set up custom Gateway block pages.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/block-page/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/block-page/","name":"Gateway block page"}}]} ``` --- --- title: Create a list of IPs or domains description: Build reusable IP and domain lists. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a list of IPs or domains Gateway supports creating [lists](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/) of IPs, hostnames, or other entries to reference in your policies. It is likely that you will be onboarding to the Cloudflare platform with some predetermined series of security policies. Maybe you have explicit deny lists based on hostnames, IPs, or another measure that tie to individual users. Maybe some networks can access certain apex records while others cannot. The best way to migrate to Cloudflare in a way that will simplify ongoing maintenance is to build as many reusable objects as possible. Not only because that makes policy building simpler, but because as those applications, networks, and services organically change and grow, updates to the lists automatically update everywhere that the lists are applied. ## Create a list from a CSV file To test uploading CSV lists, you can download a [sample CSV file](https://edgetunnel-b2h.pages.dev/cloudflare-one/static/list-test.csv) of IP address ranges or copy the following into a file: **list-test.csv** ```csv value,description 192.0.2.0/24,This is an IP address range in CIDR format 198.51.100.0/24,This is also an IP address range 203.0.113.0/24,This is the third IP address range ``` When you format a CSV file for upload: * Each line should be a single entry that includes a value and an optional description. * A header row must be present for Zero Trust to recognize descriptions. * Trailing whitespace characters are not allowed. * CRLF (Windows) and LF (Unix) line endings are valid. To upload the list to the Cloudflare dashboard: * [ Dashboard ](#tab-panel-9949) * [ Terraform (v5) ](#tab-panel-9950) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Lists**. 2. Select **Upload CSV**. 3. Next, specify a **List name**, enter an optional description, and choose a **List type**. 4. Drag and drop a file into the **CSV file** window, or select a file. 5. Select **Create**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Decode the contents of the CSV file and store it as a local value: ```tf locals { ip_list = csvdecode(file("${path.module}/list-test.csv")) } ``` 3. Create a list using the [cloudflare\_zero\_trust\_list ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Flist) resource: ```tf resource "cloudflare_zero_trust_list" "ips_from_csv" { account_id = var.cloudflare_account_id name = "IPs imported from CSV" description = "Managed by Terraform" type = "IP" items = local.ip_list } ``` You can now use this list in the policy builder by choosing the _in list_ operator. ## Create a list manually * [ Dashboard ](#tab-panel-9951) * [ API ](#tab-panel-9952) * [ Terraform (v5) ](#tab-panel-9953) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Lists**. 2. Select **Create manual list**. 3. Next, specify a **List name**, enter an optional description, and choose a **List type**. 4. Enter your list element manually into the **Add entry** field and select **Add**. 5. Select **Save**. **Create Zero Trust list** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/lists" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "description": "Private application IPs", "items": [ { "value": "10.226.0.177/32" }, { "value": "10.226.1.177/32" } ], "name": "Corporate IP list", "type": "IP" }' ``` 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Create a list using the [cloudflare\_zero\_trust\_list ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Flist) resource. Example list of IPs: ```tf resource "cloudflare_zero_trust_list" "wiki_IPs" { account_id = var.cloudflare_account_id name = "Company Wiki IP addresses" description = "Managed by Terraform" type = "IP" items = [ { description = "Example IP address range" value = "192.0.2.0/24", }, { value = "198.51.100.0/24" } ] } ``` Example list of domains: ```tf resource "cloudflare_zero_trust_list" "wiki_domains" { account_id = var.cloudflare_account_id name = "Company Wiki Domains" description = "Managed by Terraform" type = "DOMAIN" items = [ { value = "wiki.example.com" }, { value = "wiki2.example.com" }] } ``` You can now use this list in the policy builder by choosing the _in list_ operator. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/create-list/#page","headline":"Create a list of IPs or domains · Cloudflare Learning Paths","description":"Build reusable IP and domain lists.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/create-list/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/create-list/","name":"Create a list of IPs or domains"}}]} ``` --- --- title: Secure your first application description: Create policies for your first application. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Secure your first application To ensure holistic security precautions, we recommend securing each distinct private application with at least two policies: * A [Gateway DNS policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/) with the appropriate identity and device posture values, targeting the domain list that defines your application. Policy enforcement happens at the request resolution event, before the user's device makes a connection request to the application itself; if denied here, no traffic will reach your private network. * A [Gateway network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) with the same identity and device posture values as the DNS policy, targeting the IP list that defines your application. You can optionally include the domain list by matching the SNI header. Then, you can include any combinations of ports or protocols that are relevant for application access. Network policy enforcement happens after the user passes the DNS policy, when the user's device attempts to connect to the target application. ## Create a Gateway policy To create a new policy, open the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) and go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. ## Example DNS policy * [ Dashboard ](#tab-panel-9954) * [ API ](#tab-panel-9955) * [ Terraform (v5) ](#tab-panel-9956) | Traffic Selector | Operator | Value | | ---------------- | -------- | -------------------- | | Domain | in list | Company Wiki domains | | Identity Selector | Operator | Value | | ----------------- | ------------- | --------------- | | User email | matches regex | .\*@example.com | | Action | | ------ | | Allow | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "name": "Company Wiki DNS policy", "conditions": [ { "type": "traffic", "expression": { "any": { "in": { "lhs": { "splat": "dns.domains" }, "rhs": "$" } } } }, { "type": "identity", "expression": { "matches": { "lhs": "identity.email", "rhs": ".*@example.com" } } } ], "action": "allow", "precedence": 13002, "enabled": true, "description": "Allow employees to access company wiki domains.", "filters": [ "dns" ] }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_allow_wiki_domains" { name = "Company Wiki DNS policy" enabled = true account_id = var.cloudflare_account_id description = "Managed by Terraform - Allow employees to access company wiki domains." precedence = 102 action = "allow" filters = ["dns"] traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.wiki_domains.id})" identity = "identity.email matches \".*@example.com\"" } ``` ## Example network policy * [ Dashboard ](#tab-panel-9957) * [ API ](#tab-panel-9958) * [ Terraform (v5) ](#tab-panel-9959) | Traffic Selector | Operator | Value | | ---------------- | -------- | ---------------- | | Destination IP | in list | Company Wiki IPs | | Identity Selector | Operator | Value | | ----------------- | ------------- | --------------- | | User Email | matches regex | .\*@example.com | | Action | | ------ | | Allow | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "name": "Company Wiki network policy", "conditions": [ { "type": "traffic", "expression": { "in": { "lhs": "net.dst.ip", "rhs": "$" } } }, { "type": "identity", "expression": { "matches": { "lhs": "identity.email", "rhs": ".*@example.com" } } } ], "action": "allow", "precedence": 13002, "enabled": true, "description": "Allow employees to access company wiki IPs.", "filters": [ "l4" ] }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "network_allow_wiki_IPs" { name = "Company Wiki Network policy" enabled = true account_id = var.cloudflare_account_id description = "Managed by Terraform - Allow employees to access company wiki IPs." precedence = 103 action = "allow" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.wiki_IPs.id}" identity = "identity.email matches \".*@example.com\"" } ``` ### Catch-all policy We recommend adding a catch-all policy to the bottom of your network policy list. An effective Zero Trust model should prioritize default-deny actions to avoid any overly permissive policy building. For example, * [ Dashboard ](#tab-panel-9960) * [ API ](#tab-panel-9961) * [ Terraform (v5) ](#tab-panel-9962) | Traffic Selector | Operator | Value | Logic | | ---------------- | -------- | -------------------------- | ----- | | Destination IP | in list | All private network ranges | Or | | SNI Domain | in list | All private apex domains | | | Action | | ------ | | Block | ```bash curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "name": "Catch-all block policy", "conditions": [ { "type": "traffic", "expression": { "or": [ { "in": { "lhs": "net.dst.ip", "rhs": "$" } }, { "any": { "in": { "lhs": { "splat": "net.sni.domains" }, "rhs": "$" } } } ] } } ], "action": "block", "precedence": 14002, "enabled": true, "description": "Block access to private network.", "filters": [ "l4" ] }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "network_catch_all" { name = "Catch-all block policy" enabled = true account_id = var.cloudflare_account_id description = "Managed by Terraform - Block access to private network." precedence = 14002 action = "block" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.private_IPs.id} or any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.private_domains.id})" } ``` Network policies are evaluated in [top-down order](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence), so if a user does not match an explicitly defined policy for an application, they will be blocked. To learn how multiple policies interact, refer to [Order of enforcement](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/order-of-enforcement/). Note It is not recommended to employ a default-deny model while testing. Instead, build your explicit application policies and [monitor your logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) to determine if your policies are working as expected. If you do not see the policies triggering in your logs, you may need to tune your policies and review what kind of information (identity groups, device posture values, etc.) is being sent with your traffic. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/create-policy/#page","headline":"Secure your first application · Cloudflare Learning Paths","description":"Create policies for your first application.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/create-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/create-policy/","name":"Secure your first application"}}]} ``` --- --- title: Policy design description: Design Zero Trust access policies. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Policy design Most policy building for private network access happens within the Gateway DNS and Gateway Network policy builders. For the most part, customers use a mixture of DNS resolution, SNI hostname values, and IP address groupings as the baseline for defining policies that pertain to specific applications. ## Considerations Before building your policies, it is helpful to ask yourself a few questions: * Should all users and services be able to reach all connected subnets? Are there explicit exceptions? * Do all applications live within a primary network range, and are they defined by static or dynamic hosts and IP addresses? * Are there DevOps workflows that rely on completely ephemeral IPs or subdomains? * Do you have sources of truth for identity and device posture that will be used in policies? * Do you plan to immediately implement a default-deny model? In other words, will you block all users except for those who match an explicit Allow policy? ## Prepare to build policies We recommend the following approach when planning your Zero Trust Network Access policies. ### 1\. Determine your sources of truth #### Identity Determine which identity provider you will use as the source of truth for user email, user groups, and other [identity-based attributes](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/identity-selectors/). Note Ensure that the [identity provider is connected to Cloudflare](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/configure-idp/) and available to users in your [device enrollment permissions](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/device-enrollment-permissions/). If you plan to grant access to services based on group membership, [view the user registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/users/) and verify that the target users have that group value in their User Registry. #### Device posture Most customers will also build policies that are contingent on the use of a corporate device. For example, all users on corporate devices can access `*.jira.internal.com`, but users on personal devices can only access `dev.internal.jira.com`. In order for this to be effective, we recommend defining a source of truth for your corporate devices. This is sometimes the presence of a specific [issued certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/client-certificate/), the presence of a [process with a matched hash](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/application-check/), or an API integration with a supported [thirty-party endpoint security provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/service-providers/) like Crowdstrike or SentinelOne. Note Be sure to [enable the device posture checks](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/) that you want to use in your policies. ### 2\. Define your networks Almost all businesses have a series of interconnected networks, either physical or virtual. Prepare a list of all relevant networks, subnets, or segments within your network that users currently access, either locally or when using the VPN. For example, | Network name | Location | IP range | Accessible by VPN? | | ------------ | --------------------- | ---------- | ------------------ | | Corporate DC | AWS US East - VA, USA | 10.0.0.0/8 | Yes | ### 3\. Define your applications Next, prepare a list of all relevant internal applications on your networks that will have distinct policy requirements (for example, different user identity or device posture requirements). Each application should be defined by an IP list, a hostname/domain list, or sometimes both. | Application name | Local IPs | Hostnames | Accessible via IP? | Static or dynamic IP? | | ---------------- | ----------- | ----------------- | ------------------ | --------------------- | | Company Wiki | 10.128.0.10 | wiki.internal.com | Yes | Static | For example, you may have an application at `a.internal.com` which points to a load balancer with a static IP address, balancing a series of dynamic hosts serving the application on `a.internal.com`. Because the IPs of the application hosts are dynamic, the best practice would be to build two policies: a network policy for the load balancer IP, and a DNS policy for the application hostnames. On the other hand, if the IPs behind the load balancer are static or only semi-dynamic, it may make sense to directly use the application IPs in your network policy. You can build a workflow to update the application IP list via a Cloudflare API call whenever host changes are made in your infrastructure provider. ### 4\. List existing policies Gather any existing security policies or block lists that you wish to migrate from your VPN provider to Zero Trust. Descaler program If you are an Enterprise organization migrating from Zscaler, you can use our [Descaler toolkit ↗](https://blog.cloudflare.com/descaler-program/) to export policies from Zscaler Internet Access (ZIA) and import them into Cloudflare Gateway. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/policy-design/#page","headline":"Policy design · Cloudflare Learning Paths","description":"Design Zero Trust access policies.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/policy-design/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/policy-design/","name":"Policy design"}}]} ``` --- --- title: Session timeouts description: Configure WARP session timeout settings. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Session timeouts Most legacy VPNs have a global timeout setting that requires end users to log in every X hours or resets VPN profiles at a certain frequency. By doing continuous identity evaluation, a Zero Trust security model eliminates the need for most of the user-interrupting workflows triggered by session timeouts. However, there can still be valid reasons to want users to reauthenticate, either on a recurring basis or to access specific, highly-sensitive or regulated internal services. To enforce Cloudflare One Client reauthentication, you can configure the Cloudflare One Client session timeouts on a per-application basis in your Gateway network policies. When a user goes to a protected application or website, Cloudflare checks their device client session duration against the configured session timeout. If the session has expired, the user will be prompted to re-authenticate with the identity provider (IdP) used to enroll in the Cloudflare One Client. ![Cloudflare One Client prompts user to re-authenticate session.](https://edgetunnel-b2h.pages.dev/_astro/warp-reauthenticate-session.BjGtdKWz_18URJV.webp) _Note: Labels in this image may reflect a previous product name._ A user's device client session duration resets to zero whenever they re-authenticate with the IdP, regardless of what triggered the authentication event. ## Configure Cloudflare One Client session timeout You can enforce device client session timeouts on any Gateway Network and HTTP policy that has an Allow action. If you do not specify a session timeout, the device client session will be unlimited by default. Session timeouts have no impact on Gateway DNS policies. DNS policies remain active even when a user needs to re-authenticate. To configure a session timeout for a Gateway policy: * [ Dashboard ](#tab-panel-9963) * [ Terraform (v5) ](#tab-panel-9964) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. Choose either **Network** or **HTTP**. 2. Add a policy and select the _Allow_ action. Alternatively, choose any existing _Allow_ policy. 3. Under **Step 4 - Configure policy settings**, select **Edit** next to **Enforce Cloudflare One Client session duration**. 4. Enter a session expiration time in `1h30m0s` format and save. 5. Save the policy. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Choose a Network (`l4`) or HTTP (`http`) policy with an Allow action. 3. In the policy's [rule\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fpolicy), use the `check_session` argument to enable and configure a session timeout: ```tf resource "cloudflare_zero_trust_gateway_policy" "network_allow_wiki_IPs" { name = "Company Wiki Network policy" enabled = true account_id = var.cloudflare_account_id description = "Managed by Terraform - Allow employees to access company wiki IPs." precedence = 103 action = "allow" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.wiki_IPs.id}" identity = "identity.email matches \".*@example.com\"" rule_settings = { check_session = { enforce = true duration = "1h30m0s" } } } ``` Session checks are now enabled for the application protected by this policy. Users can continue to reach applications outside of the policy definition. ## Global timeouts To set a global reauthentication event, similar to a global timeout on a traditional VPN, we recommend setting all of your Gateway Network Allow policies to the same baseline Cloudflare One Client session duration (typically between 3-7 days). This will ensure that whenever your user tries to access any application on the private network within that window, they will be forced to reauthenticate with your identity provider when they have not logged in for your chosen number of days. If a specific application requires a more stringent reauthentication timeline, users accessing that application will not have to complete the baseline reauthentication event because they are already in compliance with the baseline policy. Note A global timeout does not necessarily fit all customer needs. With the increased interrogation of traffic offered by ZTNA compared to traditional remote access, many customers choose not to use a global reauthentication event and instead only use reauthentication for specific applications. ### Common mistake When configuring a global Cloudflare One Client session duration, a common mistake is to build a single policy that covers your entire private network range. An example would be an Allow policy that requires reauthentication every 7 days for all users with traffic to a destination IP in `10.0.0.0/8`. This type of global policy may result in a suboptimal user experience because an expired session blocks the user from the entire internal network (including private DNS functionality) instead of specific applications. If a user misses the one-time reauth notification, they may not know that they need to manually go into their Cloudflare One Client settings to reauthenticate. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/session-timeouts/#page","headline":"Session timeouts · Cloudflare Learning Paths","description":"Configure WARP session timeout settings.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/session-timeouts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/session-timeouts/","name":"Session timeouts"}}]} ``` --- --- title: Shadow IT discovery description: Discover unapproved applications with Shadow IT. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Shadow IT discovery [Shadow IT ↗](https://www.cloudflare.com/learning/access-management/what-is-shadow-it/) refers to the unsanctioned use of software, hardware, or other systems and services within an organization, often without the knowledge of that organization's information technology (IT) department. After you have built your initial set of application policies and have users using Cloudflare Zero Trust as a replacement for your VPN, review your [Shadow IT discovery report](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/shadow-it-discovery/#private-network-origins) to determine what kind of services are seeing the most traffic on your network. In almost all cases, businesses very quickly find unknown, usually widely accessed resources. As you find new (and sometimes surprising) services within that list, modify your Gateway policies to allow or block these services. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/shadow-it/#page","headline":"Shadow IT discovery · Cloudflare Learning Paths","description":"Discover unapproved applications with Shadow IT.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/shadow-it/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/shadow-it/","name":"Shadow IT discovery"}}]} ``` --- --- title: Test your first application description: Test Zero Trust policies on an application. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Test your first application You have now set up your [Zero Trust organization](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/), [configured the Cloudflare One Client](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/), [installed it on devices](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/), and created your [Access and Gateway policies](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/). The next step is to test those policies. ## 1\. Manually test your policies Test if the Access or Gateway policy that you configured is working by using a device with the Cloudflare One Client installed to reach an internal application or external website. If you cannot reach an application protected by Access or an external application through Gateway as expected, Cloudflare recommends starting with reviewing your Cloudflare One Client configuration. ### 1.1\. Troubleshoot the Cloudflare One Client If your manual test fails, troubleshoot the Cloudflare One Client. Cloudflare recommends starting with reviewing your Cloudflare One Client configuration because misconfiguration is the most common cause of connectivity issues. * [WARP troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/): Step-by-step instructions to debug Cloudflare One Client issues. * [Cloudflare One Client errors](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/client-errors/): If you are receiving an error, review the associated solutions. * [Cloudflare One Client connectivity status](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/connectivity-status/): Review the connectivity stage of the WARP daemon as it establishes a connection from the device to Cloudflare. * [WARP with Firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/): Ensure you have exempted the correct IP addresses and domains to allow the Cloudflare One Client to connect. ### 1.2\. Review analytics Analytics provide visualizations of [log data](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/test-your-first-application/#review-logs). To review Access or Gateway analytics: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Analytics** \> **Dashboards**. 2. Select **[Access event analytics](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/access/)** for a summary of login events or **[Application Access Report](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/application-access/)** for a summary of overall Access Activity. 3. Select the **HTTP request analytics**, **DNS query analytics** or **Network session analytics** depending on [your Gateway investigation scope](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/gateway/). ### 1.3\. Review logs [Logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/) provide event-level (such as an authentication attempt or a DNS query) visibility into your Cloudflare One environment. To review traffic activity for applications protected by Access: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Logs**. 2. Select **Access authentication logs**. 3. Review the [per-request logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#per-request-logs) for your application. To review traffic activity in the [Gateway logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/): 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Logs**. 2. Select **HTTP request logs**, **Network logs**, or **DNS query logs** depending on your investigation scope. Refer to [Troubleshoot Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/troubleshoot-gateway/) to troubleshoot common issues with Gateway egress policies. ## 2\. Monitor your policies and device connectivity After you confirm your policies work by testing manually, use DEX to monitor connectivity and performance over time. Digital Experience Monitoring (DEX) provides visibility into device, network, and application performance across your Zero Trust organization. With DEX, you can monitor the state of your [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) deployment and resolve issues impacting end-user productivity. DEX is designed for IT and security teams who need to proactively monitor and troubleshoot device and network health across distributed environments. DEX is available on all Cloudflare Zero Trust and SASE plans. Refer to [Digital Experience Monitoring (DEX)](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) for more information. ### Example use case * Imagine that you have three devices, with the Cloudflare One Client installed, set up in your testing environment. * You have set up a [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) and an [Access policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) for your internal wiki that is available at `wiki.acme.org`. * You [manually tested](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/test-your-first-application/#manually-test-your-policies) the three Cloudflare One Client devices, and you confirmed they can all reach `wiki.acme.org`. * You want to set up automated connectivity and performance testing to `wiki.acme.org` for each of these Cloudflare One Client devices so you can monitor them over time. * You set up a DEX test, and it sends an HTTP GET request to `wiki.acme.org` from all three devices on a five minute interval. * If device connectivity drops, or if there are performance problems, you can see the DEX test results to troubleshoot the problem. ### 2.1\. Create a DEX test With Digital Experience Monitoring (DEX), you can test if your devices can connect to a private or public endpoint through the Cloudflare One Client. Tests allow you to monitor availability for a given application and investigate performance issues reported by your end users. Refer to [DEX tests](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/tests/) for more information. An HTTP test sends a `GET` request from an end-user device to a specific web application. You can use the response metrics to troubleshoot connectivity issues. For example, you can check whether the application is inaccessible for all users in your organization, or only certain ones. To set up an HTTP test for an application: 1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Insights** \> **Digital experience**. 2. Select the **Tests** tab. 3. Select **Add a Test**. 4. Fill in the following fields: * **Name**: Enter any name for the test. * **Target**: Enter the URL of the website or application that you want to test (for example, `https://jira.site.com`). Both public and private hostnames are supported. If testing a private hostname, ensure that the domain is on your [local domain fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) list. * **Source device profiles**: (Optional) Select the [device profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) that you want to run the test on. If no profiles are selected, the test will run on all supported devices connected to your Zero Trust organization. * **Test type**: Select _HTTP Get_. * **Test frequency**: Specify how often the test will run. Input a minute value between 5 and 60. 5. Select **Add test**. 6. After the test is created and running, you can [view the results](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/tests/view-results/) of your test. #### HTTP test results An HTTP test measures the following data: | Data | Description | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Resource fetch time | Total time of all steps of the request, measured from [startTime to responseEnd ↗](https://developer.mozilla.org/en-US/docs/Web/API/Performance%5FAPI/Resource%5Ftiming). | | Server response time | Round-trip time for the device to receive a response from the target. | | DNS response time | Round-trip time for the DNS query to resolve. | | HTTP status codes | [Status code ↗](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status) returned by the target. | ### 2.2\. Set up notifications Administrators can receive alerts when Cloudflare detects connectivity issues with the Cloudflare One Client or degraded application performance. Notifications can be delivered via email, webhook, and third-party services. Refer to [DEX Notifications](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/notifications/) for more information on DEX-specific notifications. #### Device anomaly notification setup Customers who want to be notified when Cloudflare detects a spike or drop in the number of devices connected to the Cloudflare One Client can create a [Device connectivity anomaly](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/notifications/#available-notifications) notification. To create a device connectivity anomaly notification: 1. In the Cloudflare dashboard, go to the **Notifications** page. [ Go to **Notifications** ](https://dash.cloudflare.com/?to=/:account/notifications) 2. Select **Add**. 3. Find **Product** DEX and **Alert type** Device connectivity anomaly, and choose **Select**. 4. Name the notification. 5. Enter an email address to receive the notifications or set up a [webhook](https://edgetunnel-b2h.pages.dev/notifications/get-started/configure-webhooks/). 6. (Optional) Specify any additional options for the notification, if required. For example, some notifications require that you select one or more domains or services. 7. Select **Create**. Refer to [Notifications](https://edgetunnel-b2h.pages.dev/notifications/get-started/) for more information on editing, testing, and disabling notifications. ## Conclusion Once your policies are live, you can use [DEX tests](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/test-your-first-application/#create-a-dex-test) and [notifications](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/test-your-first-application/#notifications) to ensure your team has secure, reliable access to internal and external resources. How it all works together To learn how to use Logs, Analytics, and DEX together during real-world situations, like onboarding, daily monitoring, and troubleshooting, refer to [Insights](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/) for more example use cases. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/test-your-first-application/#page","headline":"Test your first application · Cloudflare Learning Paths","description":"Test Zero Trust policies on an application.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/test-your-first-application/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/build-policies/","name":"Build secure access policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/build-policies/test-your-first-application/","name":"Test your first application"}}]} ``` --- --- title: Concepts description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Concepts explain the basic ideas behind how Cloudflare Zero Trust works. ## Objectives By the end of this module, you will be able to: * Explain how Cloudflare works. * Describe the purpose of a VPN. * Understand the benefits of switching to a Zero Trust architecture. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/concepts/","name":"Concepts"}}]} ``` --- --- title: What is a VPN? description: Understand how VPNs create encrypted tunnels. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is a VPN? A virtual private network (VPN) is an Internet security service that allows users to access the Internet as though they were connected to a private network. This encrypts Internet communications and provides a strong degree of anonymity. Some of the most common reasons people use VPNs are to protect against snooping on public WiFi, to circumvent Internet censorship, or to connect to a business’s internal network for the purpose of remote work. ## Why use a VPN Ordinarily, most Internet traffic is unencrypted and very public. When a user creates an Internet connection, such as visiting a website in a browser, the user’s device will connect to their Internet Service Provider (ISP). The ISP will then connect to the Internet to find the appropriate web server to communicate with to fetch the request website. Information about the user is exposed in every step of the website request. Since the user’s IP address is exposed throughout the process, the ISP and any other intermediary can keep logs of the user’s browsing habits. Additionally, the data flowing between the user’s device and the web server is unencrypted; this creates opportunities for malicious actors to spy on the data or perpetrate attacks on the user, such as an [on-path attack ↗](https://www.cloudflare.com/learning/security/threats/on-path-attack/). ## How a VPN works A user connecting to the Internet using a VPN service has a higher level of security and privacy. flowchart LR accTitle: How a VPN works subgraph Device A(VPN client) end A<--Encrypted VPN tunnel-->B(VPN server)<-->C((Internet)) A VPN connection involves the following four steps: 1. The VPN client connects to the ISP using an encrypted connection. 2. The ISP connects the VPN client to the VPN server, maintaining the encrypted connection. 3. The VPN server decrypts the data from the user’s device and then connects to the Internet to access the web server in an unencrypted communication. 4. The VPN server creates an encrypted connection with the client, known as a VPN tunnel. The VPN tunnel between the VPN client and VPN server passes through the ISP, but since all the data is encrypted, the ISP cannot see the user’s activity. The VPN server’s communications with the Internet are unencrypted, but the web servers will only log the IP address of the VPN server, which gives them no information about the user. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/vpn-overview/#page","headline":"What is a VPN? · Cloudflare Learning Paths","description":"Understand how VPNs create encrypted tunnels.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/vpn-overview/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/concepts/vpn-overview/","name":"What is a VPN?"}}]} ``` --- --- title: What is Cloudflare? description: Learn about Cloudflare's global network. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Cloudflare? Cloudflare is one of the world's largest [connectivity cloud networks ↗](https://blog.cloudflare.com/welcome-to-connectivity-cloud). Today, anyone with an Internet presence can have faster and more secure websites and applications thanks to Cloudflare. This includes bloggers, businesses, and even non-profits. Millions of Internet properties are on Cloudflare, and our network is growing by tens of thousands each day. Cloudflare powers Internet requests for millions of websites and serves 55 million HTTP requests per second on average. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/what-is-cloudflare/#page","headline":"What is Cloudflare? · Cloudflare Learning Paths","description":"Learn about Cloudflare's global network.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/what-is-cloudflare/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/concepts/what-is-cloudflare/","name":"What is Cloudflare?"}}]} ``` --- --- title: Why should you replace your VPN? description: Learn benefits of Zero Trust over VPNs. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Why should you replace your VPN? Many organizations rely on VPNs to protect their data, but for many reasons, VPNs are often not ideal for defending against today's risks. ## Downsides of a VPN VPNs invoke a perimeter-based security model (often called the [castle-and-moat model ↗](https://www.cloudflare.com/learning/access-management/castle-and-moat-network-security/)), which grant users access to the entire internal network once they login to the VPN client. In castle-and-moat security, it is hard to obtain access from outside the network, but everyone inside the network is trusted by default. The problem with this approach is that once an attacker gains access to the network, they have free rein over everything inside. In the modern digital landscape, where users can access resources from various locations and devices, this concept of a fixed perimeter is no longer effective. ## ZTNA vs. VPNs [Zero Trust Network Access (ZTNA) ↗](https://www.cloudflare.com/learning/access-management/what-is-ztna/) is the main technology that enables organizations to transition from a traditional VPN configuration to a more secure and modern approach. **Insider threats** — ZTNA enhances security by assuming that threats may exist both inside and outside the network. Whereas a VPN implicitly trusts all logged-in users, ZTNA emphasizes the [principle of least privilege ↗](https://www.cloudflare.com/learning/access-management/principle-of-least-privilege/) and enforces continuous verification of user identity. **Network security** — A ZTNA architecture reduces the blast radius of potential threats by facilitating network [micro-segmentation ↗](https://www.cloudflare.com/learning/access-management/what-is-microsegmentation/). Unlike VPNs, which grant users access to the entire corporate network, ZTNA only grants access to a specific application and denies access to all other resources by default. **Performance** — ZTNA connects users to corporate networks via [the cloud ↗](https://www.cloudflare.com/learning/cloud/what-is-the-cloud/) instead of via on-premise VPN servers. This enables users to connect from anywhere without experiencing performance degradation and integrates more easily with cloud-based infrastructure. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/why-vpn/#page","headline":"Why should you replace your VPN? · Cloudflare Learning Paths","description":"Learn benefits of Zero Trust over VPNs.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/concepts/why-vpn/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/concepts/why-vpn/","name":"Why should you replace your VPN?"}}]} ``` --- --- title: Configure the device agent description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure the device agent The Cloudflare One Client (known as the Cloudflare One Agent in mobile app stores) encrypts designated traffic from a user's device to Cloudflare's global network. In this learning path, we will first define all of your parameters and deployment rules, and then we will install and connect the client. If you prefer to start the client download now, refer to [Download the Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). Note The following steps are identical to [Configure the device agent](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/) in the Secure your Internet traffic and SaaS apps implementation guide. If you have already completed Secure your Internet traffic and SaaS apps, you can skip ahead to [Connect user devices](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/). ## Objectives By the end of this module, you will be able to: * Define which users can connect devices to your Zero Trust instance. * Configure global and device-specific settings for the Cloudflare One Client. * Route user traffic through Cloudflare Gateway. * Route domains to a private DNS server, if required. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/#page","headline":"Configure the device agent · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/","name":"Configure the device agent"}}]} ``` --- --- title: Define device enrollment permissions description: Control which devices can enroll. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Define device enrollment permissions Device enrollment permissions determine which users can connect new devices to your organization's Cloudflare Zero Trust instance. Once the user registers their device, the Cloudflare One Client will store their identity token and use it to authenticate to services in your private network. ## Set device enrollment permissions * [ Dashboard ](#tab-panel-9965) * [ Terraform (v5) ](#tab-panel-9966) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **Management**. 2. In **Device enrollment** \> **Device enrollment permissions**, select **Manage**. 3. In the **Policies** tab, configure one or more [Access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) to define who can join their device. For example, you could allow all users with a company email address: | Rule type | Selector | Value | | --------- | ---------------- | ------------ | | Include | Emails ending in | @company.com | Note Device posture checks are not supported in device enrollment policies. The Cloudflare One Client (formerly WARP) can only perform posture checks after the device is enrolled. 1. In the **Login methods** tab: a. Select the [identity providers](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/). b. (Optional) If you plan to only allow access via a single IdP, turn on **Apply instant authentication**. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event. 2. Select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Apps and Policies Write` 2. Create a reusable Access policy using the [cloudflare\_zero\_trust\_access\_policy ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fpolicy) resource: ```tf resource "cloudflare_zero_trust_access_policy" "allow_company_emails" { account_id = var.cloudflare_account_id name = "Allow company emails" decision = "allow" include = [ { email_domain = { domain = "@example.com" } } ] } ``` 3. Use the [cloudflare\_zero\_trust\_access\_application ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fapplication) resource to create an application with type `warp`. ```tf resource "cloudflare_zero_trust_access_application" "device_enrollment" { account_id = var.cloudflare_account_id type = "warp" name = "Warp device enrollment" allowed_idps = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id] auto_redirect_to_identity = true app_launcher_visible = false policies = [ { id = cloudflare_zero_trust_access_policy.allow_company_emails.id precedence = 1 } ] } ``` ## Only allow corporate devices Device posture evaluation happens after a device has already enrolled in your Zero Trust organization. If you want only specific devices to be able to enroll, we recommend adding a [mutual TLS authentication](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/) rule to your device enrollment policy. This rule will check for the presence of a specific client certificate on the enrolling devices. Note Mutual TLS authentication is only available on Enterprise plans. Certificate requirements * The CA certificate can be from a publicly trusted CA or self-signed. * In the certificate `Basic Constraints`, the attribute `CA` must be set to `TRUE`. * The certificate must use one of the signature algorithms listed below: Allowed signature algorithms `x509.SHA1WithRSA` `x509.SHA256WithRSA` `x509.SHA384WithRSA` `x509.SHA512WithRSA` `x509.ECDSAWithSHA1` `x509.ECDSAWithSHA256` `x509.ECDSAWithSHA384` `x509.ECDSAWithSHA512` To check for an mTLS certificate: * [ Dashboard ](#tab-panel-9967) * [ Terraform (v5) ](#tab-panel-9968) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Service credentials** \> **Mutual TLS**. 2. Select **Add mTLS Certificate**. 3. Enter any name for the root CA. 4. In **Certificate content**, paste the contents of your root CA. If the client certificate is directly signed by the root CA, you only need to upload the root. If the client certificate is signed by an intermediate certificate, you must upload the entire CA chain (intermediate and root). For example: ```txt -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- ``` 1. In **Associated hostnames**, enter your Zero Trust team domain: `.cloudflareaccess.com` 2. In your [device enrollment permissions](#set-device-enrollment-permissions), add a _Common Name_ or _Valid Certificate_ rule. For example, the following policy requires a client certificate with a specific common name: | Action | Rule type | Selector | Value | | ------ | --------- | ----------- | ------------------ | | Allow | Require | Common Name | | 3. On your device, add the client certificate to the [system keychain](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#test-in-the-browser). 1. Add the following permissions to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Mutual TLS Certificates Write` * `Access: Apps and Policies Write` 2. Use the [cloudflare\_zero\_trust\_access\_mtls\_certificate ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fmtls%5Fcertificate) resource to add an mTLS certificate to your account: ```tf resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" { account_id = var.cloudflare_account_id name = "WARP enrollment mTLS cert" certificate = < Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Customize device profiles A device profile defines [Cloudflare One Client settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) for a specific set of devices in your organization. You can create multiple profiles and apply different settings based on the user's identity, the device's location, and other criteria. For example, users in one identity provider group (signifying a specific office location) might have different routes that need to be excluded from their WARP tunnel, or some device types (like Linux) might need different DNS settings to accommodate local development services. ## Configure the default profile Set your default device profile to be applicable to a majority of your userbase, or any user without known explicit considerations. To customize the default settings: * [ Dashboard ](#tab-panel-9969) * [ API ](#tab-panel-9970) * [ Terraform (v5) ](#tab-panel-9971) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Select the **Default** profile and select \*_Edit_. 3. Many users running Cloudflare Zero Trust as a VPN replacement have a default profile that resembles the following. Refer to [Cloudflare One Client settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) for a description of each setting. | Setting | State | Notes | | ------------------------------------ | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Captive portal detection | Enabled | | | Mode switch | Disabled | If enabled, users have the option to switch to a DNS-only security mode and lose access to your private network. Usually disabled for a VPN replacement use case. | | Lock device client switch | Enabled | Should be enabled unless users have an explicit reason to disable the device client, such as a conflicting VPN client on the device or other extenuating circumstances. If disabled for concerns about user experience, **Auto Connect** should be enabled and set on a short interval, like 10-15 minutes. | | Allow device to leave organization | Disabled | | | Allow updates | Disabled | Usually disabled on managed devices. If enabled, users who are local administrators on their device can update the Cloudflare One Client on their own — this can introduce version consistency control issues if client versions are centrally managed by IT. | | Auto connect | Enabled | Timeout is usually set between 10min - 30min. | | Support URL | Enabled | | | Service mode | Traffic and DNS mode | Proxies device traffic to Cloudflare according to your Split Tunnel rules. | | Local Domain Fallback | | Refer to [Resolve Private DNS](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/private-dns/). | | Split Tunnels | Exclude IPs and domains | Refer to [Define Split Tunnels settings](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/split-tunnel-settings/). | | Directly route Microsoft 365 traffic | Disabled | Usually disabled to allow inspection of Microsoft 365 traffic. | 4. Save the profile. 5. Configure [global settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#global-settings) for all device profiles: 1. (Recommended) Enable **Admin override code** if you turned on **Lock device client switch**. 2. Enable **Install CA to system certificate store** if you want users to see a [custom block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/). 1. Update the default device settings profile: ```bash curl --request PATCH \ https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "allow_mode_switch": false, "allow_updates": false, "allowed_to_leave": false, "auto_connect": 900, "captive_portal": 180, "disable_auto_fallback": true, "exclude_office_ips": false, "service_mode_v2": { "mode": "warp" }, "support_url": "https://it.company.com/help", "switch_locked": true }' ``` 1. Update global settings: ```bash curl --request PUT \ https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/settings \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "disable_for_time": 3600, "root_certificate_installation_enabled": true }' ``` 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Configure default profile settings using the [cloudflare\_zero\_trust\_device\_default\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile) resource: ```tf resource "cloudflare_zero_trust_device_default_profile" "default_profile" { account_id = var.cloudflare_account_id allow_mode_switch = false allow_updates = false allowed_to_leave = false auto_connect = 600 captive_portal = 180 disable_auto_fallback = true exclude_office_ips = false service_mode_v2 = {mode = "warp"} support_url = "https://support.example.com" switch_locked = true tunnel_protocol = "wireguard" } ``` 3. Configure [global settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#global-settings) using the [cloudflare\_zero\_trust\_device\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fsettings) resource: ```tf resource "cloudflare_zero_trust_device_settings" "global_warp_settings" { account_id = var.cloudflare_account_id disable_for_time = 3600 root_certificate_installation_enabled = true use_zt_virtual_ip = false } ``` ## (Optional) Create an office profile You can configure a device settings profile to take effect when the device is connected to a trusted network such as an office. For example, you may wish to allow users in the office to access applications directly rather than route traffic through Cloudflare. For setup instructions, refer to [Add a managed network](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/managed-networks/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/device-profiles/#page","headline":"Customize device profiles · Cloudflare Learning Paths","description":"Configure WARP client device profiles.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/device-profiles/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/device-profiles/","name":"Customize device profiles"}}]} ``` --- --- title: Proxy traffic through Gateway description: Route device traffic through Cloudflare Gateway. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Proxy traffic through Gateway With Cloudflare Gateway, you can log and filter DNS, network, and HTTP traffic from devices running the Cloudflare One Client. This includes traffic to the public Internet and traffic directed to your private network. DNS filtering is enabled by default since the Cloudflare One Client sends DNS queries to Cloudflare's public DNS resolver, [1.1.1.1](https://edgetunnel-b2h.pages.dev/1.1.1.1/). To enable network and HTTP filtering, you will need to allow Cloudflare Gateway to proxy that traffic. ## Enable the proxy * [ Dashboard ](#tab-panel-9972) * [ Terraform (v5) ](#tab-panel-9973) 1. Go to **Traffic policies** \> **Traffic settings**. 2. In **Proxy and inspection**, turn on **Allow Secure Web Gateway to proxy traffic**. 3. Select **TCP**. 4. Select **UDP** (required to proxy traffic to internal DNS resolvers). 5. (Recommended) To proxy traffic for diagnostic tools such as `ping` and `traceroute`, select **ICMP**. You may also need to [update your system](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/proxy/#icmp) to allow ICMP traffic through `cloudflared`. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Turn on the TCP and/or UDP proxy using the [cloudflare\_zero\_trust\_device\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fsettings) resource: ```tf resource "cloudflare_zero_trust_device_settings "global_warp_settings" { account_id = var.cloudflare_account_id gateway_proxy_enabled = true gateway_udp_proxy_enabled = true } ``` Cloudflare will now proxy traffic from enrolled devices, except for the traffic excluded in your [split tunnel settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#3-route-private-network-ips-through-the-cloudflare-one-client). For more information on how Gateway forwards traffic, refer to [Gateway proxy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/proxy/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/enable-proxy/#page","headline":"Proxy traffic through Gateway · Cloudflare Learning Paths","description":"Route device traffic through Cloudflare Gateway.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/enable-proxy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/enable-proxy/","name":"Proxy traffic through Gateway"}}]} ``` --- --- title: Enable TLS decryption (optional) description: Inspect encrypted traffic with TLS decryption. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Enable TLS decryption (optional) [TLS decryption ↗](https://www.cloudflare.com/learning/security/what-is-https-inspection/) allows Cloudflare Gateway to inspect HTTPS requests to your private network applications. ## Should I enable TLS decryption? With TLS decryption turned on, you can apply advanced Gateway policies, such as: * Filtering based on the complete URL and path of requests * Scanning for sensitive data with [Cloudflare Data Loss Prevention (DLP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) * Starting a remote browser isolation session with [Cloudflare Browser Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/) These features can increase the security posture of sensitive systems, but TLS decryption can also break your users' access to certain resources. For instance, if your internal applications use self-signed certificates, you will need to either configure a [Do Not Inspect](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/#do-not-inspect) policy or an [Untrusted certificate _Pass through_](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/#untrusted-certificates) policy to allow users to connect. To learn more, refer to [TLS decryption limitations](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/#inspection-limitations). With TLS decryption turned off, Gateway can only inspect and apply HTTP policies to unencrypted HTTP requests. However, you can still apply network policies to HTTPS traffic based on user identity, device posture, IP, resolved domain, SNI, and other attributes that support a Zero Trust security implementation. For more information, refer to [Gateway network policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/). ## Enable TLS decryption * [ Dashboard ](#tab-panel-9974) * [ Terraform (v5) ](#tab-panel-9975) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Traffic settings**. 2. In **Proxy and inspection**, turn on **Inspect HTTPS requests with TLS decryption**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Configure the `tls_decrypt` argument in [cloudflare\_zero\_trust\_gateway\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fsettings): ```tf resource "cloudflare_zero_trust_gateway_settings" "team_name" { account_id = var.cloudflare_account_id settings = { tls_decrypt = { enabled = true } } } ``` Next, choose a [user-side certificate](#configure-user-side-certificates) to use for inspection. ## Configure user-side certificates When you enable TLS decryption, Gateway will decrypt all traffic sent over HTTPS, apply your HTTP policies, and then re-encrypt the request with a certificate on the user device. You can either [install the certificate provided by Cloudflare](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) (default option) or [upload a custom root certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) to Cloudflare (Enterprise-only option). ### Best practices Deploying the Cloudflare root certificate is the simplest way to get started with TLS decryption and is usually appropriate for testing or proof of concept conditions. If you already have a certificate that you use for other inspection or trust purposes, we recommend uploading your own root certificate for the following reasons: * Using a single certificate streamlines IT management. * If other services (such as `git` workflows, other CLI tools, or thick client applications) rely on an existing certificate store, presenting the same certificate in inspection is far less likely to interrupt their traffic flow. * If you are using Cloudflare Mesh to connect devices to Cloudflare, those devices will not be able to leverage HTTP policies that require decrypting TLS unless they have a certificate that matches either your uploaded certificate or the Cloudflare root certificate. It is more likely that your network infrastructure already has your own device certificates deployed, so using the existing PKI infrastructure for inspection will reduce the number of steps needed to deploy Zero Trust. MDM deployments Many customers [deploy the Cloudflare One Client](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/) onto devices in production using an MDM tool like JAMF or Intune. Cloudflare has the ability to deploy a root certificate along with the device, but this could be more consistently and holistically configured within the MDM, where other certificates are presumably managed, trusted, and stored. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/enable-tls-decryption/#page","headline":"Enable TLS decryption (optional) · Cloudflare Learning Paths","description":"Inspect encrypted traffic with TLS decryption.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/enable-tls-decryption/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/enable-tls-decryption/","name":"Enable TLS decryption (optional)"}}]} ``` --- --- title: Resolve private DNS description: Set up private DNS resolution. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Resolve private DNS By default, all DNS requests on the user device are resolved by Cloudflare's [public DNS resolver](https://edgetunnel-b2h.pages.dev/1.1.1.1/) except for common top level domains used for local resolution (such as `localhost`). To allow users to connect to internal server names or domains that do not resolve on the public Internet, you have two options: * [Add internal domains to Local Domain Fallback](#local-domain-fallback) * [Build custom resolver policies](#resolver-policies) ## Local Domain Fallback Local Domain Fallback tells the Cloudflare One Client to send specific DNS requests to your private DNS resolver instead of to Cloudflare's public DNS resolver. This method was the primary delivery mechanism for private DNS for a long time, and is the simplest option, but it has two shortcomings: you cannot deterministically route private DNS queries to different resolvers based on specific attributes, and you cannot apply Gateway DNS policies to this traffic because Cloudflare is not resolving it. To learn more about how Local Domain Fallback works, refer to [How the Cloudflare One Client handles DNS requests](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/#how-the-warp-client-handles-dns-requests). ### Add a domain To add a domain to the Local Domain Fallback list: * [ Dashboard ](#tab-panel-9978) * [ Terraform (v5) ](#tab-panel-9979) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Locate the [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) you would like to view or modify and select **Configure**. 3. Scroll down to **Local Domain Fallback** and select **Manage**. 1. In **Domain**, enter the apex domain (`example.com`) that you want to resolve using your private DNS server. All prefixes under the apex domain are subject to Local Domain Fallback (in other words, `example.com` is interpreted as `*.example.com`). 2. In **DNS Servers**, enter the IP address of the DNS servers that should resolve that domain name. Cloudflare recommends keeping the list to a maximum of eight servers to avoid performance issues. 3. Enter an optional description and select **Save domain**. A Local Domain Fallback list is scoped to a specific [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). If a device profile does not have a corresponding Local Domain Fallback resource, those devices will use the default local domains shown in Step 2. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. (Optional) Create a list of domains that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles: **local-domains.local.tf** ```tf locals { default_local_domains = [ # Default Local Domain Fallback entries recommended by Cloudflare { suffix = "corp" }, { suffix = "domain" }, { suffix = "home" }, { suffix = "home.arpa" }, { suffix = "host" }, { suffix = "internal" }, { suffix = "intranet" }, { suffix = "invalid" }, { suffix = "lan" }, { suffix = "local" }, { suffix = "localdomain" }, { suffix = "localhost" }, { suffix = "private" }, { suffix = "test" } ] } ``` 3. To configure Local Domain Fallback for the default device profile, use the [cloudflare\_zero\_trust\_device\_default\_profile\_local\_domain\_fallback ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile%5Flocal%5Fdomain%5Ffallback) resource. To configure Local Domain Fallback for a custom device profile, use[cloudflare\_zero\_trust\_device\_custom\_profile\_local\_domain\_fallback ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fcustom%5Fprofile%5Flocal%5Fdomain%5Ffallback). For example: **device-profiles.tf** ```tf resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example" { account_id = var.cloudflare_account_id policy_id = cloudflare_zero_trust_device_custom_profile.example.id domains = concat( # Global entries local.default_local_domains, # Profile-specific entries [ { suffix = "example.com" description = "Domain for local development" dns_server = ["1.1.1.1", "192.168.0.1"] } ] ) } ``` For `suffix`, specify the apex domain (`example.com`) that you want to resolve using your private DNS server. All prefixes under the apex domain are subject to Local Domain Fallback (in other words, `example.com` is interpreted as `*.example.com`). For `dns_server`, enter the IP address of the DNS servers that should resolve that domain name. Cloudflare recommends keeping the list to a maximum of eight servers to avoid performance issues. The Cloudflare One Client tries all servers and always uses the fastest response, even if that response is `no records found`. We recommend specifying at least one DNS server for each domain. If a value is not specified, the Cloudflare One Client will try to identify the DNS server (or servers) used on the device before it started, and use that server for each domain in the Local Domain Fallback list. ### Route traffic to fallback server The Cloudflare One Client routes DNS traffic to your [Local Domain Fallback server](#add-a-domain) according to your [Split Tunnel configuration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/). To ensure that queries can reach your private DNS server: * If your DNS server is only reachable inside of the WARP tunnel (for example, via `cloudflared` or Cloudflare WAN): 1. Go to **Networking** \> **Routes** and verify that the DNS server is connected to Cloudflare. To connect a DNS server, refer to [Private networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/). 2. In your [Split Tunnel configuration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/), verify that the DNS server IP routes through the WARP tunnel. * If your DNS server is only reachable outside of the WARP tunnel (for example, via a third-party VPN), verify that the DNS server IP is [excluded from the WARP tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/). For more information, refer to [How the Cloudflare One Client handles DNS requests](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/#how-the-warp-client-handles-dns-requests). ## Resolver policies Note Only available on Enterprise plans. [Resolver policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/) provide similar functionality to Local Domain Fallback but occur in Cloudflare Gateway rather than on the local device. This option is recommended if you want more granular control over private DNS resolution. For example, you can ensure that all users in a specific geography use the private DNS server closest to them, ensure that specific conditions are met before resolving private DNS traffic, and apply [Gateway DNS policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/) to private DNS traffic. ### Create a resolver policy Virtual network limitation Resolver policies do not automatically update when you change the virtual networks associated with a route. If you move a route from one virtual network to another, the resolver policy will still reference the old virtual network. You will need to manually remove and recreate the resolver policy to update the route. To create a resolver policy: * [ Dashboard ](#tab-panel-9976) * [ Terraform (v5) ](#tab-panel-9977) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Resolver policies**. 2. Select **Add a policy**. 3. Create an expression for your desired traffic. For example, you can resolve a hostname for an internal service: | Selector | Operator | Value | | -------- | -------- | -------------------- | | Host | in | internal.example.com | Make sure your destination is not subject to [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/#manage-local-domains). 4. In **Select DNS resolver**, choose _Configure custom DNS resolvers_. 5. Enter the IP addresses of your custom DNS resolver. As you enter an IP address, Gateway will search through your [virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) configured in Zero Trust. 6. In **Network**, choose whether to route queries publicly (to the Internet) or privately (to a private network service). 7. (Optional) Enter a custom port for each IP address. 8. Select **Create policy**. Custom resolvers are saved to your account for future use. You can add up to 10 IPv4 and 10 IPv6 addresses to a policy. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Create a resolver policy using the [cloudflare\_zero\_trust\_gateway\_policy ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fpolicy) resource: ```tf resource "cloudflare_zero_trust_gateway_policy" "resolver_policy" { name = "Example resolver policy" enabled = true account_id = var.cloudflare_account_id description = "TERRAFORM MANAGED resolver policy" action = "resolve" traffic = "dns.fqdn in {\"internal.example.com\"}" identity = "identity.email in {\"jdoe@example.com\"}" precedence = 1 rule_settings = { dns_resolvers = { # You can add up to 10 IPv4 and 10 IPv6 addresses to a policy. ipv4 = [{ ip = "192.0.2.24" port = 53 route_through_private_network = true vnet_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.staging_vnet.id }] ipv6 = [{ ip = "2001:DB8::" port = 53 route_through_private_network = true vnet_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.staging_vnet.id }] } } } ``` When a user's query matches a resolver policy, Gateway will send the query to your listed resolvers in the following order: 1. Public resolvers 2. Private resolvers behind the default virtual network for your account 3. Private resolvers behind a custom virtual network Gateway will cache the fastest resolver for use in subsequent queries. Resolver priority is cached on a per user basis for each data center. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/private-dns/#page","headline":"Resolve private DNS · Cloudflare Learning Paths","description":"Set up private DNS resolution.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/private-dns/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/private-dns/","name":"Resolve private DNS"}}]} ``` --- --- title: Define Split Tunnel settings description: Configure split tunnel routing rules. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Define Split Tunnel settings Split tunnel settings determine which traffic the Cloudflare One Client does and does not proxy. The Cloudflare One Client offers two different split tunnel modes: * If you intend to send all internal and external destination traffic through Cloudflare's global network, opt for **Exclude IPs and domains** mode. This mode will proxy everything through the WARP tunnel with the exception of IPs and hosts defined explicitly within the Split Tunnel list. * If you intend to only use the Cloudflare One Client to proxy private destination traffic, you can operate in **Include IPs and domains** mode, in which you explicitly define which IP ranges and domains should be included in the WARP routing table. ## Update Split Tunnels mode To change your Split Tunnels mode: * [ Dashboard ](#tab-panel-9980) * [ Terraform (v5) ](#tab-panel-9981) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Locate the [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) you would like to modify and select **Configure**. 3. Scroll down to **Split Tunnels**. 4. (Optional) To view your existing Split Tunnel configuration, select **Manage**. You will see a list of the IPs and domains Cloudflare Zero Trust excludes or includes, depending on the mode you have selected. We recommend making a copy of your Split Tunnel entries, as they will revert to the default upon switching modes. 5. Under **Split Tunnels**, choose a mode: * **Exclude IPs and domains** — (Default) All traffic will be sent to Cloudflare Gateway except for the IPs and domains you specify. * **Include IPs and Domains** — Only traffic destined to the IPs or domains you specify will be sent to Cloudflare Gateway. All other traffic will bypass Gateway and will no longer be filtered by your network or HTTP policies. In order to use certain features, you will need to manually add [Zero Trust domains](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#cloudflare-zero-trust-domains). 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Choose a [cloudflare\_zero\_trust\_device\_default\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile) or [cloudflare\_zero\_trust\_device\_custom\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fcustom%5Fprofile) resource to modify, or [create a new device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/#create-a-new-profile). 3. In your device profile, configure either the `exclude` or `include` argument. You cannot set both `exclude` and `include` in a given device profile. a. To manage Split Tunnel routes in **Exclude** mode, use the `exclude` argument: ```tf resource "cloudflare_zero_trust_device_custom_profile" "exclude_example" { account_id = var.cloudflare_account_id name = "Custom profile in Split Tunnels Exclude mode" enabled = true precedence = 101 service_mode_v2 = {mode = "warp"} match = "identity.email == \"test@cloudflare.com\"" exclude = [{ address = "10.0.0.0/8" description = "Example route to exclude from WARP tunnel" }] } ``` In this example, all traffic will be sent to Cloudflare Gateway except for traffic destined to `10.0.0.0/8`. To exclude the default IPs and domains recommended by Cloudflare, refer to [Add a route](#add-a-route). b. To manage Split Tunnel routes in **Include** mode, use the `include` argument: ```tf resource "cloudflare_zero_trust_device_custom_profile" "include_example" { account_id = var.cloudflare_account_id name = "Custom profile in Split Tunnels Include mode" enabled = true precedence = 101 service_mode_v2 = {mode = "warp"} match = "identity.email == \"test@cloudflare.com\"" include = [{ address = "10.0.0.0/8" description = "Example route to include in WARP tunnel" }] } ``` In this example, only traffic destined to `10.0.0.0/8` will be sent to Cloudflare Gateway. All clients with this device profile will now switch to the new mode and its default route configuration. Next, [add](#add-a-route) or [remove](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#remove-a-route) routes from your Split Tunnel configuration. ## Add a route * [ Dashboard ](#tab-panel-9986) * [ Terraform (v5) ](#tab-panel-9987) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Locate the [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) you would like to modify and select **Configure**. 3. Under **Split Tunnels**, check whether your [Split Tunnels mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include**. 4. Select **Manage**. 5. You can exclude or include routes based on either their IP address or domain. When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to [Domain-based Split Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels). * [ Add an IP ](#tab-panel-9984) * [ Add a domain ](#tab-panel-9985) To add an IP address to Split Tunnels: 1. Select _IP Address_. 2. Enter the IP address or CIDR you want to exclude or include. 3. Select **Save destination**. Traffic to this IP address is now excluded or included from the WARP tunnel. Note If you would like to exclude a specific IP range from a larger IP range, you can use this calculator: **Base CIDR:** **Subtracted CIDRs:** Calculate To add a domain to Split Tunnels: 1. Select _Domain_. 2. Enter a [valid domain](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#valid-domains) to exclude or include. 3. Select **Save destination**. 4. (Optional) If your domain does not have a public DNS record, create a [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) entry to allow a private DNS server to handle domain resolution. When a user goes to the domain, the domain gets resolved according to your Local Domain Fallback configuration (either by Gateway or by your private DNS server). Split Tunnels will then dynamically include or exclude the IP address returned in the DNS lookup. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Choose a [cloudflare\_zero\_trust\_device\_default\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile) or [cloudflare\_zero\_trust\_device\_custom\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fcustom%5Fprofile) resource to modify, or [create a new device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/#create-a-new-profile). 3. (Optional) Create a list of split tunnel routes that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles: **split-tunnels.local.tf** ```tf locals { global_exclude_list = [ # Default Split Tunnel entries recommended by Cloudflare { address = "ff05::/16" }, { address = "ff04::/16" }, { address = "ff03::/16" }, { address = "ff02::/16" }, { address = "ff01::/16" }, { address = "fe80::/10" description = "IPv6 Link Local" }, { address = "fd00::/8" }, { address = "255.255.255.255/32" description = "DHCP Broadcast" }, { address = "240.0.0.0/4" }, { address = "224.0.0.0/24" }, { address = "192.168.0.0/16" }, { address = "192.0.0.0/24" }, { address = "172.16.0.0/12" }, { address = "169.254.0.0/16" description = "DHCP Unspecified" }, { address = "100.64.0.0/10" }, { address = "10.0.0.0/8" } ] } ``` 4. In the device profile, exclude or include routes based on either their IP address or domain: **device-profiles.tf** ```tf resource "cloudflare_zero_trust_device_custom_profile" "example" { account_id = var.cloudflare_account_id name = "Example custom profile with split tunnels" enabled = true precedence = 101 service_mode_v2 = {mode = "warp"} match = "identity.email == \"test@cloudflare.com\"" exclude = concat( # Global entries local.global_exclude_list, # Profile-specific entries [ { address = "192.0.2.0/24" description = "Example IP to exclude from WARP" }, { host = "example.com" description = "Example domain to exclude from WARP" } ] ) } ``` When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to [Domain-based Split Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels). It may take up to 10 minutes for newly updated settings to propagate to devices. We recommend keeping the Split Tunnels list short, as each entry takes time for the client to parse. In particular, domains are slower to action than IP addresses because they require on-the-fly IP lookups and routing table / local firewall changes. A shorter list will also make it easier to understand and debug your configuration. For information on device profile limits, refer to [Account limits](https://edgetunnel-b2h.pages.dev/cloudflare-one/account-limits/#warp). ## Configure Split Tunnels for private network access By default, WARP excludes traffic bound for [RFC 1918 space ↗](https://datatracker.ietf.org/doc/html/rfc1918), which are IP addresses typically used in private networks and not reachable from the Internet. In order for the Cloudflare One Client to send traffic to your private network, you must configure [Split Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) so that the IP/CIDR of your private network routes through the Cloudflare One Client. 1. First, check whether your [Split Tunnels mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include** mode. 2. Edit your Split Tunnel routes depending on the mode: * [ Exclude IPs and domains ](#tab-panel-9982) * [ Include IPs and domains ](#tab-panel-9983) If you are using **Exclude** mode: a. [Delete the route](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#remove-a-route) containing your private network's IP/CIDR range. For example, if your network uses the default AWS range of `172.31.0.0/16`, delete `172.16.0.0/12`. b. [Re-add IP/CIDR ranges](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#add-a-route) that are not explicitly used by your private network. For the AWS example above, you would add new entries for `172.16.0.0/13`, `172.24.0.0/14`, `172.28.0.0/15`, and `172.30.0.0/16`. This ensures that only traffic to `172.31.0.0/16` routes through the Cloudflare One Client. You can use the following calculator to determine which IP addresses to re-add: **Base CIDR:** **Subtracted CIDRs:** Calculate Calculator instructions 1. In **Base CIDR**, enter the RFC 1918 range that you deleted from Split Tunnels. 2. In **Subtracted CIDRs**, enter the IP/CIDR range used by your private network. 3. Re-add the calculator results to your Split Tunnel Exclude mode list. By tightening the private IP range included in the Cloudflare One Client, you reduce the risk of breaking a user's [access to local resources](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion). If you are using **Include** mode: 1. Add the required [Zero Trust domains](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#cloudflare-zero-trust-domains) or [IP addresses](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#cloudflare-zero-trust-ip-addresses) to your Split Tunnel include list. 2. [Add a route](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#add-a-route) to include your private network's IP/CIDR range. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/split-tunnel-settings/#page","headline":"Define Split Tunnel settings · Cloudflare Learning Paths","description":"Configure split tunnel routing rules.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/split-tunnel-settings/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/configure-device-agent/split-tunnel-settings/","name":"Define Split Tunnel settings"}}]} ``` --- --- title: Connect user devices description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect user devices Now that your device enrollment policies and Cloudflare One Client profiles are configured, you can begin deploying the Cloudflare One Client to user devices for testing. Note The following steps are identical to [Device on-ramps](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/choose-on-ramp/#device-on-ramps) in the Secure your Internet traffic and SaaS apps implementation guide. If you have already completed Secure your Internet traffic and SaaS apps, you can skip ahead to [Build secure access policies](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/build-policies/). ## Objectives By the end of this module, you will be able to: * Manually deploy the Cloudflare One Client on a test device. * Create an automated script to use with your organization's managed deployment tool. * View user traffic in Zero Trust. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/#page","headline":"Connect user devices · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/","name":"Connect user devices"}}]} ``` --- --- title: Download and install the Cloudflare One Client description: Install the Cloudflare One device client. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Download and install the Cloudflare One Client Most admins test by manually downloading the Cloudflare One Client and enrolling in your organization's Cloudflare Zero Trust instance. ## Install the Cloudflare One Client 1. First, uninstall any existing third-party VPN software if possible. Sometimes products placed in a disconnected or disabled state will still interfere with the Cloudflare One Client. 2. If you are running third-party firewall or TLS decryption software, verify that it does not inspect or block traffic to the following destinations: * IPv4 API endpoints: `162.159.137.105` and `162.159.138.105` * IPv6 API endpoints: `2606:4700:7::a29f:8969` and `2606:4700:7::a29f:8a69` * SNIs for Cloudflare One Client version 2026.6.0 and later: `api.devices.cloudflare.com` * SNIs for versions earlier than 2026.6.0: `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` For more information, refer to [WARP with firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/). 3. Manually install the Cloudflare One Client on the device. Window, macOS, and Linux To enroll your device using the client GUI: * [ Version 2026.2+ ](#tab-panel-9988) * [ Version 2026.1 and earlier ](#tab-panel-9989) 1. [Download](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) and install the Cloudflare One Client. 2. Launch the Cloudflare One Client. 3. On the **What would you like to use the Cloudflare One Client for?** screen, select **Zero Trust security**. 4. Enter your team name. 5. Complete the authentication steps required by your organization. Once authenticated, you will see a Success page and a dialog prompting you to open the Cloudflare One Client. 6. Select **Open the Cloudflare One Client** to complete the registration. 1. [Download](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) and install the Cloudflare One Client. 2. Launch the Cloudflare One Client. 3. Select the Cloudflare logo in the menu bar. 4. Select the gear icon. 5. Go to **Preferences** \> **Account**. 6. Select **Login with Cloudflare Zero Trust**. 7. Enter your team name. 8. Complete the authentication steps required by your organization. Once authenticated, you will see a Success page and a dialog prompting you to open the Cloudflare One Client. 9. Select **Open Cloudflare WARP.app** to complete the registration. iOS, Android, and ChromeOS 1. [Download](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) and install the Cloudflare One Agent app. 2. Launch the Cloudflare One Agent app. 3. Select **Next**. 4. Review the privacy policy and select **Accept**. 5. Enter your team name. 6. Complete the authentication steps required by your organization. 7. After authenticating, select **Install VPN Profile**. 8. In the **Connection request** popup window, select **OK**. 9. If you did not enable [auto-connect ↗](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#auto-connect), manually turn on the switch to **Connected**. The Cloudflare One Client should show as **Connected**. The device can now access private network resources that you have made available via Cloudflare Tunnel. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/install-agent/#page","headline":"Download and install the Cloudflare One Client · Cloudflare Learning Paths","description":"Install the Cloudflare One device client.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/install-agent/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/","name":"Connect user devices"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/install-agent/","name":"Download and install the Cloudflare One Client"}}]} ``` --- --- title: MDM deployment description: Deploy the device client via MDM. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # MDM deployment Organizations can deploy and manage the Cloudflare One Client (formerly WARP) across their fleet of devices in two complementary ways: * **Through a mobility management solution (MDM)** — Push the client installer and its deployment parameters using a tool such as [Intune, JAMF, Kandji, or JumpCloud](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/), or by executing an `.msi` file on desktop machines. This page covers the MDM-driven workflow. * **From the Cloudflare dashboard** — Manage client versions for groups of devices directly from the Zero Trust dashboard, without relying on a third-party MDM solution. For more information, refer to [Client version assignments](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/). ## MDM policy file Refer to our [managed deployment instructions](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/) and create a `.plist`, `mdm.xml`, or `.msi` policy file based on your organization's software management tool. [MDM parameters](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/) that you specify in a local policy file will overrule any [device client settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) configured in the dashboard. Therefore, we recommend that your policy file only contain the organization name and potentially the onboarding flag, [relying on the dashboard](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles/) to configure the remaining device settings. ```xml organization your-team-name onboarding ``` 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) by going to **Zero Trust** \> **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) at any time. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/mdm/#page","headline":"MDM deployment · Cloudflare Learning Paths","description":"Deploy the device client via MDM.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/mdm/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/","name":"Connect user devices"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/mdm/","name":"MDM deployment"}}]} ``` --- --- title: Verify device connectivity description: Verify devices connect through Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Verify device connectivity To validate that Cloudflare is receiving traffic from a user device: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Traffic settings**. 2. Under **Log traffic activity**, enable activity logging for all DNS logs. 3. On your device, open a browser and go to any website. 4. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Logs** \> **DNS**. 5. Make sure DNS queries from your device appear. ## Best practices Securing your organization with a Zero Trust Network Access solution usually happens in two phases: the first phase is establishing connectivity, and the second phase is building policies for distinct applications. We recommend verifying that all connectivity is working as expected before moving on to build complex security policies. This will reduce the amount of troubleshooting and challenges that arise from managing complex systems. Troubleshoot the Cloudflare One Client For step-by-step guidance on diagnosing and resolving Cloudflare One Client issues, refer to the [Cloudflare One Client troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/). The guide covers: * How to collect diagnostic logs via the Cloudflare dashboard or CLI * How to review key configuration files * Common misconfigurations and their fixes * Best practices for filing support tickets ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/validate-traffic-in-gateway/#page","headline":"Verify device connectivity · Cloudflare Learning Paths","description":"Verify devices connect through Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/validate-traffic-in-gateway/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/","name":"Connect user devices"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-devices/validate-traffic-in-gateway/","name":"Verify device connectivity"}}]} ``` --- --- title: Connect your private network description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect your private network This module covers how to connect your private network services and applications to Cloudflare. In many ways, this connection will replace the concept of a traditional VPN concentrator or headend device. ## Objectives By the end of this module, you will be able to: * Create a Cloudflare Tunnel. * Configure private network routes for your tunnel. * Understand how to size and scale your tunnel. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/#page","headline":"Connect your private network · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/","name":"Connect your private network"}}]} ``` --- --- title: Connect with Cloudflare Mesh description: Connect your network using Cloudflare Mesh. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect with Cloudflare Mesh [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) (formerly WARP Connector) connects your private networks to Cloudflare using the Cloudflare One Client (`warp-cli`) running in headless mode on a Linux server. Every enrolled device and node receives a private Mesh IP and can communicate with any other participant over TCP, UDP, or ICMP. Mesh supports bidirectional traffic — devices can reach servers, servers can reach devices, and networks can reach other networks. This makes it the recommended approach for replacing a VPN, as it covers both user-to-network and network-to-network connectivity. ## Set up Cloudflare Mesh To connect your private network using Cloudflare Mesh, refer to [Get started with Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/get-started/). The setup wizard in the dashboard configures enrollment, device profiles, and connectivity settings automatically. Once a node is online, add [CIDR routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/) to make the subnet behind it reachable from any enrolled device. ## When to use Mesh * Replacing a VPN for remote access to private networks * Bidirectional connectivity (VoIP, SIP, Active Directory, SCCM, DevOps pipelines) * Long-lived TCP connections sensitive to interruptions (SAP, database replication, ERP systems, RDP sessions) * Site-to-site networking between offices, data centers, or cloud VPCs * Client-to-client connectivity (two laptops reaching each other by private IP) * Any L3/L4 workload where source IP preservation matters ## Best practices * Enable [high availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/high-availability/) for production nodes with CIDR routes. * Use [Gateway network policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) to control which users and devices can reach specific resources. * Refer to [Tips and best practices](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/tips/) for cloud VPC configuration and running alongside Cloudflare Tunnel. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/cloudflare-mesh/#page","headline":"Connect with Cloudflare Mesh · Cloudflare Learning Paths","description":"Connect your network using Cloudflare Mesh.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/cloudflare-mesh/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-27","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/","name":"Connect your private network"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/cloudflare-mesh/","name":"Connect with Cloudflare Mesh"}}]} ``` --- --- title: Connect with Cloudflare Tunnel description: Create a tunnel to your private network. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect with Cloudflare Tunnel Cloudflare Tunnel is an outbound-only daemon service that can run on nearly any host machine and proxies local traffic once validated from the Cloudflare network. User traffic initiated from the Cloudflare One Client onramps to Cloudflare, passes down your Cloudflare Tunnel connections, and terminates automatically in your local network. Traffic reaching your internal applications or services will carry the local source IP address of the host machine running the `cloudflared` daemon. ## Create a tunnel To connect your private network: * [ Dashboard ](#tab-panel-9994) * [ Terraform (v5) ](#tab-panel-9995) 1. Log in to the Cloudflare dashboard and go to **Networking** \> **Tunnels**. [ Go to **Tunnels** ](https://dash.cloudflare.com/?to=/:account/tunnels) 2. Select **Create a tunnel**. 3. Enter a name for your tunnel. We suggest choosing a name that reflects the type of resources you want to connect through this tunnel (for example, `enterprise-VPC-01`). 4. Select **Create Tunnel**. 5. Choose your operating system, then copy the installation command and run it in a terminal on your origin server. 6. Wait for the tunnel to connect. Once the connection is established, select **Continue**. 1. In the **CIDR** tab, enter the CIDR of your private network (for example, `10.0.0.0/8`). 2. Select **Save tunnel**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Cloudflare Tunnel Write` 2. Create a tunnel using the [cloudflare\_zero\_trust\_tunnel\_cloudflare ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Ftunnel%5Fcloudflared) resource. ```tf resource "cloudflare_zero_trust_tunnel_cloudflared" "example_tunnel" { account_id = var.cloudflare_account_id name = "Example tunnel" config_src = "cloudflare" } ``` 3. Route the CIDR of your private network through the tunnel using the [cloudflare\_zero\_trust\_tunnel\_cloudflared\_route ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Ftunnel%5Fcloudflared%5Froute) resource: ```tf resource "cloudflare_zero_trust_tunnel_cloudflared_route" "example_tunnel_route" { account_id = var.cloudflare_account_id tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.example_tunnel.id network = "10.0.0.0/8" comment = "Example tunnel route" } ``` 4. Get the [token](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/remote-tunnel-permissions/) used to run the tunnel: ```tf data "cloudflare_zero_trust_tunnel_cloudflared_token" "tunnel_token" { account_id = var.cloudflare_account_id tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.example_tunnel.id } ``` If your host machine is not managed in Terraform or you want to install the tunnel manually, you can output the token value to the CLI. Example: Output to CLI 1. Output the tunnel token to the Terraform state file: ```tf output "tunnel_token" { value = data.cloudflare_zero_trust_tunnel_cloudflared_token.tunnel_token.token sensitive = true } ``` 2. Apply the configuration: ```sh terraform apply ``` 3. Read the tunnel token: ```sh terraform output -raw tunnel_token ``` ```sh eyJhIj... ``` Alternatively, pass `data.cloudflare_zero_trust_tunnel_cloudflared_token.tunnel_token.token` directly into your host's Terraform configuration or store the token in your secret management tool. Example: Store in HashiCorp Vault ```tf resource "vault_generic_secret" "tunnel_token" { path = "kv/cloudflare/tunnel_token" data_json = jsonencode({ "TUNNEL_TOKEN" = data.cloudflare_zero_trust_tunnel_cloudflared_token.tunnel_token.token }) } ``` 5. Install `cloudflared` on a host machine in your private network and run the tunnel: * [ Linux ](#tab-panel-9990) * [ Windows ](#tab-panel-9991) * [ macOS ](#tab-panel-9992) * [ Docker ](#tab-panel-9993) 1. [Download and install ↗](https://pkg.cloudflare.com/index.html) `cloudflared`. 2. Run the following command: ```sh sudo cloudflared service install ``` 1. [Download and install](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#windows) `cloudflared`. 2. Open Command Prompt as administrator. 3. Run the following command: ```txt cloudflared.exe service install ``` 1. [Download and install](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#macos) `cloudflared`. 2. Open a terminal window and run the following command: ```sh sudo cloudflared service install ``` 1. Open a terminal window. 2. Run the following command: ```sh docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token ``` All internal applications and services in this IP range are now connected to Cloudflare. Note If the tunnel is disconnected: * Ensure that your on-premise or cloud firewall allows egress traffic on the [required ports](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation). * Ensure that the `cloudflared` host machine can connect to your internal applications and services. Verify that the host has the proper security group memberships and that no firewalls will block traffic between the host and the target services. ## Best practices * Segregate production and staging traffic among different Cloudflare tunnels. * Add a [cloudflared replica](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) to another host machine for an additional point of availability. * Distribute access to critical services (for example, private DNS, Active Directory, and other critical systems) across different tunnels for blast-radius reduction in the event of a server-side outage. * [Enable notifications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/notifications/) in the Cloudflare dashboard to monitor tunnel health. * [Monitor performance metrics](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/) to identify potential bottlenecks. * [Update cloudflared](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/) regularly. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/cloudflared/#page","headline":"Connect with Cloudflare Tunnel · Cloudflare Learning Paths","description":"Create a tunnel to your private network.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/cloudflared/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/","name":"Connect your private network"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/cloudflared/","name":"Connect with Cloudflare Tunnel"}}]} ``` --- --- title: Choose a connection method description: Compare Cloudflare Mesh and Tunnel options. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Choose a connection method There are [multiple ways](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-networks) to onramp traffic from your private networks to Cloudflare. This page covers the two software-based methods commonly used for VPN replacement: Cloudflare Mesh and Cloudflare Tunnel. Both involve installing lightweight software on a host machine in your network to create a secure connection to Cloudflare's global network. ## Cloudflare Mesh [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) (formerly WARP Connector) runs the Cloudflare One Client (`warp-cli`) in headless mode on a Linux server. It operates as a Layer 3 proxy, supports bidirectional traffic (TCP, UDP, ICMP), and assigns a private Mesh IP to every participant. Use Mesh when you need: * User-to-network access (replacing a VPN) * Network-to-network / site-to-site connectivity * Server-initiated connections (VoIP, SIP, AD updates, SCCM, DevOps) * Client-to-client connectivity between enrolled devices ## Cloudflare Tunnel [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) runs the `cloudflared` daemon on a host machine. It creates an outbound-only connection and proxies traffic from Cloudflare to your internal applications or network. Use Tunnel when you need: * Publishing specific applications by hostname * Outbound-only connectivity (no inbound ports opened) * Proxying HTTP/S, TCP, or SSH traffic to specific services * Running on non-Linux platforms (macOS, Windows) ## Comparison table | | Cloudflare Mesh | Cloudflare Tunnel | | --------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Bidirectional traffic | ✅ | ❌ | | High availability | ✅ (active-passive) | ✅ (active-active replicas) | | Source IP of request | Virtual IP of requesting device | cloudflared host machine | | Host machine | Linux (amd64, arm64) | Linux, macOS, Windows | | IPv4 | ✅ | ✅ | | IPv6 | ✅ | ✅ | | OSI layer | L3 | L7 | | Protocol | MASQUE | QUIC or HTTP/2 | | Protocols proxied | TCP, UDP, ICMP | HTTP/S, TCP, SSH, RDP, SMB | | Connection handling | End-to-end — preserves long-lived TCP connections across the full path | Proxied — TCP connections are terminated and re-established at Cloudflare, which can interrupt long-lived sessions (for example, SAP transactions, database replication streams, or persistent RDP sessions may drop when cloudflared reconnects) | ## Recommendation For most VPN replacement scenarios, [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/cloudflared/) is the easiest way to get started. It runs on all platforms (Linux, macOS, Windows, containers, Raspberry Pi), does not require return route configuration (traffic is source-NATed to the `cloudflared` host), and does not interfere with existing VPN software on the same machine. Use [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/cloudflare-mesh/) when you need bidirectional connectivity with server-initiated traffic (VoIP, SIP, AD updates, SCCM), site-to-site networking between multiple locations, deployments where preserving the original source IP is important, or workloads with long-lived TCP connections sensitive to interruptions (SAP, database replication, ERP systems). Both methods can be used together. For example, use Tunnel for straightforward user-to-application access and add Mesh nodes where you need bidirectional or site-to-site connectivity. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/connection-methods/#page","headline":"Choose a connection method · Cloudflare Learning Paths","description":"Compare Cloudflare Mesh and Tunnel options.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/connection-methods/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-06","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/","name":"Connect your private network"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/connection-methods/","name":"Choose a connection method"}}]} ``` --- --- title: Manage overlapping IPs description: Handle overlapping IP addresses with virtual networks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Manage overlapping IPs Virtual networks provide routing isolation within your Cloudflare account. Each virtual network maintains its own routing table, allowing you to separate traffic between different environments, partners, or applications. For example, an organization may have separate "production" and "staging" VPC networks that both use the same private IP range (such as `10.128.0.0/24`). Without virtual networks, Cloudflare cannot distinguish between `10.128.0.1` in production and `10.128.0.1` in staging. By creating two virtual networks, you can deterministically route traffic to the correct environment. Users select which virtual network they want to connect to in the Cloudflare One Client. For a conceptual overview of virtual networks, including how they work across Cloudflare products, refer to [Virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/virtual-networks/). ## Example This example illustrates best practices for managing overlapping subnets. For this example, assume that you are connecting two different private networks: a production VPC that uses the `10.0.0.0/8` space holistically and a staging VPC that uses the `10.0.1.0/24` space. These networks are served by Tunnel-A and Tunnel-B respectively. The following table shows the default configuration without a virtual network assigned: | Routes in Tunnel-A | Virtual network | | ------------------ | --------------- | | 10.0.0.0/8 | default | | Routes in Tunnel-B | Virtual network | | ------------------ | --------------- | | 10.0.1.0/24 | default | In the above configuration, all user traffic to `10.0.1.0/24` takes the most specific path and routes to the staging VPC (Tunnel-B). All other `10.0.0.0/8` traffic routes to the production VPC (Tunnel-A). Users would not be able to reach the `10.0.1.0/24` subnet for the network served by Tunnel-A. To solve this problem, add a `10.0.1.0/24` route to Tunnel-A and assign it the `production` virtual network. Next, assign the `staging` virtual network to `10.0.1.0/24` in Tunnel-B. | Routes in Tunnel-A | Virtual network | | ------------------ | --------------- | | 10.0.0.0/8 | default | | 10.0.1.0/24 | production | | Routes in Tunnel-B | Virtual network | | ------------------ | --------------- | | 10.0.1.0/24 | staging | The user can now [toggle between the two virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/#connect-to-a-virtual-network) in their Cloudflare One Client, similar to the concept of switching VPN profiles in a VPN client. When a user selects `production`, they can connect to the entire `10.0.0.0/8` range served by Tunnel-A. When they select `staging`, they can connect to all of `10.0.0.0/8` in Tunnel-A except for `10.0.1.0/24`, which will be served by Tunnel-B. ## Set up virtual networks For setup instructions, refer to [Create a virtual network](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/#create-a-virtual-network). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/overlapping-ips/#page","headline":"Manage overlapping IPs · Cloudflare Learning Paths","description":"Handle overlapping IP addresses with virtual networks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/overlapping-ips/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/","name":"Connect your private network"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/overlapping-ips/","name":"Manage overlapping IPs"}}]} ``` --- --- title: Tunnel capacity for cloudflared description: Size and scale cloudflared tunnel capacity. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Tunnel capacity for cloudflared Now that you have a Cloudflare Tunnel up and running, evaluate whether `cloudflared` has enough system resources to handle the expected volume of requests from end users. Unlike legacy VPNs where throughput is determined by the server's memory, CPU and other hardware specifications, Cloudflare Tunnel throughput is primarily limited by the number of ports configured in system software. Therefore, when sizing your `cloudflared` server, the most important element is sizing the available ports on the machine to reflect the expected throughput of TCP and UDP traffic. If you have exhausted the ports on a single machine, you will need to add additional servers running `cloudflared`. ## Size the tunnel To determine how many `cloudflared` host servers you need: 1. Start with our baseline recommendations: * Run a [cloudflared replica](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/#cloudflared-replicas) on two dedicated host machines per network location. Using two hosts enables server-side redundancy and traffic balancing. * Size each host with minimum 4GB of RAM and 4 CPU cores. * Allocate 50,000 [ports](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/#number-of-ports) to the `cloudflared` process on each host. This setup is usually sufficient to handle traffic from 8,000 users (4,000 per host). 2. After you have completed this learning path and have users actively engaging with the network, [calculate](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/#calculate-your-tunnel-capacity) your actual tunnel usage. 3. Decide how much headroom you want to include and [resize the tunnel](#scale-the-tunnel) if needed. ## Scale the tunnel There are two ways to scale Cloudflare Tunnel: you could either add additional replicas of the existing tunnel (Figure 1), or you could divide your network's IP space across multiple tunnels (Figure 2). flowchart TB accTitle: Figure 1: Multiple replicas of a tunnel that proxies all private networks. subgraph replica1[my-tunnel] ip1[10.0.0.0/8
172.0.0.0/8
192.0.0.0/8] end subgraph replica2[my-tunnel] ip2[10.0.0.0/8
172.0.0.0/8
192.0.0.0/8] end subgraph replica3[my-tunnel] ip3[10.0.0.0/8
172.0.0.0/8
192.0.0.0/8] end replica1 <--> C((Cloudflare)) replica2 <--> C replica3 <--> C flowchart TB accTitle: Figure 2: Multiple tunnels proxying different private networks. subgraph tunnel-1 ip1[10.0.0.0/8] end subgraph tunnel-2 ip2[172.0.0.0/8] end subgraph tunnel-3 ip3[192.0.0.0/8] end tunnel-1 <--> C((Cloudflare)) tunnel-2 <--> C tunnel-3 <--> C ### When to add replicas Adding additional [replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/#cloudflared-replicas) of an existing Cloudflare Tunnel (two is the baseline recommendation) should only be done to support additional traffic to the IP routes in the tunnel. Replicas should always be added in the same physical location as one another so that they can operate in a pooled mode. If you are considering adding a replica in a different geographic location, reevaluate the network proxy design for your Cloudflare Tunnel and refer to [When to add tunnels](#when-to-add-tunnels). ### When to add tunnels #### Servers in different locations Consider creating brand new tunnels when your network is dispersed across different geographic locations. For example, assume that the network represented by `10.0.0.0/8` is almost entirely contiguous in Eastern United States, with one non-overlapping exception for `10.0.50.0/24` served out of the Pacific Northwest. Rather than serve an additional replica from the Pacific Northwest, we recommend breaking out `10.0.50.0/24` into a separate Cloudflare Tunnel. Serve this new tunnel from a host machine near the Pacific Northwest with its own balanced replica implementation. Note If you add the `10.0.50.0/24` range to a new tunnel without removing it from your existing `10.0.0.0/8` tunnel, Cloudflare will automatically default to the most specific path for user traffic. In other words, all traffic to `10.0.50/0/24` will flow through the newly created tunnel even though both tunnels technically include that route. #### Servers in same location Even if all routes in your network are served from the same physical location, it may eventually make sense from a control-plane redundancy perspective to split up the network into separate tunnels rather than add replicas. For instance, if you proxy the ranges `10.0.0.0/8`, `172.0.0.0/8`, and `192.0.0.0/8` from a single tunnel with multiple replicas, you may reach a point of port exhaustion with respect to the traffic flowing through the multitude of networks. It may make sense to break out `10.0.0.0/8`, `172.0.0.0/8`, and `192.0.0.0/8` into their own independent tunnels, each with their own replica. Alternatively, you could find specific applications or functions (like DNS servers or other functions that generate a high volume of independent traffic) and break them out into standalone tunnels with properly rated throughput and replica volume. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/tunnel-capacity/#page","headline":"Tunnel capacity for cloudflared · Cloudflare Learning Paths","description":"Size and scale cloudflared tunnel capacity.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/tunnel-capacity/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/","name":"Connect your private network"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/connect-private-network/tunnel-capacity/","name":"Tunnel capacity for cloudflared"}}]} ``` --- --- title: Get started with Zero Trust description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Get started with Zero Trust In this learning path, you will learn how to replace your existing VPN provider with Cloudflare's ZTNA solution. Your users will run the Cloudflare One Client on their devices, and you will run either Cloudflare Tunnel or Cloudflare Mesh in your network or on your application servers. After deploying Zero Trust, users will be able to connect to private resources (not exposed to the Internet) via TCP/UDP/ICMP, and administrators will be able to control access to these resources based on user identity, device posture, and other factors. ![How Cloudflare connects a user device to a private network application](https://edgetunnel-b2h.pages.dev/_astro/cf1-ref-arch-10.PVIlTF5F_2l0MEM.svg) This guide will highlight best practices to follow and other decisions to consider when planning your deployment. Additionally, each module will include links to the key resources and how-to pages needed to get your deployment up and running. Note This learning path focuses on client-based remote access to internal services. If you are looking for clientless or browser-based functionality, refer to our [Deploy clientless access](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/) learning path. ## Objectives By the end of this module, you will be able to: * Understand the high-level architecture and requirements for a ZTNA deployment to replace a legacy VPN. * Set up a Cloudflare account. * Create a Zero Trust organization to manage your devices and policies. * Configure an identity provider (IdP) for user authentication. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/#page","headline":"Get started with Zero Trust · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/get-started/","name":"Get started with Zero Trust"}}]} ``` --- --- title: Configure an identity provider description: Set up identity provider integration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure an identity provider An [identity provider (IdP)](https://www.cloudflare.com/learning/access-management/what-is-an-identity-provider/) stores and manages users' digital identities. You can integrate your existing identity provider with Cloudflare Zero Trust in order to manage user access to your private network. This requires configuration both in Cloudflare and with the identity provider itself. Note Some admins choose to test by authenticating with a [one-time PIN (OTP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) instead of an IdP. OTP can also be used as an alternative login method for contractors or other guests that are not part of your IdP. To add an identity provider: * [ Dashboard ](#tab-panel-9996) * [ Terraform (v5) ](#tab-panel-9997) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Integrations** \> **Identity providers**. 2. In the **Your identity providers** card, select **Add new identity provider**. 3. Select the identity provider you want to add. If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, select the [generic OIDC](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/) option. If they support SAML, select the [generic SAML](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration. 4. Fill in the necessary fields to set up your identity provider. Each identity provider will have different required fields for you to fill in. Step-by-step instructions are shown in the dashboard side panel. Alternatively, refer to the [IdP-specific documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/). 5. Once you have filled in the necessary fields, select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Organizations, Identity Providers, and Groups Write` 2. Add an identity provider to Cloudflare One using the [cloudflare\_zero\_trust\_access\_identity\_provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fidentity%5Fprovider) resource. For example, to add a Microsoft Entra ID integration: ```tf resource "cloudflare_zero_trust_access_identity_provider" "microsoft_entra_id" { account_id = var.cloudflare_account_id name = "Entra ID example" type = "azureAD" config = { client_id = var.entra_id_client_id client_secret = var.entra_id_client_secret directory_id = var.entra_id_directory_id support_groups = true } } ``` Each identity provider integration has different required attributes. You will need to obtain these attribute values from your identity provider. For more information, refer to the [IdP-specific documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/). If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, use the [generic OIDC](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/) option. If they support SAML, use the [generic SAML](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration. Users will now be able to select this IdP when they are prompted to authenticate. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/configure-idp/#page","headline":"Configure an identity provider · Cloudflare Learning Paths","description":"Set up identity provider integration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/configure-idp/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/get-started/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/get-started/configure-idp/","name":"Configure an identity provider"}}]} ``` --- --- title: Create a Cloudflare account description: Sign up for a Cloudflare account. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Cloudflare account To create a new Cloudflare account: 1. [Sign up ↗](https://dash.cloudflare.com/sign-up) on the Cloudflare dashboard. 2. To secure your account, enable [two-factor authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/). 3. If you have a Cloudflare contact (Enterprise only), ask them to set up your account as a multi-user organization. Account members will need: * [**Access** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit applications and Access policies. * [**Gateway** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit Gateway policies. * [**PII** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/#cloudflare-zero-trust-pii) to view user information in Gateway activity logs. ## Best practices If you are creating an account for your team or a business, we recommend choosing an email alias or distribution list for your **Email**, such as `cloudflare@example.com`. This email address is the main point of contact for your Cloudflare billing, usage notifications, and account recovery. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/create-cloudflare-account/#page","headline":"Create a Cloudflare account · Cloudflare Learning Paths","description":"Sign up for a Cloudflare account.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/create-cloudflare-account/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/get-started/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/get-started/create-cloudflare-account/","name":"Create a Cloudflare account"}}]} ``` --- --- title: Create a Zero Trust organization description: Set up a Zero Trust organization. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Zero Trust organization To start using Zero Trust features, create a Zero Trust organization in your Cloudflare account. ## Sign up for Zero Trust To create a Zero Trust organization: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) by going to **Zero Trust** \> **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) at any time. ## (Optional) Manage Zero Trust in Terraform You can use the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest) to manage your Zero Trust organization alongside your other IT infrastructure. To get started with Terraform, refer to our [Terraform tutorial series](https://edgetunnel-b2h.pages.dev/terraform/tutorial/). To add Zero Trust to your Terraform configuration: 1. [Sign up for Zero Trust](#sign-up-for-zero-trust) on the Cloudflare dashboard. 2. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Organizations, Identity Providers, and Groups Write` 3. Add the [cloudflare\_zero\_trust\_organization ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Forganization) resource: ```terraform resource "cloudflare_zero_trust_organization" "" { account_id = var.cloudflare_account_id name = "Acme Corporation" auth_domain = ".cloudflareaccess.com" } ``` Replace `` with the Zero Trust organization name selected during [onboarding](#sign-up-for-zero-trust). You can also view your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) under **Zero Trust** \> **Settings** \> **Team name and domain**. You can now update Zero Trust organization settings using Terraform. Tip If you plan to manage all Zero Trust settings in Terraform, set the dashboard to [API/Terraform read-only mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/api-terraform/#set-dashboard-to-read-only). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/create-zero-trust-org/#page","headline":"Create a Zero Trust organization · Cloudflare Learning Paths","description":"Set up a Zero Trust organization.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/create-zero-trust-org/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/get-started/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/get-started/create-zero-trust-org/","name":"Create a Zero Trust organization"}}]} ``` --- --- title: Prerequisites description: Review requirements before getting started. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Prerequisites To make the most of this learning path, make sure that you have the following: * A device that can run [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/), Cloudflare's endpoint agent. * A private network with applications or services that are available locally or via a VPN. * A [host server](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/#recommendations) on the private network that can run the lightweight Cloudflare Tunnel daemon process. * (Optional) A [Linux host server](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/#linux) on the private network that can run Cloudflare Mesh. This is only needed for server-initiated traffic flows such as Microsoft SCCM, Active Directory (AD) updates, and DevOps workflows that require server-initiated connections. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/prerequisites/#page","headline":"Prerequisites · Cloudflare Learning Paths","description":"Review requirements before getting started.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/get-started/prerequisites/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/get-started/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/get-started/prerequisites/","name":"Prerequisites"}}]} ``` --- --- title: Troubleshooting description: Replace your VPN with Cloudflare Zero Trust. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Troubleshooting Learn how to troubleshoot your ZTNA deployment. ## Objectives By the end of this module, you will be able to: * Investigate why users cannot connect to private network applications behind Cloudflare Tunnel. * Fix the most common causes of connectivity issues. Troubleshoot the Cloudflare One Client For step-by-step guidance on diagnosing and resolving Cloudflare One Client issues, refer to the [Cloudflare One Client troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/). The guide covers: * How to collect diagnostic logs via the Cloudflare dashboard or CLI * How to review key configuration files * Common misconfigurations and their fixes * Best practices for filing support tickets ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/troubleshooting/#page","headline":"Troubleshooting · Cloudflare Learning Paths","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/troubleshooting/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/troubleshooting/","name":"Troubleshooting"}}]} ``` --- --- title: Troubleshoot private networks description: Debug private network connectivity issues. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Troubleshoot private networks Follow this troubleshooting procedure when end users running the Cloudflare One Client have issues connecting to a private network behind Cloudflare Tunnel. ## 1\. Is the Cloudflare One Client connected to a Cloudflare data center? The Cloudflare One Client GUI should display `Connected` and `Your Internet is protected`. ![Cloudflare One Client GUI when connected to Cloudflare](https://edgetunnel-b2h.pages.dev/_astro/warp-connected.NWD7Y4NW_1F03OI.webp) If the Cloudflare One Client is stuck in the `Disconnected` state or frequently changes between `Connected` and `Disconnected`, refer to [Unable to connect WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/common-issues/#unable-to-connect-warp). ## 2\. Is the Cloudflare One Client connecting to your private DNS server? This step is only needed if users access your application via a private hostname (for example, `wiki.internal.local`). * If you are using [custom resolver policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/) to handle private DNS, go to your Gateway DNS logs (**Insights** \> **Logs** \> **DNS query logs**) and search for DNS queries to the hostname. * If you are using [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) to handle private DNS, go to your Gateway Network logs (**Insights** \> **Logs** \> **Network logs**) and search for port `53` traffic to your DNS server IP. If there are no relevant Gateway logs, it means that WARP was unable to forward the query to your private DNS server. Check your resolver policies or Local Domain Fallback configuration and refer to [How WARP handles DNS requests](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/#how-the-warp-client-handles-dns-requests). ## 3\. Is network traffic to the application going through the Cloudflare One Client? Next, check if your Gateway Network logs (**Insights** \> **Logs** \> **Network logs**) show any traffic to the destination IP. If the Cloudflare One Client is connected but there are no network logs, it means that your private network IPs are not routing through the Cloudflare One Client. You can confirm this by [searching the routing table](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/client-architecture/#routing-table) on the device for the IP address of your application. Traffic to your application should route through the Cloudflare One Client interface. If another interface is used, [check your Split Tunnel configuration](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#3-route-private-network-ips-through-the-cloudflare-one-client). ## 4\. Is the user blocked by a Gateway policy? To check if a Gateway block event occurred: 1. Go to **Insights** \> **Logs** and select the **DNS query logs**, **Network logs**, or **HTTP request logs**. 2. Apply the following filters: * **Email**: User's email address * **Event**: _Blocked_ * **Date Time Range**: Time period when the user accessed the application ## 5\. Is the user matching the correct Gateway policy? Determine whether the user is matching any policy, or if they are matching a policy that has a higher priority than the expected policy. 1. To determine the actual policy that was applied: 1. Go to **Insights** \> **Logs** and select the **DNS query logs**, **Network logs**, or **HTTP request logs**. 2. Apply the following filters: * **Email**: User's email address * **Date Time Range**: Time period when the user accessed the application 3. In the search box, filter by the destination IP or FQDN. 4. In the results, select a log and note its **Policy Name** value. 2. Go to **Traffic policies** \> **Firewall policies** and compare the [order of enforcement](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/order-of-enforcement/) of the matched policy versus the expected policy. 3. Compare the Gateway log values with the expected policy criteria. * If the mismatched value is related to identity, [check the user registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/users/) and verify the values that are passed to Gateway from your IdP. Cloudflare updates the registry when the user enrolls in the Cloudflare One Client. If the user's identity is outdated, ask the user to re-authenticate the client (**Profile** \> **Account information** \> **Re-authenticate**)[1](#user-content-fn-1). * If the mismatched value is related to device posture, [view posture check results](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/#2-verify-device-posture-checks) for the user's device. Verify that the device passes the posture checks configured in the policy. ## 6\. Are the correct Gateway proxy settings enabled? Under **Traffic policies** \> **Traffic settings**, ensure that **Allow Secure Web Gateway to proxy traffic** is enabled for TCP, UDP, and ICMP traffic. UDP is required for proxying DNS traffic and other UDP packets, while ICMP is required for `ping` and other administrative functions. ## 7\. Is the user's traffic reaching the tunnel? [Review your tunnel log stream](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/#view-logs-on-your-local-machine). If you do not see any requests to your application, ensure that you have added the appropriate static routes to your Cloudflare Tunnel. ## 8\. Is the tunnel forwarding requests to your application? Verify that you can connect to the application directly from the `cloudflared` host machine: * [ macOS and Linux ](#tab-panel-9998) * [ Windows ](#tab-panel-9999) Open Terminal and run the following command: ```sh telnet test.example.com 443 ``` If `telnet` fails to open the connection, check your infrastructure for firewalls, load balancers, or other network devices that may be interfering with the connection between `cloudflared` and the application server. Open PowerShell and run the following command: **PowerShell** ```powershell PS C:\Users\JohnDoe> Test-NetConnection test.example.com -port 443 ``` If the output shows `TcpTestSucceeded : False`, check your infrastructure for firewalls, load balancers, or other network devices that may be interfering with the connection between `cloudflared` and the application server. You can also use a packet capture tool such as `tcpdump` or Wireshark to trace whether traffic from the user device successfully reaches `cloudflared` and routes to your application. Traffic to your application will carry the source IP of the `cloudflared` host. ## 9\. How is your application handling requests? 1. Check if the application server has a local firewall in place that is blocking requests from the `cloudflared` host machine. 2. Check if the application server needs to initiate any connection towards the user's device. If so, this is a limitation of `cloudflared` and you should instead [deploy Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) to enable bidirectional traffic. ## 10\. Is TLS inspection affecting the connection to your application? If there is a problem with [TLS inspection](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/), the user will get an `Insecure Upstream` error when they access the application in a browser. They will probably not get an error if they access the application outside of a browser. Customers who have [Logpush](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/logpush/) enabled can check the [Gateway HTTP dataset](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/gateway%5Fhttp/) for any hostnames which have an elevated rate of `526` HTTP status codes. To troubleshoot TLS inspection: 1. Create a temporary Gateway HTTP policy that disables TLS inspection for all traffic to the application. For example: | Selector | Operator | Value | Action | | -------------- | -------- | ----------- | -------------- | | Destination IP | in | 10.2.3.4/32 | Do Not Inspect | 2. If the `Do Not Inspect` policy enables the user to connect, verify that the TLS certificate used by your application is trusted by a public CA and not self-signed. Cloudflare Gateway is unable to negotiate TLS with applications that use self-signed certificates. For more information, refer to [TLS inspection limitations](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/#inspection-limitations). To work around the issue: * **Option 1:** Create a permanent [Do Not Inspect HTTP policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/#do-not-inspect) for this application. * **Option 2:** Customers who use their [own certificate infrastructure](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) for inspection can opt to create an [Allow _Pass Through_ policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/#untrusted-certificates) which enables our proxy to accept the TLS negotiation from your application. This will allow requests to flow correctly without the need for a `Do Not Inspect` policy. * **Option 3:** If your application uses `HTTPS` or other common protocols, you can add a [published application](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) to your Cloudflare Tunnel and set [noTLSVerify](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#notlsverify) to `true`. This will allow `cloudflared` to trust your self-signed certificate. ## Footnotes 1. In Cloudflare One Client version 2026.1 and earlier, select **Preferences** \> **Account** \> **Re-Authenticate Session**. [↩](#user-content-fnref-1) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/troubleshooting/troubleshoot-private-networks/#page","headline":"Troubleshoot private networks · Cloudflare Learning Paths","description":"Debug private network connectivity issues.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/troubleshooting/troubleshoot-private-networks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/replace-vpn/troubleshooting/","name":"Troubleshooting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/replace-vpn/troubleshooting/troubleshoot-private-networks/","name":"Troubleshoot private networks"}}]} ``` --- --- title: Overview description: Learn SASE architecture and Cloudflare One fundamentals. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Overview ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/#page","headline":"Overview · Cloudflare Learning Paths","description":"Learn SASE architecture and Cloudflare One fundamentals.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/sase-overview-course/series/","name":"Overview"}}]} ``` --- --- title: Connect and secure from any network to anywhere description: Connect networks securely with Cloudflare SASE. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect and secure from any network to anywhere * [ Watch this episode ](#tab-panel-10000) * [ Series overview ](#tab-panel-10001) Build your new corporate network with Cloudflare, connecting any network into our modern SASE platform and secure applications, users, devices and your company data. In this video you will learn all the different methods of connecting networks to Cloudflare and what services can be used to improve security and performance. Chapters * ![Introduction to SASE and the Need for Modern, Secure Corporate Networking](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/86f22d1f760b77cdc349f89b25b63c3e/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction to SASE and the Need for Modern, Secure Corporate Networking** 0s * ![Using Cloudflare to Unify and Secure Corporate Networks Across Multiple Locations](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/86f22d1f760b77cdc349f89b25b63c3e/thumbnails/thumbnail.jpg?fit=crop&time=117s) **Using Cloudflare to Unify and Secure Corporate Networks Across Multiple Locations** 1m57s * ![Enabling Secure Remote Access for Distributed Teams with Cloudflare's Zero Trust Approach](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/86f22d1f760b77cdc349f89b25b63c3e/thumbnails/thumbnail.jpg?fit=crop&time=167s) **Enabling Secure Remote Access for Distributed Teams with Cloudflare's Zero Trust Approach** 2m47s * ![Integrating Private Networks and Data Centers using various methods](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/86f22d1f760b77cdc349f89b25b63c3e/thumbnails/thumbnail.jpg?fit=crop&time=257s) **Integrating Private Networks and Data Centers using various methods** 4m17s * ![Cloudflare's Connectivity Cloud: Security, Performance, and Simplified Network Management](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/86f22d1f760b77cdc349f89b25b63c3e/thumbnails/thumbnail.jpg?fit=crop&time=317s) **Cloudflare's Connectivity Cloud: Security, Performance, and Simplified Network Management** 5m17s **Related content** If you want to dive into detail about using Cloudflare to modernize your corporate network, refer to the following pages: * [Evolving to a SASE architecture with Cloudflare](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/) * [WAN transformation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-wan/wan-transformation/) * [Magic Transit Reference Architecture](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/magic-transit/) * [Protect data center networks](https://edgetunnel-b2h.pages.dev/reference-architecture/diagrams/network/protect-data-center-networks/) * [Protect hybrid cloud networks](https://edgetunnel-b2h.pages.dev/reference-architecture/diagrams/network/protect-hybrid-cloud-networks-with-cloudflare-magic-transit/) [ Watch Episode 1: The evolution of corporate networks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) In this video, we provide a Cloudflare SASE platform overview and how it has been designed to revolutionize the corporate network. [ Watch Episode 2: Stop hosting your own VPN service ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/) In this video, we discuss the Cloudflare SASE platform and how it can replace your traditional VPN appliances. [ Watch Episode 3: Secure remote access to your critical infrastructure ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/) In this video, learn how Cloudflare's SASE platform leverages a modern ZTNA service to implement zero trust principles for accessing your critical infrastructure. [ Watch Episode 4: Connect and secure from any network to anywhere ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/) In this video, we discuss how to connect any network to Cloudflare to any other network and the Internet. Learn how this improves security and performance for your networks and applications. [ Watch Episode 5: Protect your users from Internet risks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/) In this video, we will explore how Cloudflare's Secure Web Gateway (SWG) helps keep users and devices safe by filtering and inspecting Internet traffic in real time. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/#page","headline":"Connect and secure from any network to anywhere · Cloudflare Learning Paths","description":"Connect networks securely with Cloudflare SASE.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/sase-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/","name":"Connect and secure from any network to anywhere"}}]} ``` --- --- title: The evolution of corporate networks description: Explore how corporate networks have evolved. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # The evolution of corporate networks * [ Watch this episode ](#tab-panel-10002) * [ Series overview ](#tab-panel-10003) In this video, we discuss Cloudflare One, our Secure Access Service Edge (SASE) platform and how it has been designed to revolutionize the corporate network and enable companies with their Zero Trust strategy. Legacy network design is struggling to address today's challenges of security, performance and monitoring needs. Many IT teams are trying to evolve their corporate network with point solutions and finding the lack of integration and performance an issue. Chapters * ![Introduction to SASE and Modern Corporate Networking](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/a4ede34e937c81781575af6494828b5b/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction to SASE and Modern Corporate Networking** 0s * ![The Evolution of Corporate Networks and Security Challenges](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/a4ede34e937c81781575af6494828b5b/thumbnails/thumbnail.jpg?fit=crop&time=68s) **The Evolution of Corporate Networks and Security Challenges** 1m8s * ![Why Legacy Solutions Like VPNs and SD-WAN Are Insufficient](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/a4ede34e937c81781575af6494828b5b/thumbnails/thumbnail.jpg?fit=crop&time=185s) **Why Legacy Solutions Like VPNs and SD-WAN Are Insufficient** 3m5s * ![How Cloudflare's Global Network Powers SASE Solutions](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/a4ede34e937c81781575af6494828b5b/thumbnails/thumbnail.jpg?fit=crop&time=253s) **How Cloudflare's Global Network Powers SASE Solutions** 4m13s * ![The Role of Cloudflare's Connectivity Cloud in Securing Enterprises](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/a4ede34e937c81781575af6494828b5b/thumbnails/thumbnail.jpg?fit=crop&time=328s) **The Role of Cloudflare's Connectivity Cloud in Securing Enterprises** 5m28s * ![Simplified Security, Network Optimization, and Cost Savings with Cloudflare](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/a4ede34e937c81781575af6494828b5b/thumbnails/thumbnail.jpg?fit=crop&time=375s) **Simplified Security, Network Optimization, and Cost Savings with Cloudflare** 6m15s **Related content** If you want to dive into detail about modernizing your corporate network with Cloudflare, refer to the following pages: * [Evolving to a SASE architecture with Cloudflare](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/) * [Network-focused migration from VPN concentrators to Zero Trust Network Access](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/network-vpn-migration/) * [Using a Zero Trust framework to secure SaaS applications](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/zero-trust-for-saas/) * [Building Zero Trust architecture into your startup](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/zero-trust-for-startups/) [ Watch Episode 1: The evolution of corporate networks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) In this video, we provide a Cloudflare SASE platform overview and how it has been designed to revolutionize the corporate network. [ Watch Episode 2: Stop hosting your own VPN service ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/) In this video, we discuss the Cloudflare SASE platform and how it can replace your traditional VPN appliances. [ Watch Episode 3: Secure remote access to your critical infrastructure ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/) In this video, learn how Cloudflare's SASE platform leverages a modern ZTNA service to implement zero trust principles for accessing your critical infrastructure. [ Watch Episode 4: Connect and secure from any network to anywhere ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/) In this video, we discuss how to connect any network to Cloudflare to any other network and the Internet. Learn how this improves security and performance for your networks and applications. [ Watch Episode 5: Protect your users from Internet risks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/) In this video, we will explore how Cloudflare's Secure Web Gateway (SWG) helps keep users and devices safe by filtering and inspecting Internet traffic in real time. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/#page","headline":"The evolution of corporate networks · Cloudflare Learning Paths","description":"Explore how corporate networks have evolved.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/sase-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/","name":"The evolution of corporate networks"}}]} ``` --- --- title: Protect your users from Internet risks description: Filter Internet traffic to protect users. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Protect your users from Internet risks * [ Watch this episode ](#tab-panel-10004) * [ Series overview ](#tab-panel-10005) The Internet has become part of your corporate network, however browsing the web comes with hidden risks including malware, phishing attacks, and malicious websites. In this video, we will explore how Cloudflare's Secure Web Gateway (SWG) helps keep users safe by filtering and inspecting Internet traffic in real time. Whether you are protecting a remote workforce or securing an entire organization, Cloudflare ensures that users can access the web securely — without sacrificing speed or productivity. Chapters * ![Introduction to Cloudflare's SASE and the Importance of Secure Corporate Networking](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/48a3b49b7cdfaef0b3044d1530c82c19/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction to Cloudflare's SASE and the Importance of Secure Corporate Networking** 0s * ![Using Secure Web Gateway to Inspect and Control Internet Traffic](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/48a3b49b7cdfaef0b3044d1530c82c19/thumbnails/thumbnail.jpg?fit=crop&time=66s) **Using Secure Web Gateway to Inspect and Control Internet Traffic** 1m6s * ![Protecting Users with DNS Filtering and Threat Intelligence](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/48a3b49b7cdfaef0b3044d1530c82c19/thumbnails/thumbnail.jpg?fit=crop&time=124s) **Protecting Users with DNS Filtering and Threat Intelligence** 2m4s * ![Implementing Network-Level Security Policies for Private and Public Traffic](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/48a3b49b7cdfaef0b3044d1530c82c19/thumbnails/thumbnail.jpg?fit=crop&time=217s) **Implementing Network-Level Security Policies for Private and Public Traffic** 3m37s * ![Advanced HTTP Filtering and Data Loss Prevention with Cloudflare](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/48a3b49b7cdfaef0b3044d1530c82c19/thumbnails/thumbnail.jpg?fit=crop&time=263s) **Advanced HTTP Filtering and Data Loss Prevention with Cloudflare** 4m23s * ![Isolating Risky Websites and Preventing Data Leaks with Browser Isolation](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/48a3b49b7cdfaef0b3044d1530c82c19/thumbnails/thumbnail.jpg?fit=crop&time=348s) **Isolating Risky Websites and Preventing Data Leaks with Browser Isolation** 5m48s **Related content** If you want to dive into detail about modernizing your corporate network with Cloudflare, refer to the following pages: * [Evolving to a SASE architecture with Cloudflare](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/) * [Network-focused migration from VPN concentrators to Zero Trust Network Access](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/network-vpn-migration/) * [Using a Zero Trust framework to secure SaaS applications](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/zero-trust-for-saas/) * [Building Zero Trust architecture into your startup](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/zero-trust-for-startups/) [ Watch Episode 1: The evolution of corporate networks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) In this video, we provide a Cloudflare SASE platform overview and how it has been designed to revolutionize the corporate network. [ Watch Episode 2: Stop hosting your own VPN service ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/) In this video, we discuss the Cloudflare SASE platform and how it can replace your traditional VPN appliances. [ Watch Episode 3: Secure remote access to your critical infrastructure ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/) In this video, learn how Cloudflare's SASE platform leverages a modern ZTNA service to implement zero trust principles for accessing your critical infrastructure. [ Watch Episode 4: Connect and secure from any network to anywhere ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/) In this video, we discuss how to connect any network to Cloudflare to any other network and the Internet. Learn how this improves security and performance for your networks and applications. [ Watch Episode 5: Protect your users from Internet risks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/) In this video, we will explore how Cloudflare's Secure Web Gateway (SWG) helps keep users and devices safe by filtering and inspecting Internet traffic in real time. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/#page","headline":"Protect your users from Internet risks · Cloudflare Learning Paths","description":"Filter Internet traffic to protect users.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/sase-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/","name":"Protect your users from Internet risks"}}]} ``` --- --- title: Secure remote access to your critical infrastructure description: Secure remote access to critical infrastructure. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Secure remote access to your critical infrastructure * [ Watch this episode ](#tab-panel-10006) * [ Series overview ](#tab-panel-10007) In this video learn how Cloudflare's SASE platform can provide highly secure access to your critical infrastructure by leveraging a modern ZTNA service to implement Zero Trust principles. Applications, databases and their servers are running in a variety of locations from on-premises data centers to cloud hyperscalers, making the need to secure administrative access more important than ever. Chapters * ![Introduction to SASE and Securing Access to Critical Infrastructure](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/f13b085ed4d28a9dbb8faf19ae986125/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction to SASE and Securing Access to Critical Infrastructure** 0s * ![Connecting and Securing Private Servers with Cloudflare Tunnels](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/f13b085ed4d28a9dbb8faf19ae986125/thumbnails/thumbnail.jpg?fit=crop&time=50s) **Connecting and Securing Private Servers with Cloudflare Tunnels** 50s * ![Using Internal DNS to Securely Resolve Private Network Resources](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/f13b085ed4d28a9dbb8faf19ae986125/thumbnails/thumbnail.jpg?fit=crop&time=132s) **Using Internal DNS to Securely Resolve Private Network Resources** 2m12s * ![Connecting User Devices Securely with Cloudflare's Device Agent](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/f13b085ed4d28a9dbb8faf19ae986125/thumbnails/thumbnail.jpg?fit=crop&time=181s) **Connecting User Devices Securely with Cloudflare's Device Agent** 3m1s * ![Enforcing Access Control with Identity, Network and Device Based Security Policies](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/f13b085ed4d28a9dbb8faf19ae986125/thumbnails/thumbnail.jpg?fit=crop&time=228s) **Enforcing Access Control with Identity, Network and Device Based Security Policies** 3m48s * ![Auditing and Logging Access to Critical Infrastructure](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/f13b085ed4d28a9dbb8faf19ae986125/thumbnails/thumbnail.jpg?fit=crop&time=303s) **Auditing and Logging Access to Critical Infrastructure** 5m3s **Related content** If you want to dive into detail about using Cloudflare to access critical infrastructure, refer to the following pages: * [Evolving to a SASE architecture with Cloudflare](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/) * [SSH with Access for Infrastructure](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) * [Using a Zero Trust framework to secure SaaS applications](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/zero-trust-for-saas/) * [Building Zero Trust architecture into your startup](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/zero-trust-for-startups/) [ Watch Episode 1: The evolution of corporate networks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) In this video, we provide a Cloudflare SASE platform overview and how it has been designed to revolutionize the corporate network. [ Watch Episode 2: Stop hosting your own VPN service ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/) In this video, we discuss the Cloudflare SASE platform and how it can replace your traditional VPN appliances. [ Watch Episode 3: Secure remote access to your critical infrastructure ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/) In this video, learn how Cloudflare's SASE platform leverages a modern ZTNA service to implement zero trust principles for accessing your critical infrastructure. [ Watch Episode 4: Connect and secure from any network to anywhere ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/) In this video, we discuss how to connect any network to Cloudflare to any other network and the Internet. Learn how this improves security and performance for your networks and applications. [ Watch Episode 5: Protect your users from Internet risks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/) In this video, we will explore how Cloudflare's Secure Web Gateway (SWG) helps keep users and devices safe by filtering and inspecting Internet traffic in real time. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/#page","headline":"Secure remote access to your critical infrastructure · Cloudflare Learning Paths","description":"Secure remote access to critical infrastructure.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/sase-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/","name":"Secure remote access to your critical infrastructure"}}]} ``` --- --- title: Stop hosting your own VPN service description: Replace self-hosted VPNs with ZTNA. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Stop hosting your own VPN service * [ Watch this episode ](#tab-panel-10008) * [ Series overview ](#tab-panel-10009) Cloudflare's SASE platform can replace your traditional, expensive VPN appliances which deliver poor performance for users and create more security risks than solve them. Cloudflare's Zero Trust Network Access (ZTNA) service is a more secure, highly scalable cloud solution. In this video we look at how easily you can deploy Cloudflare to secure access to internal resources. Chapters * ![Introduction to Corporate Network Security and Access Challenges](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/0410c73fe3fdd36142ec08bac77e8f97/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction to Corporate Network Security and Access Challenges** 0s * ![Cloudflare's SASE Approach to Securing Internal Applications](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/0410c73fe3fdd36142ec08bac77e8f97/thumbnails/thumbnail.jpg?fit=crop&time=75s) **Cloudflare's SASE Approach to Securing Internal Applications** 1m15s * ![Connecting Internal Applications to Cloudflare with Secure Tunnels](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/0410c73fe3fdd36142ec08bac77e8f97/thumbnails/thumbnail.jpg?fit=crop&time=114s) **Connecting Internal Applications to Cloudflare with Secure Tunnels** 1m54s * ![Implementing Identity-Based, Clientless Access Control Access Control](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/0410c73fe3fdd36142ec08bac77e8f97/thumbnails/thumbnail.jpg?fit=crop&time=162s) **Implementing Identity-Based, Clientless Access Control Access Control** 2m42s * ![Leveraging Anycast Networking for Faster and More Secure Application Access](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/0410c73fe3fdd36142ec08bac77e8f97/thumbnails/thumbnail.jpg?fit=crop&time=336s) **Leveraging Anycast Networking for Faster and More Secure Application Access** 5m36 * ![Enhancing Security with Micro-Segmentation and Cloudflare's Global Network](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/0410c73fe3fdd36142ec08bac77e8f97/thumbnails/thumbnail.jpg?fit=crop&time=419s) **Enhancing Security with Micro-Segmentation and Cloudflare's Global Network** 6m:59s **Related content** If you want to dive into detail about using Cloudflare to replace your existing VPN solution, refer to the following pages: * [Evolving to a SASE architecture with Cloudflare](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/) * [Network-focused migration from VPN concentrators to Zero Trust Network Access](https://edgetunnel-b2h.pages.dev/reference-architecture/design-guides/network-vpn-migration/) * [Access to private apps without having to deploy client agents](https://edgetunnel-b2h.pages.dev/reference-architecture/diagrams/sase/sase-clientless-access-private-dns/) * [Zero Trust and Virtual Desktop Infrastructure](https://edgetunnel-b2h.pages.dev/reference-architecture/diagrams/sase/zero-trust-and-virtual-desktop-infrastructure/) [ Watch Episode 1: The evolution of corporate networks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) In this video, we provide a Cloudflare SASE platform overview and how it has been designed to revolutionize the corporate network. [ Watch Episode 2: Stop hosting your own VPN service ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/) In this video, we discuss the Cloudflare SASE platform and how it can replace your traditional VPN appliances. [ Watch Episode 3: Secure remote access to your critical infrastructure ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/secure-remote-access-to-critical-infrastructure-3/) In this video, learn how Cloudflare's SASE platform leverages a modern ZTNA service to implement zero trust principles for accessing your critical infrastructure. [ Watch Episode 4: Connect and secure from any network to anywhere ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/connect-secure-from-any-network-to-anywhere-4/) In this video, we discuss how to connect any network to Cloudflare to any other network and the Internet. Learn how this improves security and performance for your networks and applications. [ Watch Episode 5: Protect your users from Internet risks ](https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/protect-users-from-internet-risks-5/) In this video, we will explore how Cloudflare's Secure Web Gateway (SWG) helps keep users and devices safe by filtering and inspecting Internet traffic in real time. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/#page","headline":"Stop hosting your own VPN service · Cloudflare Learning Paths","description":"Replace self-hosted VPNs with ZTNA.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/sase-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/sase-overview-course/series/stop-hosting-own-vpn-service-2/","name":"Stop hosting your own VPN service"}}]} ``` --- --- title: Build DNS security policies description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build DNS security policies DNS security is an important, wide-reaching, and early action in the lifecycle of a request. Cloudflare operates one of the world's largest and fastest public DNS resolvers. Your users' public DNS requests will be resolved by that same resolution engine -- whether they are connecting from a network pointing its resolvers to Cloudflare or an endpoint running the Cloudflare One Client. ## Objectives By the end of this module, you will be able to: * Create your first Gateway DNS policy. * Build an allow or block list for use in firewall policies. * Onboard networks to Gateway to filter DNS queries. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/#page","headline":"Build DNS security policies · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/","name":"Build DNS security policies"}}]} ``` --- --- title: Create an allowlist or blocklist description: Create DNS allow and block lists. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create an allowlist or blocklist In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications. Gateway supports creating [lists](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/) of URLs, hostnames, or other entries to use in your policies. ## Example list policy * [ Dashboard ](#tab-panel-10010) * [ API ](#tab-panel-10011) * [ Terraform ](#tab-panel-10012) The following DNS policy will allow access to all approved corporate domains included in a list called **Corporate Domains**. | Selector | Operator | Value | Action | | -------- | -------- | ------------------- | ------ | | Domain | in list | _Corporate Domains_ | Allow | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-CorporateDomain-AllowList", "description": "Allow access to the corporate domains defined under the Corporate Domains list", "precedence": 1, "enabled": true, "action": "allow", "filters": [ "dns" ], "traffic": "any(dns.domains[*] in $)" }' ``` To create a new DNS policy using **Terraform** to allow access to all approved corporate domains included in a list called **Corporate Domains**. ```tf resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" { account_id = var.cloudflare_account_id name = "All-DNS-CorporateDomain-AllowList" description = "Allow access to the corporate domains defined under the Corporate Domains list" precedence = 1 enabled = false action = "allow" filters = ["dns"] traffic = "any(dns.domains[*] in $)" } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/create-list/#page","headline":"Create an allowlist or blocklist · Cloudflare Learning Paths","description":"Create DNS allow and block lists.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/create-list/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/","name":"Build DNS security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/create-list/","name":"Create an allowlist or blocklist"}}]} ``` --- --- title: Create your first DNS policy description: Build your first Gateway DNS policy. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create your first DNS policy DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP. You can filter DNS traffic based on query or response parameters (such as domain, source IP, or geolocation). You can also filter by user identity if you connect your devices to Gateway with the [Cloudflare One Client or Cloudflare One Agent](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent/). To create a new DNS policy: * [ Dashboard ](#tab-panel-10013) * [ API ](#tab-panel-10014) * [ Terraform ](#tab-panel-10015) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **DNS** tab, select **Add a policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block. 5. Choose an **Action** to take when traffic matches the logical expression. For example, we recommend adding a policy to block all [security categories](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-categories): | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All security risks_ | Block | 6. Select **Create policy**. For more information, refer to [DNS policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/). To create a new DNS policy using cURL: **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-SecurityCategories-Blocklist", "description": "Block known security risks based on Cloudflare'\''s threat intelligence", "precedence": 0, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})", "rule_settings": { "block_page_enabled": true, "block_reason": "This domain was blocked due to being classified as a security risk to your organization" } }' ``` To create a new DNS policy using **Terraform**: ```tf resource "cloudflare_zero_trust_gateway_policy" "security_risks_dns_policy" { account_id = var.cloudflare_account_id name = "All-DNS-SecurityCategories-Blocklist" description = "Block known security risks based on Cloudflare's threat intelligence" precedence = 0 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})" rule_settings { block_page_enabled = true block_page_reason = "This domain was blocked due to being classified as a security risk to your organization" } } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/create-policy/#page","headline":"Create your first DNS policy · Cloudflare Learning Paths","description":"Build your first Gateway DNS policy.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/create-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/","name":"Build DNS security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/create-policy/","name":"Create your first DNS policy"}}]} ``` --- --- title: Onboard DNS for a network description: Configure DNS filtering for a network. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Onboard DNS for a network The fastest way to start filtering DNS queries is to change your DNS resolver to use a specific Gateway endpoint. You can make this change at the browser, OS, or router level. Choose this option if: * You want to try out DNS filtering without installing software. * You do not need to filter by user identity. * You want to apply blanket DNS policies to all devices in a physical location, such as a retail store or office. ## Change DNS resolver in browser To configure your browser to send traffic to Gateway: 1. Obtain your DNS over HTTPS (DoH) address: 1. Go to **Gateway** \> **DNS locations**. 2. Select **Add a location**. 3. Enter a name for the location. 4. Turn on **Set as Default DNS Location**. 5. Select **Add location**. 6. Copy your **DNS over HTTPS** hostname: `https://.cloudflare-gateway.com/dns-query` 2. Follow the configuration instructions for your browser: Mozilla Firefox 1. In Firefox, go to **Settings**. 2. In **Privacy & Security**, go to **DNS over HTTPS**. 3. Under **Enable secure DNS using**, select _Max Protection_. 4. In **Choose provider**, choose _Custom_. 5. In the field, enter `https://.cloudflare-gateway.com/dns-query`. Firefox is now configured to use your DoH endpoint. For more information on configuring DoH settings in Firefox, refer to [Mozilla's documentation ↗](https://support.mozilla.org/kb/dns-over-https). Note If you want to enforce DNS policies through the Cloudflare One Client instead of over DoH, you can disable DoH for your organization by blocking the [Firefox DoH canary domain ↗](https://support.mozilla.org/kb/canary-domain-use-application-dnsnet). Google Chrome 1. In Chrome, go to **Settings** \> **Privacy and security** \> **Security**. 2. Scroll down and turn on **Use secure DNS**. 3. Select **With Custom**. 4. In the **Enter custom provider** field, enter `https://.cloudflare-gateway.com/dns-query`. Read more about [enabling DNS over HTTPS ↗](https://www.chromium.org/developers/dns-over-https) on Chrome. Microsoft Edge 1. In Microsoft Edge, go to **Settings**. 2. Select **Privacy, Search, and Services**, and scroll down to **Security**. 3. Turn on **Use secure DNS**. 4. Select **Choose a service provider**. 5. In the **Enter custom provider** field, enter `https://.cloudflare-gateway.com/dns-query`. Brave 1. In Brave, go to **Settings** \> **Security and Privacy** \> **Security**. 2. Turn on **Use secure DNS**. 3. Select **With Custom**. 4. In the **Enter custom provider** field, enter `https://.cloudflare-gateway.com/dns-query`. Safari Currently, Safari does not support DNS over HTTPS. 3. Verify that third-party firewall or TLS decryption software does not inspect or block traffic to the DoH endpoint: `https://.cloudflare-gateway.com/dns-query`. DNS filtering is now turned on for this browser. To configure your router or OS, or to add additional DNS endpoints, refer to [DNS locations](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/dns/locations/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/onboard-dns/#page","headline":"Onboard DNS for a network · Cloudflare Learning Paths","description":"Configure DNS filtering for a network.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/onboard-dns/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/","name":"Build DNS security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/onboard-dns/","name":"Onboard DNS for a network"}}]} ``` --- --- title: Recommended DNS policies description: Deploy recommended DNS filtering policies. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Recommended DNS policies We recommend you add the following DNS policies to build an Internet and SaaS app security strategy for your organization. For additional commonly used DNS policy examples, refer to [Common DNS policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/common-policies/). For more information on building DNS policies, refer to [DNS policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/). ## All-DNS-Domain-Allowlist Allowlist any known domains and hostnames. With this policy, you ensure that your users can access your organization's domains even if the domains fall under a blocked category, such as **Newly Seen Domains** or **Login Screens**. * [ Dashboard ](#tab-panel-10016) * [ API ](#tab-panel-10017) * [ Terraform ](#tab-panel-10018) | Selector | Operator | Value | Logic | Action | | -------- | -------- | --------------- | ----- | ------ | | Domain | in list | _Known Domains_ | Or | Allow | | Host | in list | _Known Domains_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-Domain-Allowlist", "description": "Allowlist any known domains and hostnames", "precedence": 0, "enabled": true, "action": "allow", "filters": [ "dns" ], "traffic": "any(dns.domains[*] in $) or dns.fqdn in $" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" { account_id = var.cloudflare_account_id name = "All-DNS-Domain-Allowlist" description = "Allowlist any known domains and hostnames" precedence = 0 enabled = true action = "allow" filters = ["dns"] traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}) or dns.fqdn in ${"$"}${cloudflare_zero_trust_list.domain_whitelist.id}" } ``` ## Quarantined-Users-DNS-Restricted-Access Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected. * [ Dashboard ](#tab-panel-10019) * [ API ](#tab-panel-10020) * [ Terraform ](#tab-panel-10021) | Selector | Operator | Value | Logic | Action | | ---------------- | ----------- | ----------------------------- | ----- | ------ | | Domain | not in list | _Allowed Remediation Domains_ | Or | Block | | Host | not in list | _Allowed Remediation Domains_ | And | | | User Group Names | in | _Quarantined Users_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Quarantined-Users-DNS-Restricted-Access", "description": "Restrict access for users included in an identity provider (IdP) user group for risky users", "precedence": 10, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "not(any(dns.domains[] in $)) or not(any(dns.domains[] in $))", "identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" { account_id = var.cloudflare_account_id name = "Quarantined-Users-DNS-Restricted-Access" description = "Restrict access for users included in an identity provider (IdP) user group for risky users" precedence = 10 enabled = true action = "block" filters = ["dns"] traffic = "not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id})) or not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id}))" identity = "any(identity.groups.name[*] in {\"Quarantined Users\"})" } ``` ## All-DNS-SecurityCategories-Blocklist Block [security categories](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-categories), such as **Command and Control & Botnet** and **Malware**, based on Cloudflare's threat intelligence. * [ Dashboard ](#tab-panel-10037) * [ API ](#tab-panel-10038) * [ Terraform ](#tab-panel-10039) | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All security risks_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-SecurityCategories-Blocklist", "description": "Block security categories based on Cloudflare'\''s threat intelligence", "precedence": 20, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})", "identity": "" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "block_security_threats" { account_id = var.cloudflare_account_id name = "All-DNS-SecurityCategories-Blocklist" description = "Block security categories based on Cloudflare's threat intelligence" precedence = 20 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})" } ``` ## All-DNS-ContentCategories-Blocklist Entries in the [security risk content subcategory](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-risk-subcategories), such as **New Domains**, do not always pose a security threat. We recommend you first create an Allow policy to track policy matching and identify any false positives. You can add false positives to your **Trusted Domains** list used in **All-DNS-Domain-Allowlist**. After your test is complete, we recommend you change the action to Block to minimize risk to your organization. * [ Dashboard ](#tab-panel-10040) * [ API ](#tab-panel-10041) * [ Terraform ](#tab-panel-10042) | Selector | Operator | Value | Action | | ------------------ | -------- | --------------------------------------------------------- | ------ | | Content Categories | in | _Questionable Content_, _Security Risks_, _Miscellaneous_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-ContentCategories-Blocklist", "description": "Block common content categories that may pose a risk", "precedence": 30, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})", "identity": "" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "block_content_categories" { account_id = var.cloudflare_account_id name = "All-DNS-ContentCategories-Blocklist" description = "Block common content categories that may pose a risk" enabled = true action = "block" filters = ["dns"] traffic = "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})" identity = "" } ``` ## All-DNS-Application-Blocklist Block unauthorized applications to limit your users' access to certain web-based tools and minimize the risk of [shadow IT](https://www.cloudflare.com/learning/access-management/what-is-shadow-it/). For example, the following policy blocks known AI tools: * [ Dashboard ](#tab-panel-10043) * [ API ](#tab-panel-10044) * [ Terraform ](#tab-panel-10045) | Selector | Operator | Value | Action | | ----------- | -------- | ------------------------- | ------ | | Application | in | _Artificial Intelligence_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-Application-Blocklist", "description": "Block access to unauthorized AI applications", "precedence": 40, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(app.type.ids[*] in {25})", "identity": "" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "block_unauthorized_apps" { account_id = var.cloudflare_account_id name = "All-DNS-Application-Blocklist" description = "Block access to unauthorized AI applications" enabled = true action = "block" filters = ["dns"] traffic = "any(app.type.ids[*] in {25})" identity = "" } ``` ## All-DNS-GeoCountryIP-Blocklist Block websites hosted in countries categorized as high risk. The designation of such countries may result from your organization's users or through the implementation of regulations including [EAR ↗](https://www.tradecompliance.pitt.edu/embargoed-and-sanctioned-countries), [OFAC ↗](https://orpa.princeton.edu/export-controls/sanctioned-countries), and [ITAR ↗](https://www.tradecompliance.pitt.edu/embargoed-and-sanctioned-countries). * [ Dashboard ](#tab-panel-10022) * [ API ](#tab-panel-10023) * [ Terraform ](#tab-panel-10024) | Selector | Operator | Value | Action | | ------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | | Resolved Country IP Geolocation | in | _Afghanistan_, _Belarus_, _Congo (Kinshasa)_, _Cuba_, _Iran_, _Iraq_, _Korea (North)_, _Myanmar_, _Russian Federation_, _Sudan_, _Syria_, _Ukraine_, _Zimbabwe_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-GeoCountryIP-Blocklist", "description": "Block traffic hosted in countries categorized as high security risks", "precedence": 50, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_geolocation_block_policy" { account_id = var.cloudflare_account_id name = "All-DNS-GeoCountryIP-Blocklist" description = "Block traffic hosted in countries categorized as high security risks" precedence = 50 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})" } ``` ## All-DNS-DomainTopLevel-Blocklist Block frequently misused top-level domains (TLDs) to reduce security risks, especially when there is no discernible advantage to be gained from allowing access. Similarly, restricting access to specific country-level TLDs may be necessary to comply with regulations such as [OFAC ↗](https://orpa.princeton.edu/export-controls/sanctioned-countries) and [ITAR ↗](https://www.tradecompliance.pitt.edu/embargoed-and-sanctioned-countries). * [ Dashboard ](#tab-panel-10025) * [ API ](#tab-panel-10026) * [ Terraform ](#tab-panel-10027) | Selector | Operator | Value | Action | | -------- | ------------- | -------------------------------------------------------------------------------------------------- | ------ | | Domain | matches regex | \[.\](cn\|ru)$ or \[.\](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or \[.\](zip|mobi)$ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-DomainTopLevel-Blocklist", "description": "Block DNS queries of known risky TLDs", "precedence": 60, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.domains[*] matches \".$ or .$ or .$\")" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_blacklist_policy" { account_id = var.cloudflare_account_id name = "All-DNS-DomainTopLevel-Blocklist" description = "Block DNS queries of known risky TLDs" precedence = 60 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")" } ``` ## All-DNS-DomainPhishing-Blocklist Block misused domains to protect your users against sophisticated phishing attacks, such as domains that specifically target your organization. For example, the following policy blocks specific keywords associated with an organization or its authentication services (such as `okta`, `2fa`, `cloudflare` and `sso`) while still allowing access to known domains. * [ Dashboard ](#tab-panel-10028) * [ API ](#tab-panel-10029) * [ Terraform ](#tab-panel-10030) | Selector | Operator | Value | Logic | Action | | -------- | ------------- | ---------------------------------------------- | ----- | ------ | | Domain | not in list | _Known Domains_ | And | Block | | Domain | matches regex | .\*okta.\*\|.\*cloudflare.\*|.\*mfa.\*|.sso.\* | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-DomainPhishing-Blocklist", "description": "Block misused domains used in phishing campaigns", "precedence": 70, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.domains[] matches \".okta.|.cloudflare.|.mfa.|.sso.\") and not(any(dns.domains[*] in $))" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_phishing_domains_block" { account_id = var.cloudflare_account_id name = "All-DNS-DomainPhishing-Blocklist" description = "Block misused domains used in phishing campaigns" precedence = 70 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.known_phishing_domains_list.id}))" } ``` ## All-DNS-ResolvedIP-Blocklist Block specific IP addresses that are malicious or pose a threat to your organization. You can implement this policy by either creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs). Ideally, your CERTs can update the blocklist with an [API automation](https://edgetunnel-b2h.pages.dev/security-center/intel-apis/) to provide real-time threat protection. * [ Dashboard ](#tab-panel-10031) * [ API ](#tab-panel-10032) * [ Terraform ](#tab-panel-10033) | Selector | Operator | Value | Action | | ----------- | -------- | -------------- | ------ | | Resolved IP | in list | _IP Blocklist_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-ResolvedIP-Blocklist", "description": "Block specific IP addresses deemed to be a risk to the Organization", "precedence": 80, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.resolved_ips[*] in $)" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" { account_id = var.cloudflare_account_id name = "All-DNS-ResolvedIP-Blocklist" description = "Block specific IP addresses deemed to be a risk to the Organization" precedence = 80 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.resolved_ips[*] in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id}" } ``` ## All-DNS-DomainHost-Blocklist Block specific domains or hosts that are malicious or pose a threat to your organization. Like **All-DNS-ResolvedIP-Blocklist**, this blocklist can be updated manually or via API automation. * [ Dashboard ](#tab-panel-10034) * [ API ](#tab-panel-10035) * [ Terraform ](#tab-panel-10036) | Selector | Operator | Value | Logic | Action | | -------- | ------------- | ------------------ | ----- | ------ | | Domain | in list | _Domain Blocklist_ | Or | Block | | Host | in list | _Host Blocklist_ | Or | | | Host | matches regex | .\*example\\.com | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-DNS-DomainHost-Blocklist", "description": "Block specific domains or hosts that are malicious or pose a threat to your organization.", "precedence": 90, "enabled": true, "action": "block", "filters": [ "dns" ], "traffic": "any(dns.domains[*] in $) and dns.fqdn in $ and dns.fqdn matches \".*example.com\"" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "block_dns_domain_host" { account_id = var.cloudflare_account_id name = "All-DNS-DomainHost-Blocklist" description = "Block specific domains or hosts that are malicious or pose a threat to your organization." precedence = 90 enabled = true action = "block" filters = ["dns"] traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_blocklist.id}) and dns.fqdn in ${"$"}${cloudflare_zero_trust_list.host_blocklist.id} and dns.fqdn matches \".*example\\.com\"" } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies/#page","headline":"Recommended DNS policies · Cloudflare Learning Paths","description":"Deploy recommended DNS filtering policies.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/","name":"Build DNS security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies/","name":"Recommended DNS policies"}}]} ``` --- --- title: Test a policy description: Test Gateway DNS policy enforcement. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Test a policy It is common for a misconfigured Gateway policy to accidentally block traffic to benign sites. To ensure a smooth deployment, we recommend testing a simple policy before deploying DNS filtering to your organization. ## Test a policy in the browser 1. Go to **Traffic policies** \> **Firewall policies**. 2. Turn off all existing DNS policies. 3. Turn on any existing security policies or create a policy to block all security categories: | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All security risks_ | Block | 4. Ensure that your browser is not configured to use an alternate DNS resolver. For example, Chrome has a **Use secure DNS** setting that will cause the browser to send requests to 1.1.1.1 and bypass your DNS policies. 5. In the browser, go to `malware.testcategory.com`. Your browser will display: * The Gateway block page, if your device is connected through the Cloudflare One Client in Traffic and DNS mode. * A generic error page, if your device is connected through another method, such as DNS only mode. Note [Custom block pages](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/) require you to install a root certificate on the device. 1. In **Logs** \> **Gateway** \> **DNS**, verify that you see the blocked domain. 2. Slowly turn on or add other policies to your configuration. 3. When testing against frequently-visited sites, you may need to [clear the DNS cache](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/test-dns-filtering/#clear-dns-cache) in your browser or OS. Otherwise, the DNS lookup will return the locally-cached IP address and bypass your DNS policies. You have now validated DNS filtering on a test device. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/test-policy/#page","headline":"Test a policy · Cloudflare Learning Paths","description":"Test Gateway DNS policy enforcement.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-dns-policies/test-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/","name":"Build DNS security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-dns-policies/test-policy/","name":"Test a policy"}}]} ``` --- --- title: Control traffic egress with source IP anchoring and allowlisting description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Control traffic egress with source IP anchoring and allowlisting Now that you have created firewall policies to secure your organization, you can begin creating egress policies to control what IP address your users egress to the Internet with. Note The following module requires [egress policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/), a feature only available on Enterprise plans. If you are not an Enterprise user, you can skip ahead to [Secure SaaS applications](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/). For more information on egress policies, contact your account team. ## Objectives By the end of this module, you will be able to: * Understand when your organization may need source IP anchoring. * Create egress policies to make use of dedicated egress IPs. * Follow best practices for deploying egress IPs. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/#page","headline":"Control traffic egress with source IP anchoring and allowlisting · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/","name":"Control traffic egress with source IP anchoring and allowlisting"}}]} ``` --- --- title: Egress IP best practices description: Deploy dedicated egress IPs effectively. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Egress IP best practices When you turn on dedicated egress IPs for your account, Cloudflare will automatically balance all of your user traffic between your IPs depending on a few factors, including your user's physical location and the location of the resource that they are currently requesting. For example, if you have egress IP locations in Amsterdam, London, and Washington, D.C. and have not configured any policies, Cloudflare will assign the following egress IPs to your users: * Amsterdam egress IP to users near the Netherlands * London egress IP to users near England * Washington, D.C. egress IP to users in North America Because of Cloudflare's network design, your users will still take the fastest possible route on the Cloudflare network to reach their destination. The addition of an egress IP will add minimal latency in most scenarios. ## Geographic distribution Cloudflare recommends reserving distributed IPs in areas that most accurately match your users' physical locations. For example, if all of your users are in North America, you should consider a series of IPs in various North American data centers to ensure redundancy and performance for all of your users. You should also reserve multiple egress IPs if you have locations that need explicit egress. For example, if you have users who need to egress out of London and cannot fall back to Dublin, you will need to deploy multiple IPs in various London locations to ensure redundancy. Separately, you would need to build a policy relevant to all users with this requirement to ensure all of their traffic egresses with one of your London egress IPs. ## Access allowlisted sources One of the most common use cases for egress policies is to ensure a consistent egress IP for users accessing SaaS applications that may not support SAML (or vendor services that can only use IP-level controls). If given the option -- or if your business controls the application -- Cloudflare strongly recommends using [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) to move from IP-level authentication to identity-aware authentication that uses continuous evaluation. We recommend building baseline egress policies that can cover a majority of your use cases without making policy management overly complex. If all of your users need to access a series of applications that all require a specific egress IP, you should build a policy explicit to those users (or to all of your users) to ensure that all of their traffic egresses using those egress IPs. For example, you can define specific egress IPs for users with access to financial data: * [ Dashboard ](#tab-panel-10046) * [ API ](#tab-panel-10047) | Selector | Operator | Value | Egress method | | ---------------- | -------- | --------------- | ----------------------------------- | | User Group Email | in | _Finance Users_ | Use dedicated Cloudflare egress IPs | | Primary IPv4 address | IPv6 address | | -------------------- | ------------- | | 203.0.113.0 | 2001:db8::/32 | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "egress", "description": "Define static egress for finance team", "enabled": true, "filters": [ "egress" ], "name": "Finance team static egress", "precedence": 0, "identity": "any(identity.groups.name[*] in {\"finance\"})", "rule_settings": { "egress": { "ipv4": "", "ipv4_fallback": "", "ipv6": "" } } }' ``` ## User-selectable egress locations You may have use cases in which specific groups of your users may need to change the location from which they egress. Cloudflare observes this frequently with quality assurance (QA) teams for applications or sites that need to test resources as if they are accessing from different, predetermined locales. You can manage this when necessary via an egress policy, but most Cloudflare users prefer to manage this without ongoing changes to the administrative panel and existing policies. To accommodate this, you can build virtual networks for use as selectors in egress policies. This will allow your users to change their attached virtual network and subsequently change their egress IP as they choose. ![Users can choose virtual networks to change their egress IP within the Cloudflare One Client](https://edgetunnel-b2h.pages.dev/_astro/change-user-egress-warp.DDcZMPDC_Z4CY3c.webp) For more information, refer to our [tutorial for user selectable egress IPs](https://edgetunnel-b2h.pages.dev/cloudflare-one/tutorials/user-selectable-egress-ips/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/deploy-egress-ips/#page","headline":"Egress IP best practices · Cloudflare Learning Paths","description":"Deploy dedicated egress IPs effectively.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/deploy-egress-ips/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/","name":"Control traffic egress with source IP anchoring and allowlisting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/deploy-egress-ips/","name":"Egress IP best practices"}}]} ``` --- --- title: Use egress policies to deliver consistent egress IPs description: Create egress policies for IP consistency. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use egress policies to deliver consistent egress IPs Note Only available on Enterprise plans. Egress policies allow you to determine whether your organization's traffic egresses via the default Cloudflare IP or via a [dedicated egress IP](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/dedicated-egress-ips/) assigned to your account. To create a new egress policy: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Egress policies**. 2. Select **Add a policy**. 3. Name the policy. 4. Build a logical expression that defines the traffic you want to control egress for. For example, you can add a policy to configure all traffic destined for a third-party network to use a static source IP: | Policy name | Selector | Operator | Value | Egress method | | --------------------------- | -------------- | -------- | -------------- | ------------------------------- | | Access third-party provider | Destination IP | is | 198.51.100.158 | Dedicated Cloudflare egress IPs | | Primary IPv4 address | IPv6 address | | -------------------- | ------------- | | 203.0.113.88 | 2001:db8::/32 | 5. Select **Create policy**. For more information, refer to [Egress policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/egress-policies/#page","headline":"Use egress policies to deliver consistent egress IPs · Cloudflare Learning Paths","description":"Create egress policies for IP consistency.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/egress-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/","name":"Control traffic egress with source IP anchoring and allowlisting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/egress-policies/","name":"Use egress policies to deliver consistent egress IPs"}}]} ``` --- --- title: Source IP anchoring description: Anchor traffic to consistent source IPs. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Source IP anchoring Source IP anchoring has become increasingly common recently as businesses begin to shift more traffic out of their office perimeter but still rely on their corporate IPs as a primary source of truth for trusted egress. Cloudflare understands the relevance of this model. Because subsequent backhauling and often single-threaded points of failure are inherent to static IP egress, Cloudflare offers several similar concepts that can help organizations transition from static IP egress to source IP anchoring. You can maintain your existing services, such as SaaS apps, while applying more granular and accurate control over access and data security. The next section discusses best practices for migrating from managing backhauled user traffic in the context of IP allowlisting to delivering consistent security practices and IP consistency without sacrificing performance. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/source-ip-anchoring/#page","headline":"Source IP anchoring · Cloudflare Learning Paths","description":"Anchor traffic to consistent source IPs.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-egress-policies/source-ip-anchoring/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/","name":"Control traffic egress with source IP anchoring and allowlisting"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-egress-policies/source-ip-anchoring/","name":"Source IP anchoring"}}]} ``` --- --- title: Build HTTP security policies description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build HTTP security policies After securing your organization's DNS queries and network level traffic, you can begin implementing advanced security controls for web traffic by inspecting HTTPS and taking actions based on the full URL or the body of HTTP requests. ## Objectives By the end of this module, you will be able to: * Understand how and when to use TLS inspection to decrypt HTTPS traffic. * Configure and enable Data Loss Prevention to protect your organization's sensitive data. * Protect user endpoints with Browser Isolation. * Add recommended HTTP security policies. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/#page","headline":"Build HTTP security policies · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/","name":"Build HTTP security policies"}}]} ``` --- --- title: Configure Browser Isolation description: Set up Remote Browser Isolation. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure Browser Isolation Cloudflare Browser Isolation seamlessly executes active webpage content in a secure isolated browser to protect users from zero-day attacks, malware, and phishing. Browser Isolation provides unique and transparent protection for your users using methods that surpass the capabilities of a traditional secure web gateway. This section focuses primarily on Browser Isolation for external services, assuming that most traffic from a device or a network is being forwarded to Cloudflare. For other applications of Browser Isolation, refer to the [Deploy clientless access](https://edgetunnel-b2h.pages.dev/learning-paths/clientless-access/concepts/) guide. As a note, Cloudflare's Browser Isolation technology was built to be used for 100% of your user's daily browsing. These recommendations do not suggest that you should limit or be cautious with your use of Browser Isolation, but instead help identify practical outcomes that balance technology with actualized security benefits. ## Get the most out of Browser Isolation If your organization is interested in implementing Browser Isolation, there are a few methods that Cloudflare recommends exploring. ### Block copy, paste, and upload/download for shadow IT As you have begun deploying Cloudflare Zero Trust, you may have started to visualize user traffic patterns using [Shadow IT Discovery](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/shadow-it-discovery/). This feature gives you visibility into detected SaaS applications that your users use. Administrators can categorize applications and services on the basis of proper organizational use. If you do not use Shadow IT Discovery and instead maintain a similar list manually or with other tools, you can port that data into a [Zero Trust list](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/create-list/), update it via the API, and achieve the same outcomes. You can control potential risk and shape user behavior without applying heavy-handed block policies by applying policies to isolate user traffic to applications that match your defined categories. You can then set additional parameters in the policy, such as the ability to restrict copy/paste and upload/download. Users can still access information in the tools -- if not use the tools to a lesser extent -- while you minimize the risk of data loss. * [ Dashboard ](#tab-panel-10050) * [ API ](#tab-panel-10051) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **HTTP** tab, select **Add a policy**. 3. Name the policy. 4. In **Traffic**, add the following expression: | Selector | Operator | Value | Action | | -------- | -------- | ----------- | ------- | | Host | in list | _Shadow IT_ | Isolate | 5. In **Configure policy settings**, turn on the following options: * _Disable copy / paste_ * _Disable file downloads_ * _Disable file uploads_ 6. Select **Create policy**. **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "isolate", "description": "Block copy, paste, and upload/download for shadow IT", "enabled": true, "filters": [ "http" ], "name": "Block shadow IT interaction", "precedence": 0, "traffic": "http.request.host in ", "rule_settings": { "block_page_enabled": false, "block_reason": "", "override_ips": null, "override_host": "", "l4override": null, "biso_admin_controls": { "dp": false, "dcp": true, "dd": true, "du": true, "dk": false, "dcr": false } } }' ``` ### Isolate all "gray-listed" traffic A common method for using Browser Isolation to protect against unknown or zero-day threats can dramatically enhance your security posture: Separate all HTTP traffic into known acceptable, known malicious, and unknown buckets. Once your sort your traffic, isolate everything in the unknown bucket. You can accomplish this by creating the following policies: * Explicit allow policies for all of your known applications and trusted websites using either Cloudflare application definitions or a list * Explicit block policies for all security risks, known malicious traffic, and against-acceptable-use intentional denies * A policy to isolate all other traffic in this middle In this context, if some traffic is unknown to your organization, Cloudflare will isolate it by default. Cloudflare will also prevent any malicious code from being executed client side, with additional controls available. * [ Dashboard ](#tab-panel-10048) * [ API ](#tab-panel-10049) * Allow known applications and websites: | Selector | Operator | Value | Action | | -------- | -------- | --------------- | ------ | | Domain | in list | _Known Domains_ | Allow | * Block security risks: | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All Security Risks_ | Block | * Isolate all other traffic: | Selector | Operator | Value | Action | | -------- | ------------- | ----- | ------- | | Host | matches regex | .\* | Isolate | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "isolate", "description": "Allow known applications and websites", "enabled": true, "filters": [ "http" ], "name": "Allow known apps and sites", "precedence": 0, "traffic": "http.request.domains in ", "rule_settings": { "block_page_enabled": false, "block_reason": "", "override_ips": null, "override_host": "", "l4override": null } }' ``` **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "isolate", "description": "Block all security risks", "enabled": true, "filters": [ "http" ], "name": "Block security risks", "precedence": 0, "traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})", "rule_settings": { "block_page_enabled": false, "block_reason": "", "override_ips": null, "override_host": "", "l4override": null } }' ``` **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "isolate", "description": "Isolate all other traffic", "enabled": true, "filters": [ "http" ], "name": "Isolate traffic", "precedence": 0, "traffic": "http.request.host matches \".*\"", "rule_settings": { "block_page_enabled": false, "block_reason": "", "override_ips": null, "override_host": "", "l4override": null } }' ``` ### Vendor-chain using link-based isolation Many vendors that may exist within your security framework support URL manipulation. You can use URL manipulation as an on-ramp for Browser Isolation to add additional security controls. For example, vendors like Zscaler and Proofpoint allow you to prepend links to URLs in a static or dynamic format. You can prepend the clientless isolation link generated for your Cloudflare account to derive additional security benefits for potentially risky clicks. This means that if you have traffic not sent through Cloudflare today (such as through another proxy), you can potentially prepend specific filtered requests with a link to automatically send the traffic to a Cloudflare isolated browser session without an endpoint agent installed. flowchart TB %% Accessibility accTitle: Browser Isolation architecture accDescr: Flowchart describing the order of operations for user traffic for in-line Browser Isolation. %% User traffic user(["User goes to
risky.example.com"])--"Connects to"-->cloud[Third-party SWG cloud] %% Third-party SWG cloud-->warning[Third-party interstitial block or warning page] warning--"Appends Cloudflare subdomain"-->biso %% Browser Isolation subgraph cf [Cloudflare global network] biso[[Cloudflare Clientless Web Isolation]] inline(["Isolated browser"]) biso--"User's browser goes to
customer.cloudflareaccess.com/browser/risky.example.com"-->inline end ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/browser-isolation/#page","headline":"Configure Browser Isolation · Cloudflare Learning Paths","description":"Set up Remote Browser Isolation.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/browser-isolation/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/","name":"Build HTTP security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/browser-isolation/","name":"Configure Browser Isolation"}}]} ``` --- --- title: Create your first HTTP policy description: Build your first Gateway HTTP policy. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create your first HTTP policy Now that you have considered which devices and applications TLS inspection should and should not apply to, it is time to create your first HTTP policy. ## Create your first policy Use a standard naming convention when building all policies. Policy names should be unique across the Cloudflare account, follow the same structure, and be as descriptive as possible. To create a new HTTP policy: * [ Dashboard ](#tab-panel-10052) * [ API ](#tab-panel-10053) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **HTTP** tab, select **Add a policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block. 5. Choose an **Action** to take when traffic matches the logical expression. For example, if you have configured TLS decryption, some applications that use [embedded certificates](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/#inspection-limitations) may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications: | Selector | Operator | Value | Action | | ----------- | -------- | ---------------- | -------------- | | Application | in | _Do Not Inspect_ | Do Not Inspect | Cloudflare also recommends adding a policy to block [known threats](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-categories) such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence: | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All security risks_ | Block | 6. Select **Create policy**. 1. [Create an API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) with the following permissions: | Type | Item | Permission | | ------- | ---------- | ---------- | | Account | Zero Trust | Edit | 2. (Optional) Configure your API environment variables to include your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and API token. 3. Send a `POST` request to the [Create a Zero Trust Gateway rule](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/rules/methods/create/) endpoint. For example, if you have configured TLS decryption, some applications that use [embedded certificates](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/#inspection-limitations) may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications: **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Do not inspect applications", "description": "Bypass TLS decryption for unsupported applications", "precedence": 0, "enabled": true, "action": "off", "filters": [ "http" ], "traffic": "any(app.type.ids[*] in {16})", "identity": "", "device_posture": "" }' ``` ```sh { "success": true, "errors": [], "messages": [] } ``` The API will respond with a summary of the policy and the result of your request. Cloudflare also recommends adding a policy to block [known threats](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-categories) such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence: **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Block known risks", "description": "Block all default Cloudflare HTTP security categories", "precedence": 0, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})", "identity": "", "device_posture": "" }' ``` For more information, refer to [HTTP policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/). ## Order your policies In most scenarios, Gateway evaluates HTTP policies in [top-down order](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/) (like DNS policies). Because Do Not Inspect action policies are terminal actions, we recommend grouping them in logical order above all of your other policies because they will always functionally fire first regardless of where they are placed. Once the Do Not Inspect policies are ordered correctly, Allow policies should follow, and the Allow policy descriptions should include any special considerations for Allow actions (such as header IDs, certificate mismatch handling, and non-isolate traffic). Next, list your isolate and block policies. There may be scenarios in which you want to intermingle your block policies within your other policy outcomes. That is an acceptable approach, but you will need to ensure that you do not have overly permissive allows or overly restrictive block policies that will cause unintended effects. ## Test your policies Before instituting blocks or other actions that would impact your users, first measure impact by setting the policy as an Allow action. Monitor your users' actions and look in your logs, sorting by that explicit policy, to see what traffic actions matched against it. If the activity is exactly what you would expect for the policy, you are probably safe to implement it as its intended action. If your policy matches unexpected traffic flows or destinations (such as unintended users or device groups), review your policy to ensure it is not overly permissive or restrictive. If the policy design looks correct, determine whether other policies are matching before the intended policy. You can review the [order of enforcement](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/) for Gateway policies to ensure all of your policies are working together as intended. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/create-policy/#page","headline":"Create your first HTTP policy · Cloudflare Learning Paths","description":"Build your first Gateway HTTP policy.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/create-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/","name":"Build HTTP security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/create-policy/","name":"Create your first HTTP policy"}}]} ``` --- --- title: Build Data Loss Prevention (DLP) policies description: Configure DLP profiles and policies. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build Data Loss Prevention (DLP) policies In order to use Data Loss Prevention (DLP) tools within Cloudflare Zero Trust, you first need to define your DLP profiles. [DLP profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/) are complex objects with dictionaries, pre-built detections, and custom logic that you can reference as selectors within your Gateway policies. ## Configure a DLP profile You may either use DLP profiles predefined by Cloudflare, or create your own custom profiles based on regular expressions (regex), predefined detection entries, and DLP datasets. ### Configure a predefined profile 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Data loss prevention** \> **Profiles**. 2. Choose a [predefined profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/) and select **Edit**. 3. Enable one or more **Detection entries** according to your preferences. 4. Select **Save profile**. Most predefined profiles match when any enabled detection entry matches. The **Personally Identifiable Information (PII) Record** profile is an exception and requires at least three unique detection entries in close proximity before the profile matches. ### Build a custom profile 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Data loss prevention** \> **Profiles**. 2. Select **Create profile**. 3. Enter a name and optional description for the profile. 4. Add detection entries to the profile. Create a custom entry 1. Select **Create custom entry**. 2. Choose the type of detection entry you want to create and configure its values. For information on supported detection entry types, refer to [Configure detection entries](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/). 3. To save the detection entry, select **Done**. Add existing entries Existing entries include [predefined](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/predefined-detection-entries/) and [user-defined](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/) detection entries that you manage from the Detection entries section. 1. Select **Add existing entries**. 2. Choose which entries you want to add, then select **Confirm**. 3. To finish, select **Done**. 5. (Optional) Add data classes to include reusable classification rules. * Select **Add data classes** * Choose the data classes you want to add, then select **Confirm** 6. (Optional) Use labels as match criteria for the profile. * Select a sensitivity schema and minimum sensitivity level. * Select a data tag group and one or more data tags. For more information on labels, templates, and data classes, refer to [Data Classification](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/data-classification/). 7. (Optional) Configure [**profile settings**](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/) for the profile. 8. Select **Save profile**. ## Build effective DLP profiles For many Cloudflare users, Zero Trust is often one of the only measures for preventing the loss of sensitive data. For other users, Zero Trust may be the one of the early in-line measures of a complex Internet and SaaS app security strategy. No matter which model you most resemble, developing effective and appropriate DLP policies and practices starts with first-principles definitions. ### Define your sensitive data #### Existing data patterns If your organization is most concerned about general data patterns that fit existing classifications such as personal identifiable information (PII), protected health information (PHI), financial information, or source code, we recommend using the [default predefined profiles](#configure-a-predefined-profile). To help this better match the needs of your organization, you can also build a complex profile that matches data to both an existing library and a custom string detection or database. For example: * [ Dashboard ](#tab-panel-10054) * [ API ](#tab-panel-10055) | Selector | Operator | Value | Logic | Action | | ----------- | -------- | ------------------------- | ----- | ------ | | DLP Profile | in | _Credentials and Secrets_ | Or | Block | | DLP Profile | in | _AWS Key Dataset_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "block", "description": "Detect secrets and AWS keys", "enabled": true, "filters": [ "http" ], "name": "Secrets and AWS keys", "precedence": 0, "traffic": "any(dlp.profiles[*] in ) or any(dlp.profiles[*] in )" }' ``` #### Assorted data patterns If your data patterns take many different forms and contexts, consider building a custom profile using one or multiple regexes. Rust regular expressions Cloudflare implements regular expressions with Rust. Make sure you account for this difference when writing expressions or using regular expression builders and generative AI. To validate your regex, use [Rustexp ↗](https://rustexp.lpil.uk/). For example, you can use a custom expression to detect when your users share product SKUs in the format `CF1234-56789`: * [ Dashboard ](#tab-panel-10056) * [ API ](#tab-panel-10057) 1. [Build a custom profile](#build-a-custom-profile) with the following custom entry: | Detection entry name | Value | | -------------------- | ------------------------- | | Product SKUs | CF\[0-9\]{1,4}-\[0-9\]{5} | 2. Create an HTTP policy with the following expressions: | Selector | Operator | Value | Logic | Action | | ----------- | ------------- | ---------------------------- | ----- | ------ | | DLP Profile | in | _Product SKUs_ | And | Block | | User Email | matches regex | \[a-z0-9\]{0,15}@example.com | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "block", "description": "Detect product SKUs shared by users in organization", "enabled": true, "filters": [ "http" ], "name": "Detect product SKU leaks", "precedence": 0, "traffic": "any(dlp.profiles[*] in )", "identity": "identity.email matches \"[a-z0-9]{0,15}@example.com\"" }' ``` #### DLP datasets If your data is a distinct [dataset](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#exact-data-match-datasets) you have defined, you can build a profile by uploading a database to use in an Exact Data Match or Custom Wordlist function. Exact Data Match and Custom Wordlist feature some key differences: | | Exact Data Match | Custom Wordlist | | ------------------- | ------------------------------------------------------- | ------------------------------------------------------------------ | | **Encryption** | Hashed and compared to encrypted traffic | Stored as plaintext | | **Payload logging** | Matches redacted in logs | Matches appear in logs | | **Usage** | PII (such as names, addresses, and credit card numbers) | Non-sensitive data (such as intellectual property and SKU numbers) | We recommend using Exact Data Match for highly sensitive datasets and Custom Wordlists for lists of keywords. As your datasets change and grow, we recommend building a pipeline to update the data source in Cloudflare Zero Trust. For more information, contact your account team. #### Microsoft Information Protection (MIP) labels If your data already contains Microsoft Information Protection (MIP) labeling schema, Cloudflare can detect those values in-transit automatically. To get started, connect your Microsoft 365 account with a [CASB integration](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/microsoft-365/). Cloudflare will automatically pull in your existing MIP definitions into Zero Trust. You can then use the MIP definitions to build DLP profiles for use in Gateway policies. For more information, refer to [Integration profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/integration-profiles/). ## Build DLP policies The best way to start applying data loss prevention to your traffic, minimize the chance of false positives, and collect actionable data is to start with the known knowns in your sensitive data policies. Rather than building policies to detect sensitive data like SSNs or financial information across all of your traffic, you should start by building policies that target both sensitive data types and destinations that are known data sources or points of high risk. These sources can be inside or outside your organization. ### Example Many organizations want to detect and log financial information egressing from user devices to critical SaaS applications. To limit the risk of false positives and to filter out logging noise, Cloudflare recommends building your first series of policies to specify both target data and target destination. For example, you can block financial information from being sent to AI chatbots, such as ChatGPT and Gemini: * [ Dashboard ](#tab-panel-10058) * [ API ](#tab-panel-10059) | Selector | Operator | Value | Logic | Action | | ------------------ | -------- | ------------------------- | ----- | ------ | | DLP Profile | in | _Financial Information_ | And | Block | | Content Categories | in | _Artificial Intelligence_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "block", "description": "Prevent financial information from being shared with AI tools", "enabled": true, "filters": [ "http" ], "name": "Block AI financial info", "precedence": 0, "traffic": "any(dlp.profiles[*] in ) and any(http.request.uri.content_category[*] in {184})" }' ``` Once you have analyzed the flow and magnitude of data from the known sources, you can begin focusing on more specialized or explicit datasets for more generalized sources. You may want to allow sources that are known internal locations where sensitive data is intentionally transferred. After developing a level of confidence from reviewing the logs and evaluating a rate of false positives for both types of policies, you can feel more confident in experimenting more broadly with data loss prevention policies. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/data-loss-prevention/#page","headline":"Build Data Loss Prevention (DLP) policies · Cloudflare Learning Paths","description":"Configure DLP profiles and policies.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/data-loss-prevention/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/","name":"Build HTTP security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/data-loss-prevention/","name":"Build Data Loss Prevention (DLP) policies"}}]} ``` --- --- title: Recommended HTTP policies description: Deploy recommended HTTP security policies. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Recommended HTTP policies We recommend you add the following HTTP policies to build an Internet and SaaS app security strategy for your organization. For additional commonly used HTTP policy examples, refer to [Common HTTP policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/common-policies/). For more information on building HTTP policies, refer to [HTTP policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/). ## All-HTTP-Application-InspectBypass Bypass HTTP inspection for applications that use embedded certificates. This will help avoid any certificate pinning errors that may arise from an initial rollout. * [ Dashboard ](#tab-panel-10060) * [ API ](#tab-panel-10061) * [ Terraform ](#tab-panel-10062) | Selector | Operator | Value | Action | | ----------- | -------- | ---------------- | -------------- | | Application | in | _Do Not Inspect_ | Do Not Inspect | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-Application-InspectBypass", "description": "Bypass HTTP inspection for applications that use embedded certificates", "precedence": 0, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "any(app.type.ids[*] in {16})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_http_application_inspect_bypass" { account_id = var.cloudflare_account_id name = "All-HTTP-Application-InspectBypass" description = "Bypass HTTP inspection for applications that use embedded certificates" precedence = 0 enabled = true action = "block" filters = ["http"] traffic = "any(app.type.ids[*] in {16})" } ``` ## Android-HTTP-Application-InspectionBypass Bypass HTTPS inspection for Android applications (such as Google Drive) that use certificate pinning, which is incompatible with Gateway inspection. * [ Dashboard ](#tab-panel-10063) * [ API ](#tab-panel-10064) * [ Terraform ](#tab-panel-10065) | Selector | Operator | Value | Logic | Action | | ---------------------------- | -------- | --------------------------------- | ----- | -------------- | | Application | in | _Google Drive_ | And | Do Not Inspect | | Passed Device Posture Checks | in | _OS Version Android (OS version)_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Android-HTTP-Application-InspectionBypass", "description": "Bypass HTTPS inspection for Android applications with certificate pinning", "precedence": 10, "enabled": true, "action": "off", "filters": [ "http" ], "traffic": "any(app.ids[] in {554})", "device_posture": "any(device_posture.checks.passed[] in {\"\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "android_http_application_inspection_bypass" { account_id = var.cloudflare_account_id name = "Android-HTTP-Application-InspectionBypass" description = "Bypass HTTPS inspection for Android applications with certificate pinning" precedence = 10 enabled = true action = "off" filters = ["http"] traffic = "any(app.ids[*] in {554})" device_posture = "any(device_posture.checks.passed[*] in {\"${"$"}{cloudflare_zero_trust_list.android_version_posture_check.id}\"})" } ``` ## All-HTTP-Domain-Inspection-Bypass Bypass HTTP inspection for a custom list of domains identified as incompatible with TLS inspection. * [ Dashboard ](#tab-panel-10066) * [ API ](#tab-panel-10067) * [ Terraform ](#tab-panel-10068) | Selector | Operator | Value | Logic | Action | | -------- | -------- | ------------------------ | ----- | -------------- | | Domain | in list | _DomainInspectionBypass_ | Or | Do Not Inspect | | Domain | in list | _Known Domains_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-Domain-Inspection-Bypass", "description": "Bypass HTTP inspection for a custom list of domains identified as incompatible with TLS inspection", "precedence": 20, "enabled": true, "action": "off", "filters": [ "http" ], "traffic": "any(http.request.domains[*] in $) or any(http.request.domains[*] in $)" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "android_http_application_inspection_bypass" { account_id = var.cloudflare_account_id name = "All-HTTP-Domain-Inspection-Bypass" description = "Bypass HTTP inspection for a custom list of domains identified as incompatible with TLS inspection" precedence = 20 enabled = true action = "off" filters = ["http"] traffic = "any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_inspection_bypass_list.id}) or any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.known_domains_list.id})" } ``` ## All-HTTP-SecurityRisks-Blocklist Block [security categories](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-categories), such as **Command and Control & Botnet** and **Malware**, based on Cloudflare's threat intelligence. * [ Dashboard ](#tab-panel-10069) * [ API ](#tab-panel-10070) * [ Terraform ](#tab-panel-10071) | Selector | Operator | Value | Action | | ------------------- | -------- | -------------------- | ------ | | Security Categories | in | _All security risks_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-SecurityRisks-Blocklist", "description": "Block security categories based on Cloudflare'\''s threat intelligence", "precedence": 30, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_http_security_risks_blocklist" { account_id = var.cloudflare_account_id name = "All-HTTP-SecurityRisks-Blocklist" description = "Block security categories based on Cloudflare's threat intelligence" precedence = 30 enabled = true action = "block" filters = ["http"] traffic = "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})" } ``` ## All-HTTP-ContentCategories-Blocklist Entries in the [security risk content subcategory](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/domain-categories/#security-risk-subcategories), such as **New Domains**, do not always pose a security threat. We recommend you first create an Allow policy to track policy matching and identify any false positives. You can add false positives to your **Trusted Domains** list used in **All-HTTP-Domain-Allowlist**. After your test is complete, we recommend you change the action to Block to minimize risk to your organization. * [ Dashboard ](#tab-panel-10084) * [ API ](#tab-panel-10085) * [ Terraform ](#tab-panel-10086) | Selector | Operator | Value | Action | | ------------------ | -------- | ------------------------------------------------------------------------------------- | ------ | | Content Categories | in | _Questionable Content_, _Security Risks_, _Miscellaneous_, _Adult Themes_, _Gambling_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-ContentCategories-Blocklist", "description": "Block access to questionable content and potential security risks", "precedence": 40, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})", "identity": "", "device_posture": "" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "block_unauthorized_apps" { account_id = var.cloudflare_account_id name = "All-HTTP-ContentCategories-Blocklist" description = "Block access to questionable content and potential security risks" precedence = 40 enabled = true action = "block" filters = ["http"] traffic = "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})" identity = "" device_posture = "" } ``` ## All-HTTP-DomainHost-Blocklist Block specific domains or hosts that are malicious or pose a threat to your organization. Like **All-HTTP-ResolvedIP-Blocklist**, this blocklist can be updated manually or via API automation. * [ Dashboard ](#tab-panel-10072) * [ API ](#tab-panel-10073) * [ Terraform ](#tab-panel-10074) | Selector | Operator | Value | Logic | Action | | -------- | ------------- | ------------------ | ----- | ------ | | Domain | in list | _Domain Blocklist_ | Or | Block | | Host | in list | _Host Blocklist_ | Or | | | Host | matches regex | .\*example\\.com | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-DomainHost-Blocklist", "description": "Block specific domains or hosts that are malicious or pose a threat to your organization", "precedence": 50, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "any(http.request.domains[*] in $) or http.request.host in $ or http.request.host matches \".*example.com\"" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_http_domainhost_blocklist" { account_id = var.cloudflare_account_id name = "All-HTTP-DomainHost-Blocklist" description = "Block specific domains or hosts that are malicious or pose a threat to your organization" precedence = 50 enabled = true action = "block" filters = ["http"] traffic = "any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_blocklist.id}) or http.request.host in ${"$"}{cloudflare_zero_trust_list.host_blocklist.id} or http.request.host matches \".*example\\.com\"" } ``` ## All-HTTP-Application-Blocklist Block unauthorized applications to limit your users' access to certain web-based tools and minimize the risk of [shadow IT](https://www.cloudflare.com/learning/access-management/what-is-shadow-it/). For example, the following policy blocks known AI tools: * [ Dashboard ](#tab-panel-10087) * [ API ](#tab-panel-10088) * [ Terraform ](#tab-panel-10089) | Selector | Operator | Value | Action | | ----------- | -------- | ------------------------- | ------ | | Application | in | _Artificial Intelligence_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-Application-Blocklist", "description": "Limit access to shadow IT by blocking web-based tools and applications", "precedence": 60, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "any(app.type.ids[*] in {25})", "identity": "", "device_posture": "" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_http_application_blocklist" { account_id = var.cloudflare_account_id name = "All-HTTP-Application-Blocklist" description = "Limit access to shadow IT by blocking web-based tools and applications" precedence = 60 enabled = true action = "block" filters = ["http"] traffic = "any(app.type.ids[*] in {25})" identity = "" device_posture = "" } ``` ## PrivilegedUsers-HTTP-Any-Isolate Isolate traffic for privileged users who regularly access critical systems or execute actions such as threat analysis and malware testing. Security teams often need to perform threat analysis or malware testing that could trigger malware detection. Likewise, privileged users could be the target of attackers trying to gain access to critical systems. * [ Dashboard ](#tab-panel-10075) * [ API ](#tab-panel-10076) * [ Terraform ](#tab-panel-10077) | Selector | Operator | Value | Action | | ---------------- | -------- | ------------------ | ------- | | User Group Names | in | _Privileged Users_ | Isolate | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "PrivilegedUsers-HTTP-Any-Isolate", "description": "Isolate traffic for privileged users who regularly access critical or testing systems", "precedence": 70, "enabled": true, "action": "isolate", "filters": [ "http" ], "identity": "any(identity.groups.name[*] in {\"Privileged Users\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "privileged_users_http_any_isolate" { account_id = var.cloudflare_account_id name = "PrivilegedUsers-HTTP-Any-Isolate" description = "Isolate traffic for privileged users who regularly access critical or testing systems" precedence = 70 enabled = true action = "isolate" filters = ["http"] identity = "any(identity.groups.name[*] in {\"Privileged Users\"})" } ``` ## Quarantined-Users-HTTP-Restricted-Access Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected. * [ Dashboard ](#tab-panel-10078) * [ API ](#tab-panel-10079) * [ Terraform ](#tab-panel-10080) | Selector | Operator | Value | Logic | Action | | ---------------- | ----------- | ------------------------------- | ----- | ------ | | Destination IP | not in list | _Quarantined-Users-IPAllowlist_ | And | Block | | User Group Names | in | _Quarantined Users_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Quarantined-Users-HTTP-Restricted-Access", "description": "Restrict access for users included in an identity provider (IdP) user group for risky users", "precedence": 80, "enabled": true, "action": "block", "filters": [ "http" ], "traffic": "not(any(http.conn.dst_ip[] in $))", "identity": "any(identity.groups.name[] in {\"Quarantined Users\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "quarantined_users_http_restricted_access" { account_id = var.cloudflare_account_id name = "Quarantined-Users-HTTP-Restricted-Access" description = "Restrict access for users included in an identity provider (IdP) user group for risky users" precedence = 80 enabled = true action = "block" filters = ["http"] traffic = "not(any(http.conn.dst_ip[*] in ${"$"}{cloudflare_zero_trust_list.quarantined_users_ip_allowlist.id}))" identity = "any(identity.groups.name[*] in {\"Quarantined Users\"})" } ``` ## All-HTTP-Domain-Isolate Isolate high risk domains or create a custom list of known risky domains to avoid data exfiltration or malware infection. Ideally, your incident response teams can update the blocklist with an [API automation](https://edgetunnel-b2h.pages.dev/security-center/intel-apis/) to provide real-time threat protection. * [ Dashboard ](#tab-panel-10081) * [ API ](#tab-panel-10082) * [ Terraform ](#tab-panel-10083) | Selector | Operator | Value | Logic | Action | | ------------------ | -------- | ----------------------------------- | ----- | ------- | | Content Categories | in | _New Domains_, _Newly Seen Domains_ | Or | Isolate | | Domain | in list | _Domain Isolation_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-HTTP-Domain-Isolate", "description": "Isolate high risk domains or create a custom list of known risky domains to avoid data exfiltration or malware infection", "precedence": 90, "enabled": true, "action": "isolate", "filters": [ "http" ], "traffic": "any(http.request.uri.content_category[*] in {169 177}) or any(http.request.domains[*] in $)" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_http_domain_isolate" { account_id = var.cloudflare_account_id name = "All-HTTP-Domain-Isolate" description = "Isolate high risk domains or create a custom list of known risky domains to avoid data exfiltration or malware infection" precedence = 90 enabled = true action = "isolate" filters = ["http"] traffic = "any(http.request.uri.content_category[*] in {169 177}) or any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_isolate_list.id})" } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies/#page","headline":"Recommended HTTP policies · Cloudflare Learning Paths","description":"Deploy recommended HTTP security policies.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/","name":"Build HTTP security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies/","name":"Recommended HTTP policies"}}]} ``` --- --- title: Use TLS inspection description: Enable and configure TLS decryption. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use TLS inspection TLS inspection (also known as TLS decryption or HTTPS inspection) allows Cloudflare Gateway to perform deeper traffic analysis and take actions like scanning request bodies for sensitive data, upgrading to a remote browser isolation session, and redirecting based on the complete URL and path of requests. TLS inspection is desirable for security policy involving users accessing sensitive systems, but it can also present challenges. Without TLS inspection turned on, policies can still use user identity, device posture, IP address, resolved domain, SNI, and a number of other attributes that support a Zero Trust security implementation. Organizations are often hesitant to adopt TLS inspection practices due to concerns about interoperability with existing systems due to past experiences with legacy systems that conceptually worked in the same way. However, Cloudflare's approach to TLS inspection is capable, performant, modern, and above all, flexible. We understand that it is never possible to inspect absolutely all traffic — something will always break. Our recommendations keep this practical reality in mind. ## Get started To decide why and how you should turn on TLS inspection, we recommend you start with the following steps: ### 1\. Identify your goals Cloudflare Zero Trust requires TLS inspection for most advanced security and [data loss prevention (DLP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) features. Some security organizations choose to avoid TLS inspection due to concerns about user privacy and acceptable use. This is an important and sometimes complicated organization decision, but you can simplify it by establishing goals related to your security practices. Questions to consider: * Is your organizational use of TLS inspection designed to protect from the "known" (such as sensitive data in corporate-sanctioned SaaS applications) or the "unknown" (such as users downloading or uploading files to brand-new blob storage buckets)? * Do you intend to primarily block by domain or hostname or by building policies for complete URLs? * Do you plan to scan the body of requests or files against DLP profiles or scan downloaded files with an antivirus or anti-malware engine? * Do you intend to use inline [Remote Browser Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/) to take advantage of data security capabilities like copy/paste blocking, keyboard blocking, and print blocking? If the answer to a majority of these questions is no and your organization relies mostly on hostname or DNS-based security controls, then you may not need to inspect most, if not all TLS traffic. Because Cloudflare operates both as a secure web gateway and as a secure DNS resolver for your connected users, you can apply policy control that may increase your security posture without the need to broadly inspect TLS traffic. ### 2\. Turn on TLS inspection To turn on TLS inspection for your Zero Trust organization: * [ Dashboard ](#tab-panel-10090) * [ Terraform (v5) ](#tab-panel-10091) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Traffic settings**. 2. In **Proxy and inspection**, turn on **Inspect HTTPS requests with TLS decryption**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Configure the `tls_decrypt` argument in [cloudflare\_zero\_trust\_gateway\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fsettings): ```tf resource "cloudflare_zero_trust_gateway_settings" "team_name" { account_id = var.cloudflare_account_id settings = { tls_decrypt = { enabled = true } } } ``` #### Inspect on all ports Beta By default, Gateway will only inspect HTTP traffic through port `80`. Additionally, if you [turn on TLS decryption](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/#turn-on-tls-decryption), Gateway will inspect HTTPS traffic through port `443`. To detect and inspect HTTP and HTTPS traffic on ports in addition to `80` and `443`, you can turn on [protocol detection](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/protocol-detection/) and configure Gateway to [inspect traffic on all ports](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/protocol-detection/#inspect-on-all-ports). ### 3\. Determine the certificate used for inspection TLS inspection requires a trusted private root certificate to be able to inspect and filter encrypted traffic. A [Cloudflare root certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) is a simple and common solution that is usually appropriate for testing or proof-of-concept conditions when deployed to your devices. You can [generate a Cloudflare certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/#generate-a-cloudflare-root-certificate) in Zero Trust. Alternatively, if you already have a root CA that you use for other inspection or trust applications, we recommend [using your own certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/). A few reasons for this include: * Assuming the root certificate is already deployed on the relevant fleet of devices, using a single certificate streamlines your IT management. * If external services like Git workflows or CLI tools rely on an existing certificate store, presenting the same certificate in inspection is far less likely to interrupt their traffic flow, although these are things that you may wish to exempt from inspection. * If you are using [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) or a [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) IPsec/GRE tunnel to on-ramp traffic to Cloudflare, devices behind those tunnels will not be able to use HTTP policies that require TLS inspection unless they have a certificate that matches your organization's certificate of choice. Your network infrastructure most likely already has your own device certificates deployed, so using your own existing public key infrastructure for inspection will simplify protection. Once you generate a Cloudflare certificate or upload a custom certificate, you will need to set it as **Available** to deploy it across the Cloudflare network and as **In-Use** to use it for inspection. For more information, refer to [Activate a root certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). ### 4\. Build a baseline Do Not Inspect policy Do you want to inspect all traffic by default, or do you only want to inspect explicit destinations? We recommend that you build a Gateway list of applications and endpoints to exclude from inspection and add the list as an OR operator in addition to our existing Do Not Inspect application group. For example: | Selector | Operator | Value | Logic | Action | | ----------- | -------- | ------------------- | ----- | -------------- | | Application | in | _Do Not Inspect_ | Or | Do Not Inspect | | Host | in list | _Trusted Hostnames_ | | | If your organization is newly adopting the security framework that requires TLS inspection, we recommend starting minimally. In fact, it may even be appropriate to choose to only explicitly inspect a predetermined list of hostnames, IPs, or specific user groups or device types and forego inspection for everything else during the initial deployment stage. Cloudflare has a unique and flexible approach to where and when you can deploy inspection, meaning it can be as limited and granular as your organization needs without impacting device routing tables or other memory-sensitive local constructs. ### 5\. Build the necessary pass-through rules You can build pass-through rules to accommodate any type of device or user group that should not be subject to inspection. For example, if users are issued a corporate-managed iPhone with limited permissions, set an additional Do Not Inspect policy for all traffic matching the device posture value. That could include the OS type, OS version, or a list of serial numbers (updated via the API with hooks from your MDM tool) for those iPhones: * [ Dashboard ](#tab-panel-10094) * [ API ](#tab-panel-10095) | Selector | Operator | Value | Logic | Action | | --------------------- | -------- | --------------------------------------- | ----- | -------------- | | Passed Device Posture | in | _iOS 17 or higher (OS version)_ | And | Do Not Inspect | | Passed Device Posture | in | _iPhone Serial Numbers (Serial number)_ | | | 1. Create a list of device serial numbers that you do not want to inspect. **Create Zero Trust list** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/lists" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "description": "The serial numbers for administrators", "items": [ { "value": "8GE8721RE" } ], "name": "Admin Serial Numbers", "type": "SERIAL" }' ``` 2. Create a Do Not Inspect policy that checks the device against the list of serial numbers. **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Do not inspect corporate devices", "traffic": "", "identity": "", "device_posture": "any(device_posture.checks.passed[*] in {\"\"})", "action": "off", "precedence": 14002, "enabled": true, "filters": [ "http" ] }' ``` If you filter your network-connected devices with IPsec/GRE tunnels, Cloudflare Mesh, or other devices that do not have a Cloudflare certificate installed, you will need to accommodate by creating pass-through policies. For these devices, you should explicitly exempt TLS inspection for the source network IP range from which that traffic will be originating. For example: * [ Dashboard ](#tab-panel-10092) * [ API ](#tab-panel-10093) | Selector | Operator | Value | Action | | ------------------ | -------- | -------------- | -------------- | | Source Internal IP | in | 203.0.113.0/24 | Do Not Inspect | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Do not inspect corporate devices", "traffic": "http.conn.internal_src_ip in {203.0.113.0/24}", "identity": "", "device_posture": "", "action": "off" }' ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/tls-inspection/#page","headline":"Use TLS inspection · Cloudflare Learning Paths","description":"Enable and configure TLS decryption.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-http-policies/tls-inspection/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/","name":"Build HTTP security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-http-policies/tls-inspection/","name":"Use TLS inspection"}}]} ``` --- --- title: Build network security policies description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Build network security policies After creating policies for security based on DNS resolution, we can layer in additional security controls with the Gateway network firewall, which operates at Layer 4 of the OSI model. The Gateway network firewall allows you to build specific policies to block users or services' ability to connect to endpoints at specific IPs or on specific ports. You can also use [Protocol Detection ↗](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/protocol-detection/) to block proxying specific protocols. ## Objectives By the end of this module, you will be able to: * Creat your first Gateway network policy. * Add recommended network security policies. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-network-policies/#page","headline":"Build network security policies · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-network-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-network-policies/","name":"Build network security policies"}}]} ``` --- --- title: Create your first network policy description: Build your first Gateway network policy. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create your first network policy You can control network-level traffic by filtering requests by selectors such as IP addresses and ports. You can also integrate network policies with an [identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) to apply identity-based filtering. To create a new network policy: * [ Dashboard ](#tab-panel-10096) * [ API ](#tab-panel-10097) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall policies**. 2. In the **Network** tab, select **Add a network policy**. 3. Name the policy. 4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block. 5. Choose an **Action** to take when traffic matches the logical expression. For example, you can use a list of [device serial numbers](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/corp-device/) to ensure users can only access an application if they connect with the Cloudflare One Client from a company device: | Selector | Operator | Value | Logic | Action | | ---------------------------- | -------- | ----------------------- | ----- | ------ | | SNI Domain | is | internalapp.com | And | Block | | Passed Device Posture Checks | not in | _Device serial numbers_ | | | 6. Select **Create policy**. 1. [Create an API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) with the following permissions: | Type | Item | Permission | | ------- | ---------- | ---------- | | Account | Zero Trust | Edit | 2. (Optional) Configure your API environment variables to include your [account ID](https://edgetunnel-b2h.pages.dev/fundamentals/account/find-account-and-zone-ids/) and API token. 3. Send a `POST` request to the [Create a Zero Trust Gateway rule](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/rules/methods/create/) endpoint. For example, you can use a list of [device serial numbers](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/corp-device/) to ensure users can only access an application if they connect with the Cloudflare One Client from a company device: **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Enforce device posture", "description": "Ensure only devices in Zero Trust organization can connect to application", "precedence": 0, "enabled": true, "action": "block", "filters": [ "l4" ], "traffic": "any(net.sni.domains[*] == \"internalapp.com\")", "identity": "", "device_posture": "not(any(device_posture.checks.passed[*] in {\"LIST_UUID\"}))" }' ``` ```sh { "success": true, "errors": [], "messages": [] } ``` The API will respond with a summary of the policy and the result of your request. For more information, refer to [network policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-network-policies/create-policy/#page","headline":"Create your first network policy · Cloudflare Learning Paths","description":"Build your first Gateway network policy.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-network-policies/create-policy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-network-policies/","name":"Build network security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-network-policies/create-policy/","name":"Create your first network policy"}}]} ``` --- --- title: Recommended network policies description: Deploy recommended network security policies. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Recommended network policies We recommend you add the following network policies to build an Internet and SaaS app security strategy for your organization. For additional commonly used network policy examples, refer to [Common network policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/common-policies/). For more information on building network policies, refer to [Network policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/). ## Quarantined-Users-NET-Restricted-Access Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected. * [ Dashboard ](#tab-panel-10098) * [ API ](#tab-panel-10099) * [ Terraform ](#tab-panel-10100) | Selector | Operator | Value | Logic | Action | | ---------------- | ----------- | ----------------------------------- | ----- | ------ | | Destination IP | not in list | _Quarantined-Users-IPAllowlist_ | Or | Block | | SNI | not in list | _Quarantined-Users-HostAllowlist_ | Or | | | SNI Domain | not in list | _Quarantined-Users-DomainAllowlist_ | And | | | User Group Names | in | _Quarantined Users_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Quarantined-Users-NET-Restricted-Access", "description": "Restrict access for users included in an IdP user group for risky users", "precedence": 0, "enabled": true, "action": "block", "filters": [ "l4" ], "traffic": "not(net.dst.ip in $) or not(net.sni.host in $) or not(any(net.sni.domains[] in $))", "identity": "any(identity.groups.name[] in {\"Quarantined Users\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "quarantined_users_net_restricted_access" { account_id = var.cloudflare_account_id name = "Quarantined-Users-NET-Restricted-Access" description = "Restrict access for users included in an IdP user group for risky users" precedence = 0 enabled = true action = "block" filters = ["l4"] traffic = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_allowlist.id}) or not(net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_allowlist.id}) or not(any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_allowlist.id}))" identity = "any(identity.groups.name[*] in {\"Quarantined Users\"})" } ``` ## Posture-Fail-NET-Restricted-Access Restrict access for devices where baseline posture checks have not passed. If posture checks are integrated with service providers such as Crowdstrike or Intune via the API, this policy dynamically blocks access for devices that do not meet predetermined security requirements. Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected. * [ Dashboard ](#tab-panel-10101) * [ API ](#tab-panel-10102) * [ Terraform ](#tab-panel-10103) | Selector | Operator | Value | Logic | Action | | ---------------------------- | ----------- | ----------------------------------- | ----- | ------ | | Destination IP | not in list | _Posture-Fail-IPAllowlist_ | Or | Block | | SNI | not in list | _Posture-Fail-HostAllowlist_ | Or | | | SNI Domain | not in list | _Posture-Fail-DomainAllowlist_ | And | | | Passed Device Posture Checks | not in | _Windows 10 or higher (OS version)_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "Posture-Fail-NET-Restricted-Access", "description": "Restrict access for devices where baseline posture checks have not passed", "precedence": 10, "enabled": true, "action": "block", "filters": [ "l4" ], "traffic": "not(net.dst.ip in $) or not(net.sni.host in $) or not(any(net.sni.domains[] in $))", "device_posture": "not(any(device_posture.checks.passed[] in {\"\"}))" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "posture_fail_net_restricted_access" { account_id = var.cloudflare_account_id name = "Posture-Fail-NET-Restricted-Access" description = "Restrict access for devices where baseline posture checks have not passed" precedence = 10 enabled = true action = "block" filters = ["l4"] traffic = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_allowlist.id}) or not(net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_allowlist.id}) or not(any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_allowlist.id}))" device_posture = "not(any(device_posture.checks.passed[*] in {\"${cloudflare_device_posture_rule.baseline_check.id}\"}))" } ``` You can add a number of Cloudflare One Client device posture checks as needed, such as [Disk encryption](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/disk-encryption/) and [Domain joined](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/domain-joined/). For more information on device posture checks, refer to [Enforce device posture](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/). ## FinanceUsers-NET-HTTPS-FinanceServers (example) Allow HTTPS access for user groups. For example, the following policy gives finance users access to any known financial applications: * [ Dashboard ](#tab-panel-10104) * [ API ](#tab-panel-10105) * [ Terraform ](#tab-panel-10106) | Selector | Operator | Value | Logic | Action | | ---------------- | -------- | ----------------- | ----- | ------ | | Destination IP | in list | _Finance Servers_ | And | Allow | | User Group Names | in | _Finance Users_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "FinanceUsers-NET-HTTPS-FinanceServers", "description": "Allow HTTPS access for user groups", "precedence": 20, "enabled": true, "action": "allow", "filters": [ "l4" ], "traffic": "net.dst.ip in $", "identity": "any(identity.groups.name[*] in {\"Finance Users\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "finance_users_net_https_finance_servers" { account_id = var.cloudflare_account_id name = "FinanceUsers-NET-HTTPS-FinanceServers" description = "Allow HTTPS access for user groups" precedence = 20 enabled = true action = "allow" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.finance_servers_list.id}" identity = "any(identity.groups.name[*] in {\"Finance Users\"})" } ``` ## All-NET-Internet-Blocklist Block traffic to destination IPs, SNIs, and SNI domains that are malicious or pose a threat to your organization. You can implement this policy by either creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs). Ideally, your CERTs can update the blocklist with an [API automation](https://edgetunnel-b2h.pages.dev/security-center/intel-apis/) to provide real-time threat protection. * [ Dashboard ](#tab-panel-10107) * [ API ](#tab-panel-10108) * [ Terraform ](#tab-panel-10109) | Selector | Operator | Value | Logic | Action | | -------------- | -------- | ------------------ | ----- | ------ | | Destination IP | in list | _IP Blocklist_ | Or | Block | | SNI | in list | _Host Blocklist_ | Or | | | SNI Domain | in list | _Domain Blocklist_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-NET-Internet-Blocklist", "description": "Block traffic to malicious or risky destination IPs, SNIs, and SNI domains", "precedence": 30, "enabled": true, "action": "block", "filters": [ "l4" ], "traffic": "net.dst.ip in $ and net.sni.host in $ and any(net.sni.domains[*] in $)" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "finance_users_net_https_finance_servers" { account_id = var.cloudflare_account_id name = "All-NET-Internet-Blocklist" description = "Block traffic to malicious or risky destination IPs, SNIs, and SNI domains" precedence = 30 enabled = true action = "block" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id} and net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_blocklist.id} and any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_blocklist.id})" } ``` Note The **Detected Protocol** selector is only available for Enterprise users. For more information, refer to [Protocol detection](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/protocol-detection/). ## All-NET-SSH-Internet-Allowlist Allow SSH traffic to specific endpoints on the Internet for specific users. You can create a similar policy for other non-web endpoints that required access. Optionally, you can include a selector to filter by source IP or IdP group. * [ Dashboard ](#tab-panel-10110) * [ API ](#tab-panel-10111) * [ Terraform ](#tab-panel-10112) | Selector | Operator | Value | Logic | Action | | ----------------- | -------- | ------------------- | ----- | ------ | | Destination IP | in list | _SSHAllowList_ | Or | Allow | | SNI | in list | _SSHAllowlistFQDN_ | And | | | Detected Protocol | is | _SSH_ | And | | | User Group Names | in | _SSH-Allowed-Users_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-NET-SSH-Internet-Allowlist", "description": "Allow SSH traffic to specific endpoints on the Internet for specific users", "precedence": 40, "enabled": true, "action": "allow", "filters": [ "l4" ], "traffic": "net.dst.ip in $ and net.sni.host in $ and net.detected_protocol == \"ssh\"", "identity": "any(identity.groups.name[*] in {\"SSH-Allowed-Users\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_net_ssh_internet_allowlist" { account_id = var.cloudflare_account_id name = "All-NET-SSH-Internet-Allowlist" description = "Allow SSH traffic to specific endpoints on the Internet for specific users" precedence = 40 enabled = true action = "allow" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ssh_ip_allowlist.id} and net.sni.host in ${"$"}${cloudflare_zero_trust_list.ssh_fqdn_allowlist.id} and net.detected_protocol == \"ssh\"" identity = "any(identity.groups.name[*] in {\"SSH-Allowed-Users\"})" } ``` ## All-NET-NO-HTTP-HTTPS-Internet-Deny Block all non-web traffic towards the Internet. By using the **Detected Protocol** selector, you will ensure alternative ports for HTTP and HTTPS are allowed. * [ Dashboard ](#tab-panel-10113) * [ API ](#tab-panel-10114) * [ Terraform ](#tab-panel-10115) | Selector | Operator | Value | Logic | Action | | ----------------- | ----------- | ----------------- | ----- | ------ | | Destination IP | not in list | _InternalNetwork_ | And | Block | | Detected Protocol | not in | _HTTP_, _HTTP2_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-NET-NO-HTTP-HTTPS-Internet-Deny", "description": "Block all non-web traffic towards the Internet", "precedence": 50, "enabled": true, "action": "block", "filters": [ "l4" ], "traffic": "not(net.dst.ip in $) and not(net.detected_protocol in {\"http\" \"http2\"})" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_net_no_http_https_internet_deny" { account_id = var.cloudflare_account_id name = "All-NET-NO-HTTP-HTTPS-Internet-Deny" description = "Block all non-web traffic towards the Internet" precedence = 50 enabled = true action = "block" filters = ["l4"] traffic = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.internal_network_ip_list.id}) and not(net.detected_protocol in {\"http\" \"http2\"})" } ``` ## All-NET-InternalNetwork-ImplicitDeny Implicitly deny all of your internal IP ranges included in a list. We recommend you place this policy at the [bottom of your policy list](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#order-of-precedence) to ensure you explicitly approve traffic defined in the above policies. * [ Dashboard ](#tab-panel-10116) * [ API ](#tab-panel-10117) * [ Terraform ](#tab-panel-10118) | Selector | Operator | Value | Action | | -------------- | -------- | ---------------------- | ------ | | Destination IP | in list | _Internal Network IPs_ | Block | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-NET-InternalNetwork-ImplicitDeny", "description": "Implicitly deny all of your internal IP ranges included in a list", "precedence": 60, "enabled": true, "action": "block", "filters": [ "l4" ], "traffic": "net.dst.ip in $" }' ``` ```tf resource "cloudflare_zero_trust_gateway_policy" "all_net_internalnetwork_implicitdeny" { account_id = var.cloudflare_account_id name = "All-NET-InternalNetwork-ImplicitDeny" description = "Implicitly deny all of your internal IP ranges included in a list" precedence = 60 enabled = true action = "block" filters = ["l4"] traffic = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.internal_network_ip_list.id}" } ``` ## All-NET-ApplicationAccess-Allow Only allow network traffic from known and approved devices. In the following example, you can use a list of [device serial numbers](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/client-checks/corp-device/) to ensure users can only access an application if they connect with the Cloudflare One Client from a company device: * [ Dashboard ](#tab-panel-10119) * [ API ](#tab-panel-10120) * [ Terraform ](#tab-panel-10121) | Selector | Operator | Value | Logic | Action | | ---------------------------- | -------- | ----------------------- | ----- | ------ | | SNI Domain | is | internalapp.com | And | Block | | Passed Device Posture Checks | not in | _Device serial numbers_ | | | **Create a Zero Trust Gateway rule** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "All-NET-ApplicationAccess-Allow", "description": "Ensure access to the application comes from authorized WARP clients", "precedence": 70, "enabled": false, "action": "block", "filters": [ "l4" ], "traffic": "any(net.sni.domains[*] == \"internalapp.com\")", "device_posture": "not(any(device_posture.checks.passed[*] in {\"\"}))" }' ``` To get the UUIDs of your device posture checks, use the [List device posture rules](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/devices/subresources/posture/methods/list/) endpoint. ```tf resource "cloudflare_zero_trust_gateway_policy" "all_net_applicationaccess_allow" { account_id = var.cloudflare_account_id name = "All-NET-ApplicationAccess-Allow" description = "Ensure access to the application comes from authorized WARP clients" precedence = 70 enabled = false action = "block" filters = ["l4"] traffic = "any(net.sni.domains[*] == \"internalapp.com\")" posture = "not(any(device_posture.checks.passed[*] in {\"${"$"}${cloudflare_zero_trust_list.allowed_devices_sn_list.id}\"}))" } ``` ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-network-policies/recommended-network-policies/#page","headline":"Recommended network policies · Cloudflare Learning Paths","description":"Deploy recommended network security policies.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/build-network-policies/recommended-network-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/build-network-policies/","name":"Build network security policies"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/build-network-policies/recommended-network-policies/","name":"Recommended network policies"}}]} ``` --- --- title: Concepts description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Learn the core concepts of using Cloudflare Zero Trust functionality to provide granular security policy for devices and networks accessing the Internet. ## Objectives By the end of this module, you will be able to: * Understand what products and features Cloudflare offers. * Describe how Cloudflare implements Internet traffic and SaaS app security. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/concepts/","name":"Concepts"}}]} ``` --- --- title: What security features does Cloudflare provide? description: Explore Cloudflare Zero Trust security features. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What security features does Cloudflare provide? Review concepts related to Cloudflare Internet traffic and SaaS app security. ## What is 1.1.1.1? 1.1.1.1 is Cloudflare's free, fast, and secure public DNS resolver. For more information, refer to the [Learning Center ↗](https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/) and [1.1.1.1 documentation](https://edgetunnel-b2h.pages.dev/1.1.1.1/). ## What is a secure web gateway (SWG)? A secure web gateway (SWG) is a cyber security product that protects company data and enforces security policies. Cloudflare Gateway is a modern next-generation firewall between your user, device, or network and the public Internet. It includes DNS filtering to inspect and apply policies to all Internet-bound DNS queries. For more information, refer to the [Learning Center ↗](https://www.cloudflare.com/learning/access-management/what-is-a-secure-web-gateway/) and [Gateway documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/). ## What is HTTPS inspection? HTTPS inspection (also known as TLS decryption) is the process of filtering traffic by decrypting traffic sent to or from your organization, inspecting it and applying policies, then re-encrypting the traffic as it ingresses or egresses. For more information, refer to the [Learning Center ↗](https://www.cloudflare.com/learning/security/what-is-https-inspection/) and [TLS decryption documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/tls-decryption/). ## What is data loss prevention (DLP)? Data loss prevention checks for sensitive data sent in uploads and downloads. Cloudflare [Data Loss Prevention](https://www.cloudflare.com/learning/access-management/what-is-dlp/) (DLP) allows you to scan your web traffic and SaaS applications for the presence of sensitive data such as social security numbers, financial information, secret keys, and source code. For more information, refer to the [Learning Center ↗](https://www.cloudflare.com/learning/access-management/what-is-dlp/) and [DLP documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/). ## What is a cloud access security broker (CASB)? A cloud access security broker protects cloud services from security threats. Cloudflare CASB provides comprehensive visibility and control over SaaS apps to prevent data leaks and compliance violations. It helps detect insider threats, shadow IT, risky data sharing, and bad actors. For more information, refer to the [Learning Center ↗](https://www.cloudflare.com/learning/access-management/what-is-a-casb/) and [CASB documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/). ## What is browser isolation? Browser isolation prevents users from interacting directly with malicious websites by rendering pages in an isolated browser offsite. Cloudflare Browser Isolation seamlessly executes active webpage content in a secure isolated browser to protect users from zero-day attacks, malware, and phishing. For more information, refer to the [Learning Center ↗](https://www.cloudflare.com/learning/access-management/what-is-a-casb/) and [Browser Isolation documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/concepts/security-concepts/#page","headline":"What security features does Cloudflare provide? · Cloudflare Learning Paths","description":"Explore Cloudflare Zero Trust security features.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/concepts/security-concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/concepts/security-concepts/","name":"What security features does Cloudflare provide?"}}]} ``` --- --- title: Configure the device agent description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure the device agent The Cloudflare One Client (known as the Cloudflare One Agent in mobile app stores) encrypts designated traffic from a user's device to Cloudflare's global network. In this learning path, we will first define all of your parameters and deployment rules, and then we will install and connect the client. If you prefer to start the client download now, refer to [Download the Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). Note The following steps are identical to [Configure the device agent](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/) in the Replace your VPN implementation guide. If you have already completed Replace your VPN, you can skip ahead to [Determine when to use PAC files](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/pac-files/). ## Objectives By the end of this module, you will be able to: * Define which users can connect devices to your Zero Trust instance. * Configure global and device-specific settings for the Cloudflare One Client. * Route user traffic through Cloudflare Gateway. * Route domains to a private DNS server, if required. Troubleshoot the Cloudflare One Client For step-by-step guidance on diagnosing and resolving Cloudflare One Client issues, refer to the [Cloudflare One Client troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/). The guide covers: * How to collect diagnostic logs via the Cloudflare dashboard or CLI * How to review key configuration files * Common misconfigurations and their fixes * Best practices for filing support tickets ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/#page","headline":"Configure the device agent · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/","name":"Configure the device agent"}}]} ``` --- --- title: Define device enrollment permissions description: Control which devices can enroll. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Define device enrollment permissions Device enrollment permissions determine which users can connect new devices to your organization's Cloudflare Zero Trust instance. Once the user registers their device, the Cloudflare One Client will store their identity token and use it to authenticate to services in your private network. ## Set device enrollment permissions * [ Dashboard ](#tab-panel-10122) * [ Terraform (v5) ](#tab-panel-10123) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **Management**. 2. In **Device enrollment** \> **Device enrollment permissions**, select **Manage**. 3. In the **Policies** tab, configure one or more [Access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) to define who can join their device. For example, you could allow all users with a company email address: | Rule type | Selector | Value | | --------- | ---------------- | ------------ | | Include | Emails ending in | @company.com | Note Device posture checks are not supported in device enrollment policies. The Cloudflare One Client (formerly WARP) can only perform posture checks after the device is enrolled. 1. In the **Login methods** tab: a. Select the [identity providers](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/). b. (Optional) If you plan to only allow access via a single IdP, turn on **Apply instant authentication**. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event. 2. Select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Apps and Policies Write` 2. Create a reusable Access policy using the [cloudflare\_zero\_trust\_access\_policy ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fpolicy) resource: ```tf resource "cloudflare_zero_trust_access_policy" "allow_company_emails" { account_id = var.cloudflare_account_id name = "Allow company emails" decision = "allow" include = [ { email_domain = { domain = "@example.com" } } ] } ``` 3. Use the [cloudflare\_zero\_trust\_access\_application ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fapplication) resource to create an application with type `warp`. ```tf resource "cloudflare_zero_trust_access_application" "device_enrollment" { account_id = var.cloudflare_account_id type = "warp" name = "Warp device enrollment" allowed_idps = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id] auto_redirect_to_identity = true app_launcher_visible = false policies = [ { id = cloudflare_zero_trust_access_policy.allow_company_emails.id precedence = 1 } ] } ``` ## Only allow corporate devices Device posture evaluation happens after a device has already enrolled in your Zero Trust organization. If you want only specific devices to be able to enroll, we recommend adding a [mutual TLS authentication](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/) rule to your device enrollment policy. This rule will check for the presence of a specific client certificate on the enrolling devices. Note Mutual TLS authentication is only available on Enterprise plans. Certificate requirements * The CA certificate can be from a publicly trusted CA or self-signed. * In the certificate `Basic Constraints`, the attribute `CA` must be set to `TRUE`. * The certificate must use one of the signature algorithms listed below: Allowed signature algorithms `x509.SHA1WithRSA` `x509.SHA256WithRSA` `x509.SHA384WithRSA` `x509.SHA512WithRSA` `x509.ECDSAWithSHA1` `x509.ECDSAWithSHA256` `x509.ECDSAWithSHA384` `x509.ECDSAWithSHA512` To check for an mTLS certificate: * [ Dashboard ](#tab-panel-10124) * [ Terraform (v5) ](#tab-panel-10125) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Access controls** \> **Service credentials** \> **Mutual TLS**. 2. Select **Add mTLS Certificate**. 3. Enter any name for the root CA. 4. In **Certificate content**, paste the contents of your root CA. If the client certificate is directly signed by the root CA, you only need to upload the root. If the client certificate is signed by an intermediate certificate, you must upload the entire CA chain (intermediate and root). For example: ```txt -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- ``` 1. In **Associated hostnames**, enter your Zero Trust team domain: `.cloudflareaccess.com` 2. In your [device enrollment permissions](#set-device-enrollment-permissions), add a _Common Name_ or _Valid Certificate_ rule. For example, the following policy requires a client certificate with a specific common name: | Action | Rule type | Selector | Value | | ------ | --------- | ----------- | ------------------ | | Allow | Require | Common Name | | 3. On your device, add the client certificate to the [system keychain](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#test-in-the-browser). 1. Add the following permissions to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Mutual TLS Certificates Write` * `Access: Apps and Policies Write` 2. Use the [cloudflare\_zero\_trust\_access\_mtls\_certificate ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fmtls%5Fcertificate) resource to add an mTLS certificate to your account: ```tf resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" { account_id = var.cloudflare_account_id name = "WARP enrollment mTLS cert" certificate = < Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Customize device profiles A device profile defines [Cloudflare One Client settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) for a specific set of devices in your organization. You can create multiple profiles and apply different settings based on the user's identity, the device's location, and other criteria. For example, users in one identity provider group (signifying a specific office location) might have different routes that need to be excluded from their WARP tunnel, or some device types (like Linux) might need different DNS settings to accommodate local development services. ## Configure the default profile Set your default device profile to be applicable to a majority of your userbase, or any user without known explicit considerations. To customize the default settings: * [ Dashboard ](#tab-panel-10126) * [ API ](#tab-panel-10127) * [ Terraform (v5) ](#tab-panel-10128) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Select the **Default** profile and select \*_Edit_. 3. Many users running Cloudflare Zero Trust to secure their organization have a default profile that resembles the following. Refer to [Cloudflare One Client settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) for a description of each setting. | Setting | State | Notes | | ------------------------------------ | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Captive portal detection | Enabled | | | Mode switch | Disabled | If enabled, users have the option to switch to a DNS-only security mode and lose access to your private network. | | Lock device client switch | Enabled | Should be enabled unless users have an explicit reason to disable the device client, such as a conflicting VPN client on the device or other extenuating circumstances. If disabled for concerns about user experience, **Auto Connect** should be enabled and set on a short interval, like 10-15 minutes. | | Allow device to leave organization | Disabled | | | Allow updates | Disabled | Usually disabled on managed devices. If enabled, users who are local administrators on their device can update the Cloudflare One Client on their own — this can introduce version consistency control issues if client versions are centrally managed by IT. | | Auto connect | Enabled | Timeout is usually set between 10min - 30min. | | Support URL | Enabled | | | Service mode | Traffic and DNS mode | Proxies device traffic to Cloudflare according to your Split Tunnel rules. | | Local Domain Fallback | | Refer to [Resolve Private DNS](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/private-dns/). | | Split Tunnels | Exclude IPs and domains | Refer to [Define Split Tunnels settings](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/configure-device-agent/split-tunnel-settings/). | | Directly route Microsoft 365 traffic | Disabled | Usually disabled to allow inspection of Microsoft 365 traffic. | 4. Save the profile. 5. Configure [global settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#global-settings) for all device profiles: 1. (Recommended) Enable **Admin override code** if you turned on **Lock device client switch**. 2. Enable **Install CA to system certificate store** if you want users to see a [custom block page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/gateway-block-page/). 1. Update the default device settings profile: ```bash curl --request PATCH \ https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "allow_mode_switch": false, "allow_updates": false, "allowed_to_leave": false, "auto_connect": 900, "captive_portal": 180, "disable_auto_fallback": true, "exclude_office_ips": false, "service_mode_v2": { "mode": "warp" }, "support_url": "https://it.company.com/help", "switch_locked": true }' ``` 1. Update global settings: ```bash curl --request PUT \ https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/settings \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "disable_for_time": 3600, "root_certificate_installation_enabled": true }' ``` 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Configure default profile settings using the [cloudflare\_zero\_trust\_device\_default\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile) resource: ```tf resource "cloudflare_zero_trust_device_default_profile" "default_profile" { account_id = var.cloudflare_account_id allow_mode_switch = false allow_updates = false allowed_to_leave = false auto_connect = 600 captive_portal = 180 disable_auto_fallback = true exclude_office_ips = false service_mode_v2 = {mode = "warp"} support_url = "https://support.example.com" switch_locked = true tunnel_protocol = "wireguard" } ``` 3. Configure [global settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#global-settings) using the [cloudflare\_zero\_trust\_device\_settings ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fsettings) resource: ```tf resource "cloudflare_zero_trust_device_settings" "global_warp_settings" { account_id = var.cloudflare_account_id disable_for_time = 3600 root_certificate_installation_enabled = true use_zt_virtual_ip = false } ``` ## (Optional) Create an office profile You can configure a device settings profile to take effect when the device is connected to a trusted network such as an office. For example, you may wish to allow users in the office to access applications directly rather than route traffic through Cloudflare. For setup instructions, refer to [Add a managed network](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/managed-networks/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles/#page","headline":"Customize device profiles · Cloudflare Learning Paths","description":"Configure WARP client device profiles.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles/","name":"Customize device profiles"}}]} ``` --- --- title: Proxy traffic through Gateway description: Route device traffic through Cloudflare Gateway. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Proxy traffic through Gateway With Cloudflare Gateway, you can log and filter DNS, network, and HTTP traffic from devices running the Cloudflare One Client. This includes traffic to the public Internet and traffic directed to your private network. DNS filtering is enabled by default since the Cloudflare One Client sends DNS queries to Cloudflare's public DNS resolver, [1.1.1.1](https://edgetunnel-b2h.pages.dev/1.1.1.1/). To enable network and HTTP filtering, you will need to allow Cloudflare Gateway to proxy that traffic. ## Enable the proxy 1. Go to **Traffic policies** \> **Traffic settings**. 2. Enable **Allow Secure Web Gateway to proxy traffic** for TCP. 3. (Recommended) To proxy all port `443` traffic, including internal DNS queries, select **UDP**. 4. (Optional) To scan file uploads and downloads for malware, [enable anti-virus scanning](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/antivirus-scanning/). Cloudflare will now proxy traffic from enrolled devices, except for the traffic excluded in your [split tunnel settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#3-route-private-network-ips-through-the-cloudflare-one-client). For more information on how Gateway forwards traffic, refer to [Gateway proxy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/proxy/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/enable-proxy/#page","headline":"Proxy traffic through Gateway · Cloudflare Learning Paths","description":"Route device traffic through Cloudflare Gateway.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/enable-proxy/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/enable-proxy/","name":"Proxy traffic through Gateway"}}]} ``` --- --- title: Determine when to use PAC files description: Evaluate PAC files for proxy configuration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Determine when to use PAC files Note Only available on Enterprise plans. Learn how and when to use PAC files instead of (or complementary to) endpoint agents. ## What are PAC files? A PAC file, or proxy auto-configuration file, is like a tiny map that guides your web browser to websites. Instead of going straight to a website, a PAC file can forward your traffic through a proxy server first, protecting your device and filtering unwanted URL access. Cloudflare users use PAC files to filter Internet traffic when they do not want to install agents on devices or where agent installations are not supported. Here is a quick overview of PAC files: * **What they do**: PAC files contain JavaScript code that decides whether or not your browser should use a proxy. The code determines this for each website you visit. * **How they work**: PAC files tell your browser to run a `FindProxyForURL()` function with the website address. This function analyzes the address and decides whether to send it directly to the browser or through a specified proxy server. * **Why use them**: PAC files are handy for organizations or networks that want to control access to the Internet. PAC files can allow access to some websites directly while routing others through the proxy for filtering or security. * **Benefits**: Managing a single PAC file saves time and effort compared to manually configuring proxy settings for each device. It also allows for flexible rules based on websites, time and date, and other factors. Think of PAC files like a GPS: you are driving to a friend's house, but there is construction on the main road. Your GPS (the PAC file) suggests a detour through a side street (the proxy server) to get there faster. ### Use cases Some use cases for PAC files include: * **Versions of Windows before Windows 8/Windows Server 2012**: The Cloudflare One Client does not support older versions of Windows, so PAC files provide a clientless solution to route traffic through Cloudflare to add security and filtering benefits. * **Non-persistent virtual desktop infrastructure (VDI) environments**: PAC files can be especially valuable in non-persistent VDI environments where installing and saving user details for the Cloudflare One Client is challenging. In these instances, PAC files ensure consistent access and security regardless of individual user sessions. * **Backup in case of agent outage**: In case of an agent outage, PAC files can act as a backup that can be deployed quickly to minimize downtime and security risk. ## Where are PAC files hosted? PAC files are usually hosted in a centralized location where all of the devices in your organization can reach and download the file. You can configure browsers with a PAC URL to retrieve the PAC file from the address. This typically occurs when your users open the browser. Many admins push PAC files to devices via deployment methods such as Group Policy Objects (GPOs). ## Create a PAC file For detailed instructions on creating a PAC file, refer to [Enable Gateway proxy with PAC files](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/). ### Best practices * Avoid complex logic and nested conditions, as they might slow down processing time. * Place frequently accessed URLs and conditions at the top for faster processing. * Test your PAC file logic on multiple devices before deployment with tools such as an [online proxy PAC file tester ↗](https://thorsen.pm/proxyforurl). * When users download a PAC file from a central location, the download must complete within 30 seconds or most browsers will time out. * Requests must complete with an HTTP response code `200`. * Requests must have an uncompressed body smaller than 1 MB (megabyte). * Do not include standard HTTP caching within your PAC file. Cached contents can make PAC instructions outdated, and thus lead to bad HTTP routing. * PAC files cannot be fetched through a proxy. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/pac-files/#page","headline":"Determine when to use PAC files · Cloudflare Learning Paths","description":"Evaluate PAC files for proxy configuration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/pac-files/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/pac-files/","name":"Determine when to use PAC files"}}]} ``` --- --- title: Resolve private DNS description: Set up private DNS resolution. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Resolve private DNS By default, all DNS requests on the user device are resolved by Cloudflare's [public DNS resolver](https://edgetunnel-b2h.pages.dev/1.1.1.1/) except for common top level domains used for local resolution (such as `localhost`). To allow users to connect to internal server names or domains that do not resolve on the public Internet, you have two options: * [Add internal domains to Local Domain Fallback](#local-domain-fallback) * [Build custom resolver policies](#resolver-policies) ## Local Domain Fallback Local Domain Fallback tells the Cloudflare One Client to send specific DNS requests to your private DNS resolver instead of to Cloudflare's public DNS resolver. This method was the primary delivery mechanism for private DNS for a long time, and is the simplest option, but it has two shortcomings: you cannot deterministically route private DNS queries to different resolvers based on specific attributes, and you cannot apply Gateway DNS policies to this traffic because Cloudflare is not resolving it. To learn more about how Local Domain Fallback works, refer to [How the Cloudflare One Client handles DNS requests](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/#how-the-warp-client-handles-dns-requests). ### Add a domain To add a domain to the Local Domain Fallback list: * [ Dashboard ](#tab-panel-10131) * [ Terraform (v5) ](#tab-panel-10132) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Locate the [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) you would like to view or modify and select **Configure**. 3. Scroll down to **Local Domain Fallback** and select **Manage**. 1. In **Domain**, enter the apex domain (`example.com`) that you want to resolve using your private DNS server. All prefixes under the apex domain are subject to Local Domain Fallback (in other words, `example.com` is interpreted as `*.example.com`). 2. In **DNS Servers**, enter the IP address of the DNS servers that should resolve that domain name. Cloudflare recommends keeping the list to a maximum of eight servers to avoid performance issues. 3. Enter an optional description and select **Save domain**. A Local Domain Fallback list is scoped to a specific [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). If a device profile does not have a corresponding Local Domain Fallback resource, those devices will use the default local domains shown in Step 2. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. (Optional) Create a list of domains that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles: **local-domains.local.tf** ```tf locals { default_local_domains = [ # Default Local Domain Fallback entries recommended by Cloudflare { suffix = "corp" }, { suffix = "domain" }, { suffix = "home" }, { suffix = "home.arpa" }, { suffix = "host" }, { suffix = "internal" }, { suffix = "intranet" }, { suffix = "invalid" }, { suffix = "lan" }, { suffix = "local" }, { suffix = "localdomain" }, { suffix = "localhost" }, { suffix = "private" }, { suffix = "test" } ] } ``` 3. To configure Local Domain Fallback for the default device profile, use the [cloudflare\_zero\_trust\_device\_default\_profile\_local\_domain\_fallback ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile%5Flocal%5Fdomain%5Ffallback) resource. To configure Local Domain Fallback for a custom device profile, use[cloudflare\_zero\_trust\_device\_custom\_profile\_local\_domain\_fallback ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fcustom%5Fprofile%5Flocal%5Fdomain%5Ffallback). For example: **device-profiles.tf** ```tf resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example" { account_id = var.cloudflare_account_id policy_id = cloudflare_zero_trust_device_custom_profile.example.id domains = concat( # Global entries local.default_local_domains, # Profile-specific entries [ { suffix = "example.com" description = "Domain for local development" dns_server = ["1.1.1.1", "192.168.0.1"] } ] ) } ``` For `suffix`, specify the apex domain (`example.com`) that you want to resolve using your private DNS server. All prefixes under the apex domain are subject to Local Domain Fallback (in other words, `example.com` is interpreted as `*.example.com`). For `dns_server`, enter the IP address of the DNS servers that should resolve that domain name. Cloudflare recommends keeping the list to a maximum of eight servers to avoid performance issues. The Cloudflare One Client tries all servers and always uses the fastest response, even if that response is `no records found`. We recommend specifying at least one DNS server for each domain. If a value is not specified, the Cloudflare One Client will try to identify the DNS server (or servers) used on the device before it started, and use that server for each domain in the Local Domain Fallback list. ### Route traffic to fallback server The Cloudflare One Client routes DNS traffic to your [Local Domain Fallback server](#add-a-domain) according to your [Split Tunnel configuration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/). To ensure that queries can reach your private DNS server: * If your DNS server is only reachable inside of the WARP tunnel (for example, via `cloudflared` or Cloudflare WAN): 1. Go to **Networking** \> **Routes** and verify that the DNS server is connected to Cloudflare. To connect a DNS server, refer to [Private networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/). 2. In your [Split Tunnel configuration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/), verify that the DNS server IP routes through the WARP tunnel. * If your DNS server is only reachable outside of the WARP tunnel (for example, via a third-party VPN), verify that the DNS server IP is [excluded from the WARP tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/). For more information, refer to [How the Cloudflare One Client handles DNS requests](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/#how-the-warp-client-handles-dns-requests). ## Resolver policies Note Only available on Enterprise plans. [Resolver policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/) provide similar functionality to Local Domain Fallback but occur in Cloudflare Gateway rather than on the local device. This option is recommended if you want more granular control over private DNS resolution. For example, you can ensure that all users in a specific geography use the private DNS server closest to them, ensure that specific conditions are met before resolving private DNS traffic, and apply [Gateway DNS policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/) to private DNS traffic. ### Create a resolver policy Virtual network limitation Resolver policies do not automatically update when you change the virtual networks associated with a route. If you move a route from one virtual network to another, the resolver policy will still reference the old virtual network. You will need to manually remove and recreate the resolver policy to update the route. To create a resolver policy: * [ Dashboard ](#tab-panel-10129) * [ Terraform (v5) ](#tab-panel-10130) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Resolver policies**. 2. Select **Add a policy**. 3. Create an expression for your desired traffic. For example, you can resolve a hostname for an internal service: | Selector | Operator | Value | | -------- | -------- | -------------------- | | Host | in | internal.example.com | Make sure your destination is not subject to [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/#manage-local-domains). 4. In **Select DNS resolver**, choose _Configure custom DNS resolvers_. 5. Enter the IP addresses of your custom DNS resolver. As you enter an IP address, Gateway will search through your [virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) configured in Zero Trust. 6. In **Network**, choose whether to route queries publicly (to the Internet) or privately (to a private network service). 7. (Optional) Enter a custom port for each IP address. 8. Select **Create policy**. Custom resolvers are saved to your account for future use. You can add up to 10 IPv4 and 10 IPv6 addresses to a policy. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Create a resolver policy using the [cloudflare\_zero\_trust\_gateway\_policy ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fgateway%5Fpolicy) resource: ```tf resource "cloudflare_zero_trust_gateway_policy" "resolver_policy" { name = "Example resolver policy" enabled = true account_id = var.cloudflare_account_id description = "TERRAFORM MANAGED resolver policy" action = "resolve" traffic = "dns.fqdn in {\"internal.example.com\"}" identity = "identity.email in {\"jdoe@example.com\"}" precedence = 1 rule_settings = { dns_resolvers = { # You can add up to 10 IPv4 and 10 IPv6 addresses to a policy. ipv4 = [{ ip = "192.0.2.24" port = 53 route_through_private_network = true vnet_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.staging_vnet.id }] ipv6 = [{ ip = "2001:DB8::" port = 53 route_through_private_network = true vnet_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.staging_vnet.id }] } } } ``` When a user's query matches a resolver policy, Gateway will send the query to your listed resolvers in the following order: 1. Public resolvers 2. Private resolvers behind the default virtual network for your account 3. Private resolvers behind a custom virtual network Gateway will cache the fastest resolver for use in subsequent queries. Resolver priority is cached on a per user basis for each data center. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/private-dns/#page","headline":"Resolve private DNS · Cloudflare Learning Paths","description":"Set up private DNS resolution.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/private-dns/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/private-dns/","name":"Resolve private DNS"}}]} ``` --- --- title: Define Split Tunnel settings description: Configure split tunnel routing rules. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Define Split Tunnel settings Split tunnel settings determine which traffic the Cloudflare One Client does and does not proxy. The Cloudflare One Client offers two different split tunnel modes: * If you intend to send all internal and external destination traffic through Cloudflare's global network, opt for **Exclude IPs and domains** mode. This mode will proxy everything through the WARP tunnel with the exception of IPs and hosts defined explicitly within the Split Tunnel list. * If you intend to only use the Cloudflare One Client to proxy private destination traffic, you can operate in **Include IPs and domains** mode, in which you explicitly define which IP ranges and domains should be included in the WARP routing table. ## Update Split Tunnels mode To change your Split Tunnels mode: * [ Dashboard ](#tab-panel-10133) * [ Terraform (v5) ](#tab-panel-10134) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Locate the [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) you would like to modify and select **Configure**. 3. Scroll down to **Split Tunnels**. 4. (Optional) To view your existing Split Tunnel configuration, select **Manage**. You will see a list of the IPs and domains Cloudflare Zero Trust excludes or includes, depending on the mode you have selected. We recommend making a copy of your Split Tunnel entries, as they will revert to the default upon switching modes. 5. Under **Split Tunnels**, choose a mode: * **Exclude IPs and domains** — (Default) All traffic will be sent to Cloudflare Gateway except for the IPs and domains you specify. * **Include IPs and Domains** — Only traffic destined to the IPs or domains you specify will be sent to Cloudflare Gateway. All other traffic will bypass Gateway and will no longer be filtered by your network or HTTP policies. In order to use certain features, you will need to manually add [Zero Trust domains](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#cloudflare-zero-trust-domains). 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Choose a [cloudflare\_zero\_trust\_device\_default\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile) or [cloudflare\_zero\_trust\_device\_custom\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fcustom%5Fprofile) resource to modify, or [create a new device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/#create-a-new-profile). 3. In your device profile, configure either the `exclude` or `include` argument. You cannot set both `exclude` and `include` in a given device profile. a. To manage Split Tunnel routes in **Exclude** mode, use the `exclude` argument: ```tf resource "cloudflare_zero_trust_device_custom_profile" "exclude_example" { account_id = var.cloudflare_account_id name = "Custom profile in Split Tunnels Exclude mode" enabled = true precedence = 101 service_mode_v2 = {mode = "warp"} match = "identity.email == \"test@cloudflare.com\"" exclude = [{ address = "10.0.0.0/8" description = "Example route to exclude from WARP tunnel" }] } ``` In this example, all traffic will be sent to Cloudflare Gateway except for traffic destined to `10.0.0.0/8`. To exclude the default IPs and domains recommended by Cloudflare, refer to [Add a route](#add-a-route). b. To manage Split Tunnel routes in **Include** mode, use the `include` argument: ```tf resource "cloudflare_zero_trust_device_custom_profile" "include_example" { account_id = var.cloudflare_account_id name = "Custom profile in Split Tunnels Include mode" enabled = true precedence = 101 service_mode_v2 = {mode = "warp"} match = "identity.email == \"test@cloudflare.com\"" include = [{ address = "10.0.0.0/8" description = "Example route to include in WARP tunnel" }] } ``` In this example, only traffic destined to `10.0.0.0/8` will be sent to Cloudflare Gateway. All clients with this device profile will now switch to the new mode and its default route configuration. Next, [add](#add-a-route) or [remove](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#remove-a-route) routes from your Split Tunnel configuration. ## Add a route * [ Dashboard ](#tab-panel-10137) * [ Terraform (v5) ](#tab-panel-10138) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Team & Resources** \> **Devices** \> **Device profiles** \> **General profiles**. 2. Locate the [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) you would like to modify and select **Configure**. 3. Under **Split Tunnels**, check whether your [Split Tunnels mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include**. 4. Select **Manage**. 5. You can exclude or include routes based on either their IP address or domain. When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to [Domain-based Split Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels). * [ Add an IP ](#tab-panel-10135) * [ Add a domain ](#tab-panel-10136) To add an IP address to Split Tunnels: 1. Select _IP Address_. 2. Enter the IP address or CIDR you want to exclude or include. 3. Select **Save destination**. Traffic to this IP address is now excluded or included from the WARP tunnel. Note If you would like to exclude a specific IP range from a larger IP range, you can use this calculator: **Base CIDR:** **Subtracted CIDRs:** Calculate To add a domain to Split Tunnels: 1. Select _Domain_. 2. Enter a [valid domain](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#valid-domains) to exclude or include. 3. Select **Save destination**. 4. (Optional) If your domain does not have a public DNS record, create a [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) entry to allow a private DNS server to handle domain resolution. When a user goes to the domain, the domain gets resolved according to your Local Domain Fallback configuration (either by Gateway or by your private DNS server). Split Tunnels will then dynamically include or exclude the IP address returned in the DNS lookup. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Choose a [cloudflare\_zero\_trust\_device\_default\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fdefault%5Fprofile) or [cloudflare\_zero\_trust\_device\_custom\_profile ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Fdevice%5Fcustom%5Fprofile) resource to modify, or [create a new device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/#create-a-new-profile). 3. (Optional) Create a list of split tunnel routes that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles: **split-tunnels.local.tf** ```tf locals { global_exclude_list = [ # Default Split Tunnel entries recommended by Cloudflare { address = "ff05::/16" }, { address = "ff04::/16" }, { address = "ff03::/16" }, { address = "ff02::/16" }, { address = "ff01::/16" }, { address = "fe80::/10" description = "IPv6 Link Local" }, { address = "fd00::/8" }, { address = "255.255.255.255/32" description = "DHCP Broadcast" }, { address = "240.0.0.0/4" }, { address = "224.0.0.0/24" }, { address = "192.168.0.0/16" }, { address = "192.0.0.0/24" }, { address = "172.16.0.0/12" }, { address = "169.254.0.0/16" description = "DHCP Unspecified" }, { address = "100.64.0.0/10" }, { address = "10.0.0.0/8" } ] } ``` 4. In the device profile, exclude or include routes based on either their IP address or domain: **device-profiles.tf** ```tf resource "cloudflare_zero_trust_device_custom_profile" "example" { account_id = var.cloudflare_account_id name = "Example custom profile with split tunnels" enabled = true precedence = 101 service_mode_v2 = {mode = "warp"} match = "identity.email == \"test@cloudflare.com\"" exclude = concat( # Global entries local.global_exclude_list, # Profile-specific entries [ { address = "192.0.2.0/24" description = "Example IP to exclude from WARP" }, { host = "example.com" description = "Example domain to exclude from WARP" } ] ) } ``` When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to [Domain-based Split Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels). It may take up to 10 minutes for newly updated settings to propagate to devices. We recommend keeping the Split Tunnels list short, as each entry takes time for the client to parse. In particular, domains are slower to action than IP addresses because they require on-the-fly IP lookups and routing table / local firewall changes. A shorter list will also make it easier to understand and debug your configuration. For information on device profile limits, refer to [Account limits](https://edgetunnel-b2h.pages.dev/cloudflare-one/account-limits/#warp). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/split-tunnel-settings/#page","headline":"Define Split Tunnel settings · Cloudflare Learning Paths","description":"Configure split tunnel routing rules.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/split-tunnel-settings/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/","name":"Configure the device agent"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/configure-device-agent/split-tunnel-settings/","name":"Define Split Tunnel settings"}}]} ``` --- --- title: Connect devices and networks to Cloudflare description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Connect devices and networks to Cloudflare After setting up your Cloudflare account and Zero Trust organization, you can begin connecting your users' devices and networks to Cloudflare. ## Objectives By the end of this module, you will be able to: * Manually deploy the Cloudflare One Client on a test device. * Create an automated script to use with your organization's managed deployment tool. * View user traffic in Zero Trust. * Determine when and how to use PAC files. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/#page","headline":"Connect devices and networks to Cloudflare · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/","name":"Connect devices and networks to Cloudflare"}}]} ``` --- --- title: Choose an on-ramp description: Select a device or network on-ramp. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Choose an on-ramp Similar to the network onboarding practices in the [Replace your VPN](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-private-network/) implementation guide, there are a number of ways to on-ramp your network traffic to the Cloudflare global network. This guide will quickly explore all of the options to on-ramp traffic to Cloudflare Gateway to inspect, apply policies, and filter. Note The following steps are identical to [Connect user devices](https://edgetunnel-b2h.pages.dev/learning-paths/replace-vpn/connect-devices/) in the Replace your VPN implementation guide. If you have already completed Replace your VPN, you can skip ahead to [Network on-ramps](#network-on-ramps). ## Device on-ramps The most common way to protect and filter your end-user traffic is by using a device client. The standard Cloudflare device client supports a number of operating systems and deployment methodologies, but there can still be scenarios in which an alternative path makes sense. ### Cloudflare One Client The Cloudflare One Client is the most common onramp to send user traffic to Gateway. It is a lightweight device client, which builds proxy tunnels using either Wireguard or MASQUE, and builds a DNS proxy using DNS-over-HTTPS. It supports all major operating systems, supports all common forms of endpoint management tooling, and has a robust series of management parameters and profiles to accurately scope the needs of a diverse user base. It has flexible operating modes and can control device traffic as a proxy, control device DNS traffic as a DNS proxy, or both. It is the most common method to send traffic from user devices to be filtered and decrypted by Cloudflare Gateway. ### PAC files (Enterprise only) Cloudflare supports filtering HTTP/S traffic sent via a PAC file on a user device. PAC files configured to send traffic to Cloudflare target a domain specific to your account tenant, and receive and process all URL traffic for that device that fits the proxy profile. PAC files are most commonly used in scenarios in which the device client is not appropriate or cannot be installed -- specifically Windows pre-2008 and Windows Server 2012, and devices which cannot install client software at all. ### Clientless Browser Isolation Cloudflare Browser Isolation runs a headless, Chromium-based browser for your users to accomplish their secure browsing needs. It can be activated via an Access application, a Gateway policy, or by using link-based isolation (reverse proxy). In this model, your users can connect from any device to a proxy website to browse the Internet while applying all your Gateway HTTP policies and inspection requirements. | | Cloudflare One Client | PAC Files | Clientless Browser Isolation | | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | -------------- | ------------------------------------- | | Supported OS | macOS, Windows, Linux, iOS, Android | All desktop OS | All OS (with HTML5 compliant browser) | | Configurable via MDM | Yes | Yes | N/A | | Gateway policy types supported | DNS, Network, HTTP, Resolver, Egress | HTTP | DNS, Network, HTTP, Resolver, Egress | | Identity-based policies supported | Yes | No | Yes | | [Network Session Logs](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/zero%5Ftrust%5Fnetwork%5Fsessions/) | Yes | Yes | Yes | ## Network on-ramps The primary ways to source multi-device or network traffic to Cloudflare Gateway are via Cloudflare WAN (formerly Magic WAN) using GRE or IPsec tunnels, via [Cloudflare Mesh](#cloudflare-mesh) as a software-defined all-ports traffic proxy, or via upstream DNS for a whole network using [DNS filtering locations](#dns-filtering-locations). ### Cloudflare WAN Note Only available on Enterprise plans. [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) is Cloudflare's offering most analogous to a traditional SD-WAN. Cloudflare WAN is typically deployed via an IPsec or GRE tunnel terminating on customer devices (such as firewalls or routers), or via our Cloudflare One Appliance hardware device. You can also deploy Cloudflare WAN using [Cloudflare Network Interconnect](https://edgetunnel-b2h.pages.dev/network-interconnect/) (CNI) at private peering locations or some public cloud instances (where compatible). Cloudflare WAN on-ramps traffic via your connections and can send all network and HTTP traffic through Cloudflare Gateway for inspection. For more information on how Cloudflare WAN integrates with Zero Trust, refer to [Zero Trust integration](https://edgetunnel-b2h.pages.dev/cloudflare-wan/zero-trust/). ### Cloudflare Mesh Beta [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) (formerly WARP Connector), a software agent similar to our device client, functions as a virtual device to establish a connection between your network and the Cloudflare global network. You can install Cloudflare Mesh on a dedicated Linux server or virtual machine. Cloudflare Mesh supports egressing traffic from your private network to the Internet as a gateway. This means it can allow traffic initiated from a network to be on-ramped to Cloudflare for either public or private destinations. You can use Cloudflare Mesh to establish a secure egress path for servers or users on a network which may not each be able to run the Cloudflare One Client and still apply Gateway network and HTTP inspection policies. This connection is most analogous to proxy server connectivity or site-to-site VPN. For more information on setting up Cloudflare Mesh, refer to [Set up Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/). ### DNS filtering locations DNS locations are a collection of DNS endpoints which can be mapped to physical entities such as offices, homes, or data centers. The fastest way to start filtering DNS queries from a location is by changing the DNS resolvers at the router or updating the upstream resolution to Cloudflare DNS resolution endpoints. This can also be accomplished from individual devices, or an network or subnet which sets resolver IPs for clients via DHCP. For more information on setting up DNS locations, refer to [Add locations](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/dns/locations/). | | Cloudflare WAN | Cloudflare Mesh | DNS Locations | | ------------------------------ | --------------------- | --------------------- | ------------- | | Gateway policy types supported | Network, HTTP, Egress | Network, HTTP, Egress | DNS, Resolver | ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/choose-on-ramp/#page","headline":"Choose an on-ramp · Cloudflare Learning Paths","description":"Select a device or network on-ramp.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/choose-on-ramp/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-24","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/","name":"Connect devices and networks to Cloudflare"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/choose-on-ramp/","name":"Choose an on-ramp"}}]} ``` --- --- title: Download and install the Cloudflare One Client description: Install the Cloudflare One device client. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Download and install the Cloudflare One Client Most admins test by manually downloading the Cloudflare One Client and enrolling in your organization's Cloudflare Zero Trust instance. ## Install the Cloudflare One Client 1. First, uninstall any existing third-party VPN software if possible. Sometimes products placed in a disconnected or disabled state will still interfere with the Cloudflare One Client. 2. If you are running third-party firewall or TLS decryption software, verify that it does not inspect or block traffic to the following destinations: * IPv4 API endpoints: `162.159.137.105` and `162.159.138.105` * IPv6 API endpoints: `2606:4700:7::a29f:8969` and `2606:4700:7::a29f:8a69` * SNIs for Cloudflare One Client version 2026.6.0 and later: `api.devices.cloudflare.com` * SNIs for versions earlier than 2026.6.0: `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` For more information, refer to [WARP with firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/). 3. Manually install the Cloudflare One Client on the device. Window, macOS, and Linux To enroll your device using the client GUI: * [ Version 2026.2+ ](#tab-panel-10139) * [ Version 2026.1 and earlier ](#tab-panel-10140) 1. [Download](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) and install the Cloudflare One Client. 2. Launch the Cloudflare One Client. 3. On the **What would you like to use the Cloudflare One Client for?** screen, select **Zero Trust security**. 4. Enter your team name. 5. Complete the authentication steps required by your organization. Once authenticated, you will see a Success page and a dialog prompting you to open the Cloudflare One Client. 6. Select **Open the Cloudflare One Client** to complete the registration. 1. [Download](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) and install the Cloudflare One Client. 2. Launch the Cloudflare One Client. 3. Select the Cloudflare logo in the menu bar. 4. Select the gear icon. 5. Go to **Preferences** \> **Account**. 6. Select **Login with Cloudflare Zero Trust**. 7. Enter your team name. 8. Complete the authentication steps required by your organization. Once authenticated, you will see a Success page and a dialog prompting you to open the Cloudflare One Client. 9. Select **Open Cloudflare WARP.app** to complete the registration. iOS, Android, and ChromeOS 1. [Download](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) and install the Cloudflare One Agent app. 2. Launch the Cloudflare One Agent app. 3. Select **Next**. 4. Review the privacy policy and select **Accept**. 5. Enter your team name. 6. Complete the authentication steps required by your organization. 7. After authenticating, select **Install VPN Profile**. 8. In the **Connection request** popup window, select **OK**. 9. If you did not enable [auto-connect ↗](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#auto-connect), manually turn on the switch to **Connected**. The Cloudflare One Client should show as **Connected**. The device is now connected to your organization and secured with Cloudflare Zero Trust. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent/#page","headline":"Download and install the Cloudflare One Client · Cloudflare Learning Paths","description":"Install the Cloudflare One device client.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/","name":"Connect devices and networks to Cloudflare"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent/","name":"Download and install the Cloudflare One Client"}}]} ``` --- --- title: MDM deployment description: Deploy the device client via MDM. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # MDM deployment Organizations can deploy and manage the Cloudflare One Client (formerly WARP) across their fleet of devices in two complementary ways: * **Through a mobility management solution (MDM)** — Push the client installer and its deployment parameters using a tool such as [Intune, JAMF, Kandji, or JumpCloud](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/), or by executing an `.msi` file on desktop machines. This page covers the MDM-driven workflow. * **From the Cloudflare dashboard** — Manage client versions for groups of devices directly from the Zero Trust dashboard, without relying on a third-party MDM solution. For more information, refer to [Client version assignments](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/). ## MDM policy file Refer to our [managed deployment instructions](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/) and create a `.plist`, `mdm.xml`, or `.msi` policy file based on your organization's software management tool. [MDM parameters](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/) that you specify in a local policy file will overrule any [device client settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) configured in the dashboard. Therefore, we recommend that your policy file only contain the organization name and potentially the onboarding flag, [relying on the dashboard](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles/) to configure the remaining device settings. ```xml organization your-team-name onboarding ``` 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) by going to **Zero Trust** \> **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) at any time. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/mdm/#page","headline":"MDM deployment · Cloudflare Learning Paths","description":"Deploy the device client via MDM.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/mdm/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/","name":"Connect devices and networks to Cloudflare"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/mdm/","name":"MDM deployment"}}]} ``` --- --- title: Verify device connectivity description: Verify devices connect through Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Verify device connectivity To validate that Cloudflare is receiving traffic from a user device: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Traffic settings**. 2. Under **Log traffic activity**, enable activity logging for all DNS logs. 3. On your device, open a browser and go to any website. 4. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Logs** \> **DNS**. 5. Make sure DNS queries from your device appear. ## Best practices Securing your organization with Zero Trust usually happens in two phases: the first phase is establishing connectivity, and the second phase is building policies for distinct applications. We recommend verifying that all connectivity is working as expected before moving on to build complex security policies. This will reduce the amount of troubleshooting and challenges that arise from managing complex systems. Troubleshoot the Cloudflare One Client For step-by-step guidance on diagnosing and resolving Cloudflare One Client issues, refer to the [Cloudflare One Client troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/). The guide covers: * How to collect diagnostic logs via the Cloudflare dashboard or CLI * How to review key configuration files * Common misconfigurations and their fixes * Best practices for filing support tickets ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/validate-traffic-in-gateway/#page","headline":"Verify device connectivity · Cloudflare Learning Paths","description":"Verify devices connect through Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/connect-devices-networks/validate-traffic-in-gateway/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/","name":"Connect devices and networks to Cloudflare"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/connect-devices-networks/validate-traffic-in-gateway/","name":"Verify device connectivity"}}]} ``` --- --- title: Get started with Zero Trust description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Get started with Zero Trust Start securing your users and networks with Cloudflare Zero Trust. ## Objectives By the end of this module, you will be able to: * Set up a Cloudflare account. * Create a Zero Trust organization to manage your devices and policies. * Configure an identity provider (IdP) for user authentication. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/#page","headline":"Get started with Zero Trust · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/","name":"Get started with Zero Trust"}}]} ``` --- --- title: Configure an identity provider description: Set up identity provider integration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure an identity provider An [identity provider (IdP)](https://www.cloudflare.com/learning/access-management/what-is-an-identity-provider/) stores and manages users' digital identities. You can integrate your existing identity provider with Cloudflare Zero Trust in order to manage user access to your private network. This requires configuration both in Cloudflare and with the identity provider itself. Note Some admins choose to test by authenticating with a [one-time PIN (OTP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) instead of an IdP. OTP can also be used as an alternative login method for contractors or other guests that are not part of your IdP. To add an identity provider: * [ Dashboard ](#tab-panel-10141) * [ Terraform (v5) ](#tab-panel-10142) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Integrations** \> **Identity providers**. 2. In the **Your identity providers** card, select **Add new identity provider**. 3. Select the identity provider you want to add. If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, select the [generic OIDC](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/) option. If they support SAML, select the [generic SAML](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration. 4. Fill in the necessary fields to set up your identity provider. Each identity provider will have different required fields for you to fill in. Step-by-step instructions are shown in the dashboard side panel. Alternatively, refer to the [IdP-specific documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/). 5. Once you have filled in the necessary fields, select **Save**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Organizations, Identity Providers, and Groups Write` 2. Add an identity provider to Cloudflare One using the [cloudflare\_zero\_trust\_access\_identity\_provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Faccess%5Fidentity%5Fprovider) resource. For example, to add a Microsoft Entra ID integration: ```tf resource "cloudflare_zero_trust_access_identity_provider" "microsoft_entra_id" { account_id = var.cloudflare_account_id name = "Entra ID example" type = "azureAD" config = { client_id = var.entra_id_client_id client_secret = var.entra_id_client_secret directory_id = var.entra_id_directory_id support_groups = true } } ``` Each identity provider integration has different required attributes. You will need to obtain these attribute values from your identity provider. For more information, refer to the [IdP-specific documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/). If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, use the [generic OIDC](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/) option. If they support SAML, use the [generic SAML](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration. Users will now be able to select this IdP when they are prompted to authenticate. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/configure-idp/#page","headline":"Configure an identity provider · Cloudflare Learning Paths","description":"Set up identity provider integration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/configure-idp/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/configure-idp/","name":"Configure an identity provider"}}]} ``` --- --- title: Create a Cloudflare account description: Sign up for a Cloudflare account. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Cloudflare account To create a new Cloudflare account: 1. [Sign up ↗](https://dash.cloudflare.com/sign-up) on the Cloudflare dashboard. 2. To secure your account, enable [two-factor authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/). 3. If you have a Cloudflare contact (Enterprise only), ask them to set up your account as a multi-user organization. Account members will need: * [**Access** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit applications and Access policies. * [**Gateway** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/) to read or edit Gateway policies. * [**PII** permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/roles-permissions/#cloudflare-zero-trust-pii) to view user information in Gateway activity logs. ## Best practices If you are creating an account for your team or a business, we recommend choosing an email alias or distribution list for your **Email**, such as `cloudflare@example.com`. This email address is the main point of contact for your Cloudflare billing, usage notifications, and account recovery. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/create-cloudflare-account/#page","headline":"Create a Cloudflare account · Cloudflare Learning Paths","description":"Sign up for a Cloudflare account.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/create-cloudflare-account/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/create-cloudflare-account/","name":"Create a Cloudflare account"}}]} ``` --- --- title: Create a Zero Trust organization description: Set up a Zero Trust organization. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a Zero Trust organization To start using Zero Trust features, create a Zero Trust organization in your Cloudflare account. ## Sign up for Zero Trust To create a Zero Trust organization: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) by going to **Zero Trust** \> **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/) at any time. ## (Optional) Manage Zero Trust in Terraform You can use the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest) to manage your Zero Trust organization alongside your other IT infrastructure. To get started with Terraform, refer to our [Terraform tutorial series](https://edgetunnel-b2h.pages.dev/terraform/tutorial/). To add Zero Trust to your Terraform configuration: 1. [Sign up for Zero Trust](#sign-up-for-zero-trust) on the Cloudflare dashboard. 2. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Access: Organizations, Identity Providers, and Groups Write` 3. Add the [cloudflare\_zero\_trust\_organization ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Forganization) resource: ```terraform resource "cloudflare_zero_trust_organization" "" { account_id = var.cloudflare_account_id name = "Acme Corporation" auth_domain = ".cloudflareaccess.com" } ``` Replace `` with the Zero Trust organization name selected during [onboarding](#sign-up-for-zero-trust). You can also view your team name in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) under **Zero Trust** \> **Settings** \> **Team name and domain**. You can now update Zero Trust organization settings using Terraform. Tip If you plan to manage all Zero Trust settings in Terraform, set the dashboard to [API/Terraform read-only mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/api-terraform/#set-dashboard-to-read-only). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/create-zero-trust-org/#page","headline":"Create a Zero Trust organization · Cloudflare Learning Paths","description":"Set up a Zero Trust organization.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/create-zero-trust-org/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/create-zero-trust-org/","name":"Create a Zero Trust organization"}}]} ``` --- --- title: Prerequisites description: Review requirements before getting started. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Prerequisites To make the most of securing your Internet traffic and SaaS apps, make sure that you have the following: * A device that can run [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/), Cloudflare's endpoint agent. * (Optional) A [Linux host server](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/#linux) on the private network that can run Cloudflare Mesh, a software agent similar to the Cloudflare One Client. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/prerequisites/#page","headline":"Prerequisites · Cloudflare Learning Paths","description":"Review requirements before getting started.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/initial-setup/prerequisites/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/","name":"Get started with Zero Trust"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/initial-setup/prerequisites/","name":"Prerequisites"}}]} ``` --- --- title: Secure SaaS applications description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Secure SaaS applications Now that you have deployed dedicated egress IPs and created egress policies to anchor your source IPs, you can integrate Cloudflare with your SSO provider and secure your SaaS applications. ## Objectives By the end of this module, you will be able to: * Secure your SaaS applications by integrating them with Cloudflare CASB. * Control access to your SSO front door. * Layer multiple security methods for protecting SaaS apps. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/#page","headline":"Secure SaaS applications · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/","name":"Secure SaaS applications"}}]} ``` --- --- title: Scan SaaS applications with Cloudflare CASB description: Detect SaaS misconfigurations with CASB scans. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Scan SaaS applications with Cloudflare CASB Note Only available on Enterprise plans. Cloudflare CASB provides comprehensive visibility and control over SaaS apps to prevent data leaks and compliance violations. It helps detect insider threats, shadow IT, risky data sharing, and bad actors. Cloudflare's API-implemented CASB addresses the final, common security concern for administrators of SaaS applications or security organizations: How can I get insights into the existing configurations of my SaaS tools and proactively address issues before there is an incident? CASB integrates with a number of leading SaaS applications and surfaces instant security insights related to misconfiguration and potential for data loss. CASB also powers [risk score heuristics](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/risk-score/) organized by severity. For more information on Cloudflare CASB, including available SaaS integrations, refer to [Scan SaaS applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/). ## Manage CASB integrations When you integrate a third-party SaaS application or cloud environment with Cloudflare CASB, you allow CASB to make API calls to its endpoint and read relevant data on your behalf. The CASB integration permissions are read-only and follow the least privileged model. In other words, only the minimum access required to perform a scan is granted. ### Prerequisites Before you can integrate a SaaS application or cloud environment with CASB, your account with that integration must meet certain requirements. Refer to the SaaS application or cloud environment's [integration guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/) to learn more about the prerequisites and permissions. ### Add an integration 1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** \> **Integrations**. 2. Select **Connect an integration** or **Add integration**. 3. Browse the available integrations and select the application you would like to add. 4. Follow the step-by-step integration instructions in the UI. 5. To run your first scan, select **Save integration**. After the first scan, CASB will automatically scan your SaaS application or cloud environment on a frequent basis to keep up with any changes. Scan intervals will vary due to each application having their own set of requirements, but the frequency is typically between every 1 hour and every 24 hours. Once CASB detects at least one finding, you can [view and manage your findings](https://edgetunnel-b2h.pages.dev/cloudflare-one/cloud-and-saas-findings/manage-findings/). ### Pause an integration 1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** \> **Integrations**. 2. Find the integration you would like to pause and select **Configure**. 3. To stop scanning the application, turn off **Scan for findings**. 4. Select **Save integration**. You can resume CASB scanning at any time by turning on **Scan for findings**. ### Delete an integration Warning When you delete an integration, all keys and OAuth data will be deleted. This means you cannot restore a deleted integration or its scanned data. 1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** \> **Integrations**. 2. Find the integration you would like to delete and select **Configure**. 3. Select **Disenroll**. To resume scanning the integration for findings, you will need to [add the integration](#add-an-integration) again. ### Integrate DLP policies If you use both Cloudflare CASB and Cloudflare Data Loss Prevention (DLP), you can use DLP to discover if files stored in your SaaS application contain sensitive data. CASB integrations supported by DLP include: * [Amazon Web Services (AWS) S3](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/aws-s3/) * [Box](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/box/) * [Dropbox](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/dropbox/) * [Google Cloud Platform (GCP) Cloud Storage](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/gcp-cloud-storage) * [Google Drive](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/google-workspace/google-drive/) * [Microsoft OneDrive](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/microsoft-365/onedrive/) * [Microsoft SharePoint](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/microsoft-365/sharepoint/) * [Microsoft 365 Copilot](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/microsoft-365/m365-copilot/) * [OpenAI](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/openai/) * [Anthropic](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/anthropic/) For more information, refer to [Scan SaaS applications with DLP](https://edgetunnel-b2h.pages.dev/cloudflare-one/cloud-and-saas-findings/casb-dlp/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/configure-casb/#page","headline":"Scan SaaS applications with Cloudflare CASB · Cloudflare Learning Paths","description":"Detect SaaS misconfigurations with CASB scans.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/configure-casb/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/","name":"Secure SaaS applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/configure-casb/","name":"Scan SaaS applications with Cloudflare CASB"}}]} ``` --- --- title: Layer security methods description: Combine device posture and browser isolation. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Layer security methods Once you have decided on a model (or mixture of models) to secure front door access to your SaaS applications, you can address other common SaaS security areas of concern by layering multiple Cloudflare controls. ## Device posture controls for managed endpoints You can control endpoint access to your SaaS applications with device posture controls via either [Access for SaaS](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/sso-front-door/) or [WARP enrollment settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/) in Zero Trust. Device posture can determine what constitutes a managed endpoint accessing a SaaS application. You can also define what constitutes a healthy or semi-healthy managed endpoint and invoke step-up security policies based on potential security concerns. These controls are separate from the controls enacted for unmanaged endpoints. ## Inline security for unmanaged endpoints For unmanaged endpoints, you can deliver selective inline security like upload/download controls, HTTP filtering, and data loss detection/prevention policies in SaaS applications without the need to install agents. You can deliver inline security through Browser Isolation, but it requires a [front door control](https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/sso-front-door/) (such as Access for SaaS) in order to be applied consistently. ## Browser Isolation Cloudflare can deliver isolate SaaS apps in via either the Cloudflare One Client or static links with Clientless Web Isolation. ### Cloudflare One Client When your users' devices are enrolled with the Cloudflare One Client, Cloudflare will transparently isolate browser sessions. In other words, a user's browser will display `example.com`, but Cloudflare will isolate the traffic by rendering it in an isolated browser. ### Clientless Web Isolation With [Clientless Web Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/), Cloudflare will append a static link to the web address. For example, a user's browser going to `example.com` in an isolated session will display `.cloudflareaccess.com/browser/https://www.example.com`. When Browser Isolation isolates traffic, Cloudflare can apply the security stack of TLS decryption, HTTP inspection, network inspection, DNS filtering, and DLP policy evaluation to the traffic in the request body. This provides a solution for securing unmanaged endpoint access to sensitive systems and can potentially upgrade traffic from users or services that may have otherwise been deemed as risky. Any method for Browser Isolation attaches the user to your dedicated egress IP addresses so you can apply policies across each method of access consistently. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/layer-security/#page","headline":"Layer security methods · Cloudflare Learning Paths","description":"Combine device posture and browser isolation.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/layer-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/","name":"Secure SaaS applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/layer-security/","name":"Layer security methods"}}]} ``` --- --- title: SaaS security overview description: Understand SaaS application security layers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # SaaS security overview The concept of SaaS (software-as-a-service) security is top of mind for many security organizations but is not explicitly defined. When organizations approach Cloudflare for help securing their SaaS apps, it can mean a number of different things with a number of ideal outcomes. Cloudflare distills SaaS security into three key concepts: 1. Better protection for the front door of your SaaS applications with considerations for both managed and unmanaged endpoint access. 2. Assurances for the ability to apply inline security tooling. In other words, we ensure the ability to apply restrictions on file uploads/downloads, the ability to access administrative targets, and the application of policies to prevent or detect data loss. Managing distinct policies for hundreds (on average) of SaaS apps means inline security will always meaningfully drift. 3. Visibility and control for your critical SaaS applications whether or not users are actively engaging with them (also known as out-of-band). This concept becomes most critical when you have limited ability to apply inline policy using TLS inspection and other methods. Cloudflare offers multiple solutions that achieve and sometimes overlap with all three of the defined concepts. Through combinations of Access for SaaS identity proxy, WARP with dedicated IP addresses, Browser Isolation, and CASB API, Cloudflare helps define and address any potential SaaS security goals. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/saas-security-overview/#page","headline":"SaaS security overview · Cloudflare Learning Paths","description":"Understand SaaS application security layers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/saas-security-overview/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/","name":"Secure SaaS applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/saas-security-overview/","name":"SaaS security overview"}}]} ``` --- --- title: Single sign-on front door controls description: Protect SaaS apps with Access for SaaS. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Single sign-on front door controls [Access for SaaS](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/saas-apps/) functions as an identity proxy to add an additional authentication layer to your SaaS apps. Access for SaaS integrates directly with your SaaS app using standard protocols (such as SAML) to become the primary enforcement point for user access. Access calls your identity provider (IdP) of choice and uses additional security signals about your users and devices to make policy decisions. Benefits of Access for SaaS include: * A streamlined experience for users on both managed and unmanaged devices. * Application of baseline policies requiring specific concepts such as device posture and endpoint control. * Distinct access methodology for contractors. * Flexibility to configure multiple SSO vendors simultaneously, freely switch between SSO vendors, and reduce reliance on a single vendor. ### SSO integrations You can pair Access for SaaS with the [App Launcher](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/app-launcher/) to provide a full replacement to your organization's front door. SCIM provisioning limitation Access for SaaS supports SCIM passthrough in an API-only closed beta. If you require SCIM passthrough, contact your account team. ## Configure your SSO provider If you cannot use Access for SaaS for some or all of your SaaS apps, you can accomplish most of the same outcomes through a combination of strong security controls on your managed devices and your [Clientless Web Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) implementation. You can use your existing SSO provider to enforce a strong relationship between Cloudflare and your SaaS applications. ### Policies based on dedicated egress IPs With [dedicated egress IPs](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/dedicated-egress-ips/), you can set explicit egress locations globally and share these IPs with your SSO provider. With this Zero Trust security approach, your users must meet all of your Cloudflare requirements (such as being enrolled in the Cloudflare One Client or Browser Isolation) when they authenticate to your SSO provider. Using your dedicated egress IPs as a control mechanism within your SSO means you can set policies on the basis of which users are subject to security policy and inspection because they are guaranteed to be proxied through Cloudflare. ### Generic IdP multi-factor authentication Similar to the dedicated egress IP option, many IdPs support a generic multi-factor authentication (MFA) method. You can use your IdP's generic MFA in conjunction with Cloudflare security policies to make your second factor a Cloudflare Access policy. This policy can check all of the security signals available in Access for SaaS. This method delivers user traffic data to Cloudflare and ensures that users cannot access SaaS applications without first being subject to granular security policy. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/sso-front-door/#page","headline":"Single sign-on front door controls · Cloudflare Learning Paths","description":"Protect SaaS apps with Access for SaaS.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/secure-saas-applications/sso-front-door/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"},"keywords":["SSO"]} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/","name":"Secure SaaS applications"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/secure-saas-applications/sso-front-door/","name":"Single sign-on front door controls"}}]} ``` --- --- title: Understand and streamline policy creation description: Secure Internet traffic and SaaS apps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Understand and streamline policy creation Before you begin building security policies, there are a few key details about Gateway to review. The next few modules will cover the breadth of types of policies and actions that can be accomplished by sending traffic through the Cloudflare Gateway inspection engine. This implementation guide assumes that your goals are to block threat actors from using attack vectors on your user base (such as malware, complex phishing attempts, and credential theft), as well as detection and prevention of threats to your corporate data (data loss prevention). These security threats may take internal and external forms. Separately, we will detail building threat prevention that uses our Remote Browser Isolation technology to maximally reduce the theoretical attack surface for your users. This guide will provide you with a baseline of recommended policies to build and address common questions about policy building and accomplishing explicit outcomes. ## Objectives By the end of this module, you will be able to: * Understand the order Gateway enforces policies for filtering traffic. * Create reusable lists for Gateway policies. * Subscribe to indicator feeds for advanced threat intelligence. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/#page","headline":"Understand and streamline policy creation · Cloudflare Learning Paths","description":"Secure Internet traffic and SaaS apps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/","name":"Understand and streamline policy creation"}}]} ``` --- --- title: Create a list of IPs or domains description: Build reusable IP and domain lists. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create a list of IPs or domains Gateway supports creating [lists](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/) of IPs, hostnames, or other entries to reference in your policies. It is likely that you will be onboarding to the Cloudflare platform with some predetermined series of security policies. Maybe you have explicit deny lists based on hostnames, IPs, or another measure that tie to individual users. Maybe some networks can access certain apex records while others cannot. The best way to migrate to Cloudflare in a way that will simplify ongoing maintenance is to build as many reusable objects as possible. Not only because that makes policy building simpler, but because as those applications, networks, and services organically change and grow, updates to the lists automatically update everywhere that the lists are applied. ## Create a list from a CSV file To test uploading CSV lists, you can download a [sample CSV file](https://edgetunnel-b2h.pages.dev/cloudflare-one/static/list-test.csv) of IP address ranges or copy the following into a file: **list-test.csv** ```csv value,description 192.0.2.0/24,This is an IP address range in CIDR format 198.51.100.0/24,This is also an IP address range 203.0.113.0/24,This is the third IP address range ``` When you format a CSV file for upload: * Each line should be a single entry that includes a value and an optional description. * A header row must be present for Zero Trust to recognize descriptions. * Trailing whitespace characters are not allowed. * CRLF (Windows) and LF (Unix) line endings are valid. To upload the list to the Cloudflare dashboard: * [ Dashboard ](#tab-panel-10143) * [ Terraform (v5) ](#tab-panel-10144) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Lists**. 2. Select **Upload CSV**. 3. Next, specify a **List name**, enter an optional description, and choose a **List type**. 4. Drag and drop a file into the **CSV file** window, or select a file. 5. Select **Create**. 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Decode the contents of the CSV file and store it as a local value: ```tf locals { ip_list = csvdecode(file("${path.module}/list-test.csv")) } ``` 3. Create a list using the [cloudflare\_zero\_trust\_list ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Flist) resource: ```tf resource "cloudflare_zero_trust_list" "ips_from_csv" { account_id = var.cloudflare_account_id name = "IPs imported from CSV" description = "Managed by Terraform" type = "IP" items = local.ip_list } ``` You can now use this list in the policy builder by choosing the _in list_ operator. ## Create a list manually * [ Dashboard ](#tab-panel-10145) * [ API ](#tab-panel-10146) * [ Terraform (v5) ](#tab-panel-10147) 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Reusable components** \> **Lists**. 2. Select **Create manual list**. 3. Next, specify a **List name**, enter an optional description, and choose a **List type**. 4. Enter your list element manually into the **Add entry** field and select **Add**. 5. Select **Save**. **Create Zero Trust list** ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/lists" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "description": "Private application IPs", "items": [ { "value": "10.226.0.177/32" }, { "value": "10.226.1.177/32" } ], "name": "Corporate IP list", "type": "IP" }' ``` 1. Add the following permission to your [cloudflare\_api\_token ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api%5Ftoken): * `Zero Trust Write` 2. Create a list using the [cloudflare\_zero\_trust\_list ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Flist) resource. Example list of IPs: ```tf resource "cloudflare_zero_trust_list" "wiki_IPs" { account_id = var.cloudflare_account_id name = "Company Wiki IP addresses" description = "Managed by Terraform" type = "IP" items = [ { description = "Example IP address range" value = "192.0.2.0/24", }, { value = "198.51.100.0/24" } ] } ``` Example list of domains: ```tf resource "cloudflare_zero_trust_list" "wiki_domains" { account_id = var.cloudflare_account_id name = "Company Wiki Domains" description = "Managed by Terraform" type = "DOMAIN" items = [ { value = "wiki.example.com" }, { value = "wiki2.example.com" }] } ``` You can now use this list in the policy builder by choosing the _in list_ operator. Create lists in advance Before moving on to create security policies, we recommend you create lists for your known domains, hosts, and IP addresses. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/create-list/#page","headline":"Create a list of IPs or domains · Cloudflare Learning Paths","description":"Build reusable IP and domain lists.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/create-list/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/","name":"Understand and streamline policy creation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/create-list/","name":"Create a list of IPs or domains"}}]} ``` --- --- title: Use indicator feeds to improve security policies description: Enhance policies with threat indicator feeds. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use indicator feeds to improve security policies When building DNS, network, or HTTP policies to block malicious activity for your organization, you can use external indicator feeds supplied by Cloudflare and other third-party providers. ## Subscribe to indicator feeds Cloudflare threat intelligence data consists of a data exchange between providers and subscribers. A provider is an organization that has a set of data that they are interested in sharing with other Cloudflare organizations. Any organization can be a provider. Examples of current providers are Government Cyber Defense groups. Subscribers can be any Cloudflare customer that wants to secure their environment further by creating rules based on provider datasets. Subscribers must be authorized by a provider. Authorization is granted using the [Grant permission to indicator feed endpoint](https://edgetunnel-b2h.pages.dev/api/resources/intel/subresources/indicator%5Ffeeds/subresources/permissions/methods/create/). To subscribe to an indicator feed, contact your account team. For more information, refer to [Custom Indicator Feeds](https://edgetunnel-b2h.pages.dev/security-center/indicator-feeds/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/indicator-feeds/#page","headline":"Use indicator feeds to improve security policies · Cloudflare Learning Paths","description":"Enhance policies with threat indicator feeds.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/indicator-feeds/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/","name":"Understand and streamline policy creation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/indicator-feeds/","name":"Use indicator feeds to improve security policies"}}]} ``` --- --- title: Order of enforcement description: Understand Gateway policy enforcement order. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Order of enforcement Gateway follows a specific order of enforcement as traffic travels through the Cloudflare global network to the Internet: flowchart TB %% Accessibility accTitle: Gateway order of enforcement accDescr: Flowchart describing the order of enforcement for Gateway policies. subgraph Resolution["Resolution"] dns2["1.1.1.1"] dns4["Custom resolver"] dns3["Resolver policies
(Enterprise users only)"] internal["Internal DNS"] end subgraph DNS["DNS"] dns1["DNS policies"] Resolution end subgraph HTTP["HTTP policies"] http1{{"Do Not Inspect policies"}} http2["Isolate policies
(with Browser Isolation add-on)"] http3["Allow, Block, Do Not Scan, Quarantine, and Redirect policies, DLP, and anti-virus scanning"] https["HTTP or HTTPS?"] end subgraph Proxy["Proxy"] HTTP network1["Network policies"] nonhttp["Non-HTTP(S) traffic"] end subgraph Egress["Egress"] egress1["Egress policies
(Enterprise users only)"] end start(["Traffic"]) --> dns0[/"DNS query"/] & http0["Network connections"] dns0 ----> dns1 dns1 -- Resolved by --> dns2 dns1 --> dns3 dns3 -- Resolved by --> dns4 dns2 -----> internet(["Internet"]) dns4 -----> internet dns4 ---> cloudflare["Private network services
(Cloudflare Tunnel, Cloudflare WAN, Cloudflare Mesh)"] http1 -- Do Not Inspect --> internet http1 -- Inspect --> http2 http2 --> http3 http0 --> magic["Cloudflare Network Firewall (Enterprise users only)"] magic --> egress1 egress1 --> tcp["Check for origin availability (TCP SYN)"] tcp --> network1 http3 --> internet https -- HTTPS --> http1 https -- HTTP --> http2 network1 --> https & nonhttp dns3 -- Resolved by --> internal & dns2 nonhttp -----> internet https@{ shape: hex} http0@{ shape: lean-r} Order of enforcement change on 2025-07-14 On 2025-07-14, Gateway began evaluating network-level policies before application-level policies and verify the network path to an origin server before accepting a connection. This only affects your policies if you are applying HTTP policies in your account. For example: Comparison of old and new order of enforcement | | Old order of enforcement | New order of enforcement | | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | **Network Block policy and HTTP Block policy** | Gateway blocks traffic and displays the block page and/or follows the client notification settings on the HTTP policy. | Gateway blocks traffic. Gateway does not display the block page but will follow the client notification settings on the Network policy. | | **Network Allow policy and HTTP Block policy** | Gateway blocks traffic and displays the block page and follows the client notification settings on the HTTP policy. | No change. | | **Network Block policy and HTTP Allow policy** | Gateway blocks traffic and follows the client notification settings on the Network policy. | No change. | ## Connection establishment When a user connects to a server with Gateway, Gateway first establishes a TCP connection with the destination server on the port the user requested. Because TCP traffic is proxied by Cloudflare, the connection Gateway establishes with the origin is independent from the connection users establish with Gateway. This means Gateway assigns a new source IP and port to the user's connection and no details from the user's TCP handshake are included in the TCP handshake with the origin server. If the TCP connection to the destination server is successful, Gateway will apply policies. If Gateway policies allow the connection, Gateway will connect the user to the destination server. If Gateway policies block the connection, Gateway will end the connection and will not send any data between the user and the destination server. If the TCP connection to the destination server is unsuccessful, Gateway will not run any policies and retry TCP connections from the user to the server. flowchart TD %% Accessibility accTitle: How Gateway proxy works accDescr: Flowchart describing how the Gateway proxy uses the Happy Eyeballs algorithm to establish TCP connections and proxy user traffic. %% Flowchart A[User's device sends TCP SYN to Gateway] --> B[Gateway sends TCP SYN to origin server] B --> C{{Origin server responds with TCP SYN-ACK?}} C -->|Yes| E[TCP handshakes completed] C -->|No| D[Connection fails] E --> F{{Connection allowed?}} F -->|Allow policy| G[Gateway proxies traffic bidirectionally] F -->|Block policy| H[Connection blocked by firewall policies] %% Styling style D stroke:#D50000 style G stroke:#00C853 style H stroke:#D50000 Connections to Zero Trust will always appear in your [Zero Trust network session logs](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/zero%5Ftrust%5Fnetwork%5Fsessions/) regardless of connection success. Because Gateway does not inspect failed connections, they will not appear in your [Gateway activity logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). ### Filter TCP SYN packets with Cloudflare Network Firewall Because Gateway sends a TCP SYN to the destination server before evaluating policies, Gateway Network or HTTP Block policies do not prevent the initial TCP SYN from reaching the destination server. If you need to prevent TCP SYN packets from being sent to specific destination IP addresses, you can create a [Cloudflare Network Firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/packet-filtering/) rule to block traffic at the packet level. As shown in the [enforcement flowchart](#order-of-enforcement), Cloudflare Network Firewall evaluates traffic before Gateway checks for origin availability. Note Cloudflare Network Firewall is available to Enterprise users only. To block TCP SYN packets to a specific destination: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Firewall policies** \> **Custom policies**. 2. Select **Add a policy**. 3. Create a rule with the destination IP address or CIDR range you want to block. For example, to block all traffic to `10.0.0.0/8`, use the expression `ip.dst in {10.0.0.0/8}` with a **Block** action. 4. Select **Add new policy**. For more information on creating packet filtering rules, refer to [Add policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/packet-filtering/add-policies/). ## Priority between policy builders Gateway applies your policies in the following order: 1. DNS policies with selectors evaluated before resolution 2. Resolver policies (if applicable) 3. DNS policies with selectors evaluated after resolution 4. Egress policies (if applicable) 5. Network policies 6. HTTP policies DNS and resolver policies are standalone. For example, if you block a site with a DNS policy but do not create a corresponding HTTP policy, users can still access the site if they know its IP address. ### HTTP/3 traffic For proxied [HTTP/3 traffic](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/http3/), Gateway applies your policies in the following order: 1. DNS policies 2. Network policies 3. HTTP policies ## Priority within a policy builder ### DNS policies Gateway evaluates DNS policies first in order of DNS resolution, then in [order of precedence](#order-of-precedence). When DNS queries are received, Gateway evaluates policies with pre-resolution selectors, resolves the DNS query, then evaluates policies with post-resolution selectors. This means policies with selectors evaluated before DNS resolution take precedence. For example, the following set of policies will block `example.com`: | Precedence | Selector | Operator | Value | Action | | ---------- | ------------------------------- | -------- | ------------- | ------ | | 1 | Resolved Country IP Geolocation | is | United States | Allow | | 2 | Domain | is | example.com | Block | Despite an explicit Allow policy ordered first, policy 2 takes precedence because the _Domain_ selector is evaluated before DNS resolution. If a policy contains both pre-resolution and post-resolution selectors, Gateway will evaluate the entire policy after DNS resolution. For information on when each selector is evaluated, refer to the [list of DNS selectors](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/#selectors). ### Network policies Gateway evaluates network policies in [order of precedence](#order-of-precedence). ### HTTP policies Gateway applies HTTP policies based on a combination of [action type](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/#actions) and [order of precedence](#order-of-precedence): 1. All Do Not Inspect policies are evaluated first, in order of precedence. 2. If no policies match, all Isolate policies are evaluated in order of precedence. 3. All Allow, Block and Do Not Scan policies are evaluated in order of precedence. 4. The body of the HTTP request, including Data Loss Prevention (DLP), AV scanning, and file sandboxing, is evaluated. This order of enforcement allows Gateway to first determine whether decryption should occur. If a site matches a Do Not Inspect policy, it is automatically allowed through Gateway and bypasses all other HTTP policies. Note The only exception is if you are using [Clientless Web Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) — all sites within the clientless remote browser are implicitly isolated even if they match a Do Not Inspect policy. Next, Gateway checks decrypted traffic against your Isolate policies. When a user makes a request which triggers an Isolate policy, the request will be rerouted to a [remote browser](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/). Next, Gateway evaluates all Allow, Block, and Do Not Scan policies. These policies apply to both isolated and non-isolated traffic. For example, if `example.com` is isolated and `example.com/subpage` is blocked, Gateway will block the subpage (`example.com/subpage`) inside of the remote browser. Lastly, Gateway inspects the body of the HTTP request by evaluating it against DLP policies, and running anti-virus scanning and file sandboxing. If DLP Block policies are present, the action Gateway ultimately takes may not match the action it initially logs. For more information, refer to [DLP policy precedence](#dlp-policy-precedence). ### Resolver policies When [resolver policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/) are present, Gateway first evaluates any DNS policies with pre-resolution selectors, then routes any DNS queries according to the [order of precedence](#order-of-precedence) of your resolver policies, and lastly evaluates any DNS policies with post-resolution selectors. ### Default behavior when no policy matches If traffic does not match any explicit Allow or Block policy, Gateway applies the following defaults: | Policy type | Default action | Description | | ----------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DNS | Allow | DNS queries resolve normally through the configured resolver. | | Network | Allow | TCP and UDP connections are allowed through the Gateway proxy. | | HTTP | Allow | HTTP and HTTPS requests are allowed. However, if you have configured a default Block action in your [HTTP policy settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/), unmatched traffic is blocked instead. | Because the default is to allow unmatched traffic, Gateway follows a permissive model. To switch to a restrictive model (block by default, allow by exception), create a catch-all Block policy at the lowest precedence in the relevant policy builder and add specific Allow policies above it. Note Do Not Inspect policies are evaluated before all other HTTP policies. If traffic matches a Do Not Inspect policy, it bypasses all remaining HTTP policies and is allowed through Gateway. For details, refer to [HTTP policy priority](#http-policies). ### Order of precedence Order of precedence refers to the priority of individual policies within the DNS, network, or HTTP policy builder. Gateway evaluates policies in ascending order beginning with the lowest value. The order of precedence follows the first match principle. Once traffic matches an Allow or Block policy, evaluation stops and no subsequent policies can override the decision. Therefore, Cloudflare recommends assigning the most specific policies and exceptions with the highest precedence and the most general policies with the lowest precedence. #### Cloudflare dashboard In the Cloudflare dashboard, policies are in order of precedence from top to bottom of the list. Policies begin with precedence `1` and count upward. You can modify the order of precedence by dragging and dropping individual policies in the dashboard. #### Cloudflare API To update the precedence of a policy with the Cloudflare API, use the [Update a Zero Trust Gateway rule](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/rules/methods/update/) endpoint to update the `precedence` field. #### DLP policy precedence For Gateway configurations with DLP policies, Gateway will filter and log traffic based on first match, then scan the body of the HTTP request for matching content. Because of the first match principle, Gateway may perform and log a decision for traffic, then perform a contradicting decision. For example, if traffic is first allowed with an Allow HTTP policy, then blocked with a DLP Block policy, Gateway will log the initial Allow action despite ultimately blocking the request. #### Access applications If Gateway traffic is headed to a private IP address protected as an Access application, that traffic will still be evaluated by the destination application's Access policies, even if a Gateway Allow policy matched first. Gateway Block policies that match traffic will terminate any other policy evaluation. This is expected behavior. A Gateway Allow policy does not override or bypass Access policies. Terraform provider v4 precedence limitation To avoid conflicts, version 4 of the Terraform Cloudflare provider applies a hash calculation to policy precedence. For example, a precedence of `1000` may become `1000901`. This can cause errors when reordering policies. To avoid this issue, manually set the precedence of policies created with Terraform using the [Update a Zero Trust Gateway rule](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/rules/methods/update/) endpoint. To ensure your precedence is set correctly, Cloudflare recommends [upgrading your Terraform provider to version 5 ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-upgrade). ## Example Suppose you have a list of policies arranged in the following order of precedence: * DNS policies: | Precedence | Selector | Operator | Value | Action | | ---------- | -------- | ------------- | ---------------- | ------ | | 1 | Host | is | example.com | Block | | 2 | Host | is | test.example.com | Allow | | 3 | Domain | matches regex | .\\ | Block | * HTTP policies: | Precedence | Selector | Operator | Value | Action | | ---------- | -------- | -------- | ----------------- | -------------- | | 1 | Host | is | example.com | Block | | 2 | Host | is | test2.example.com | Do Not Inspect | * Network policies: | Precedence | Selector | Operator | Value | Action | | ---------- | ---------------- | -------- | ---------------- | ------ | | 1 | Destination Port | is | 80 | Block | | 2 | Destination port | is | 443 | Allow | | 3 | SNI Domain | is | test.example.com | Block | When a user goes to `https://test.example.com`, Gateway performs the following operations: 1. Evaluate DNS request against DNS policies: 1. Policy #1 does not match `test.example.com` — move on to check Policy #2. 2. Policy #2 matches, so DNS resolution is allowed. 3. Policy #3 is not evaluated because there has already been an explicit match. 2. Evaluate HTTPS request against network policies: 1. Policy #1 does not match because port 80 is used for standard HTTP, not HTTPS. 2. Policy #2 matches, so the request is allowed and proxied to the upstream server. 3. Policy #3 is not evaluated because there has already been an explicit match. 3. Evaluate HTTPS request against HTTP policies: 1. Policy #2 is evaluated first because Do Not Inspect [always takes precedence](#http-policies) over Allow and Block. Since there is no match, move on to check Policy #1. 2. Policy #1 does not match `test.example.com`. Since there are no matching Block policies, the request passes the HTTP filter. Therefore, the user is able to connect to `https://test.example.com`. ## Precedence calculations When arranging policies in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), Gateway automatically calculates the precedence for rearranged policies. When using the API to create a policy, unless the precedence is explicitly defined in the policy, Gateway will assign precedence to policies starting at `1000`. Every time a new policy is added to the bottom of the order, Gateway will calculate the current highest precedence in the account and add a random integer between 1 and 100 to `1000` so that it now claims the maximum precedence in the account. To manually update a policy's precedence, use the [Update a Zero Trust Gateway rule](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/gateway/subresources/rules/methods/update/) endpoint. You can set a policy's precedence to any value that is not already in use. Changing the order within the Cloudflare dashboard or API may result in configuration issues when using [Terraform](#manage-precedence-with-terraform). ## Manage precedence with Terraform You can manage the order of execution of your Gateway policies using Terraform. With version 5 of the Terraform Cloudflare provider, Gateway users can list their policies in a Terraform file with any desired integer precedence value. Cloudflare recommends starting with a precedence of `1000` and adding extra space between each policy's precedence for any future policies. For example: ```tf resource "cloudflare_zero_trust_gateway_policy" "policy_1" { account_id = var.cloudflare_account_id # other attributes... precedence = 1000 } resource "cloudflare_zero_trust_gateway_policy" "policy_2" { account_id = var.cloudflare_account_id # other attributes... precedence = 2000 } resource "cloudflare_zero_trust_gateway_policy" "policy_3" { account_id = var.cloudflare_account_id # other attributes... precedence = 3000 } ``` To avoid precedence calculation errors when reordering policies with Terraform, you should move one policy at a time before running `terraform plan` and `terraform apply`. If you use both Terraform and the Cloudflare dashboard or API, sync your polices with `terraform refresh` before reordering policies in Terraform. Alternatively, you can set your account to [read-only in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/cloudflare-one/api-terraform/#set-dashboard-to-read-only), only allowing changes using the API or Terraform. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#page","headline":"Order of enforcement · Cloudflare Learning Paths","description":"Understand Gateway policy enforcement order.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/","name":"Understand and streamline policy creation"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/","name":"Order of enforcement"}}]} ``` --- --- title: Concepts description: Protect your organization from email phishing attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts Review the concepts behind Cloudflare's Email security. ## Objectives By the end of this module, you will be able to: * Explain how Cloudflare works. * Describe what Email security is. * Understand how Cloudflare prevents email-based phishing attacks. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Protect your organization from email phishing attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/concepts/","name":"Concepts"}}]} ``` --- --- title: How Cloudflare prevents email-based phishing attacks description: Detect phishing with AI and ML models. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # How Cloudflare prevents email-based phishing attacks Cloudflare Email security uses a variety of factors to determine whether a given email message attachment, URL, or specific network traffic is part of a phishing campaign. These small pattern assessments are dynamic in nature. Cloudflare's automated systems use a combination of factors to clearly distinguish between a valid phishing campaign and benign traffic. Cloudflare's vast global network detects emergent campaign infrastructure and aggregates data for Cloudflare's proprietary analytics engine SPARSE. SPARSE uses AI and ML models to make effective detections for all types of malicious emails, including Business Email Compromise (BEC). In a BEC attack, the attacker falsifies an email message to trick the victim into performing some action - most often transferring money to an account or location the attacker controls. To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare analyzes the email thread, content, sentiment and context via message lexical analysis, subject analysis and sender analysis. Display names are also compared with known executive names for similarity using several matching models. Refer to [How we detect phish](https://edgetunnel-b2h.pages.dev/email-security/reference/how-we-detect-phish/#sample-attack-types-and-detections) to learn more about additional attack types and detections. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/prevent-phishing-attack/#page","headline":"How Cloudflare prevents email-based phishing attacks · Cloudflare Learning Paths","description":"Detect phishing with AI and ML models.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/prevent-phishing-attack/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/concepts/prevent-phishing-attack/","name":"How Cloudflare prevents email-based phishing attacks"}}]} ``` --- --- title: Protect your organization from phishing attacks description: Deploy modern email security beyond SEGs. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Protect your organization from phishing attacks In the early 2000s, Secure Email Gateways (SEGs) were introduced to deal with a growing need around the routing and filtering of email. While SEGs were successful at their mission for many years, their fundamental design has made it impossible for them to keep pace as phishing threats rapidly grow in scope and sophistication. Continuously updating manual rulesets and policies that were originally built for on-prem servers only inflates the amount of time and effort involved in maintaining a SEG. This has resulted in an increase in cost and complexity while still falling short of catching the most dangerous threats, such as business email compromise (BEC) attacks. As organizations continue to adopt Microsoft 365 and Google Workspace to enhance communication and collaboration for their hybrid workforce, it is crucial to take advantage of their security features while integrating complementary, machine learning-based solutions to automatically block and isolate the most dangerous threats. This strategy not only significantly reduces phishing risk, but also simplifies workflows, minimizing the time and effort needed for ongoing security management. Analysts agree that consolidating capabilities to minimize overlapping functionality is helping organizations reduce cost and complexity. However, they also advise organizations to carefully assess native features to ensure they satisfy all use cases. As Microsoft and Google continue to build out its essential email security features, the growing overlap with SEGs has given organizations an opportunity to streamline security operations by leveraging capabilities already included in their E3 or E5 license. This shift enables organizations to eliminate complex and costly SEG deployments, redirecting a fraction of that budget to integrate lightweight solutions that effectively address the most dangerous phishing threats. Cloudflare Email security provides an integrated, low-touch solution that augments Microsoft 365 using machine learning threat analysis to automate the detection of BEC and multi-channel attacks. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/protect-from-phishing-attacks/#page","headline":"Protect your organization from phishing attacks · Cloudflare Learning Paths","description":"Deploy modern email security beyond SEGs.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/protect-from-phishing-attacks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/concepts/protect-from-phishing-attacks/","name":"Protect your organization from phishing attacks"}}]} ``` --- --- title: What is Cloudflare? description: Learn about Cloudflare's global network. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Cloudflare? Cloudflare is one of the world's largest [connectivity cloud networks ↗](https://blog.cloudflare.com/welcome-to-connectivity-cloud). Today, anyone with an Internet presence can have faster and more secure websites and applications thanks to Cloudflare. This includes bloggers, businesses, and even non-profits. Millions of Internet properties are on Cloudflare, and our network is growing by tens of thousands each day. Cloudflare powers Internet requests for millions of websites and serves 55 million HTTP requests per second on average. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/what-is-cloudflare/#page","headline":"What is Cloudflare? · Cloudflare Learning Paths","description":"Learn about Cloudflare's global network.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/what-is-cloudflare/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/concepts/what-is-cloudflare/","name":"What is Cloudflare?"}}]} ``` --- --- title: What is Email security? description: Learn about email protocol security gaps. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is Email security? Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol ↗](https://www.cloudflare.com/learning/email-security/what-is-smtp/). As a result, email is a major attack vector. Email security is the process of preventing [email-based ↗](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing ↗](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks ↗](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware ↗](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery, and filtering [spam ↗](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/what-is-email-security/#page","headline":"What is Email security? · Cloudflare Learning Paths","description":"Learn about email protocol security gaps.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/what-is-email-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/concepts/what-is-email-security/","name":"What is Email security?"}}]} ``` --- --- title: What is a phishing attack? description: Understand email phishing attack methods. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What is a phishing attack? [Phishing ↗](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/) is an attempt to steal sensitive data, typically in the form of usernames, passwords, or other important account information. The phisher either uses the stolen information themselves (for instance, to take over the user's accounts with their password), or sells the stolen information. Phishing attackers disguise themselves as a reputable source. With an enticing or seemingly urgent request, an attacker lures the victim into providing information, just as a person uses bait while fishing. Phishing often takes place over email. Phishers either try to trick people into emailing information directly, or link to a webpage they control that is designed to look legitimate (for instance, a fake login page where the victim enters their password). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/what-is-phishing-attack/#page","headline":"What is a phishing attack? · Cloudflare Learning Paths","description":"Understand email phishing attack methods.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/concepts/what-is-phishing-attack/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/concepts/what-is-phishing-attack/","name":"What is a phishing attack?"}}]} ``` --- --- title: Configure Email security description: Protect your organization from email phishing attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure Email security With Email security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up Email security. In this module, you will configure your email environment. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/#page","headline":"Configure Email security · Cloudflare Learning Paths","description":"Protect your organization from email phishing attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}}]} ``` --- --- title: Manage your active directory description: Sync and manage email directory users. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Manage your active directory Directories are folders to store user data. Email security allows you to manage directories from the Cloudflare dashboard. ### Manage your Microsoft 365 directory To manage your Microsoft 365 directory: 1. Log in to [Zero Trust ↗](https://one.dash.cloudflare.com/). 2. Select **Email security**. 3. Select **Directories**. 4. Under **Directory name**, select **MS directory**. 5. From here, you can manage **Groups** or **Users** directories. ### Manage your Google Workspace directory To manage your Google Workspace Directory: 1. Log in to [Zero Trust ↗](https://one.dash.cloudflare.com/). 2. Select **Email security**. 3. Select **Directories**. 4. Under **Directory name**, select **Google Workspace Directory**. 5. From here, you can manage **Groups** or **Users** directories. Email security allows you to view and manage your groups directory and their [impersonation registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/impersonation-registry/). When a group is added to the registry, all members are registered by default. To manage your group directory, select your directory, then select the **Groups** tab. To add a single group to the registry: 1. Select the group name you want to add. 2. Select the three dots > **Add to registry**. To add multiple groups to the registry at once: 1. Select the group names you want to add to the registry. 2. Select the **Action** dropdown list. 3. Select **Add to registry**. In addition, Email security allows you to: * [Remove groups from the registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/directories/manage-integrated-directories/manage-groups-directory/#remove-groups-from-registry). * [Filter the impersonation registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/directories/manage-integrated-directories/manage-groups-directory/#filter-impersonation-registry). * [Manage users in your directory](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/directories/manage-integrated-directories/manage-users-directory/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/active-directory-sync/#page","headline":"Manage your active directory · Cloudflare Learning Paths","description":"Sync and manage email directory users.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/active-directory-sync/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/active-directory-sync/","name":"Manage your active directory"}}]} ``` --- --- title: Enable audit logs description: Enable email security audit logs via Logpush. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Enable audit logs With Email security, you can enable logs to review actions performed on your account. To enable audit logs: 1. In the Cloudflare dashboard, go to the **Logpush** page. [ Go to **Logpush** ](https://dash.cloudflare.com/?to=/:account/logs) 2. Select your storage destination. 3. Select the three dots > **Edit**. 4. Under **Configure logpush job**: * **Job name**: Enter the job name, if it is not already prepopulated. * **If logs match** \> Select **Filtered logs**: * **Field**: Choose `ResourceType`. * **Operator**: Choose `starts with`. * **Value**: Enter `email_security`. 5. Select **Submit**. You can now view logs via the Cloudflare dashboard. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/audit-logs/#page","headline":"Enable audit logs · Cloudflare Learning Paths","description":"Enable email security audit logs via Logpush.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/audit-logs/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/audit-logs/","name":"Enable audit logs"}}]} ``` --- --- title: Create allow policies description: Configure trusted sender allow policies. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create allow policies Email security allows you to configure allow policies. An allow policy exempts messages that match certain patterns from normal detection scanning. You can choose how Email security will handle messages that match your criteria: * **Trusted Sender**: Messages will bypass all [detections](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/reference/dispositions-and-attributes/) and link following. Typically, it only applies to phishing simulations from vendors such as KnowBe4\. Many emails contain links in them. Some of these could be links to surveys, phishing simulations and other trackable links. By marking a message as a Trusted Sender, Email security will not scan any attachments from the sender and will not attempt to open the links in the emails. * **Exempt Recipient**: Messages will be exempt from all Email security [detections](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/reference/dispositions-and-attributes/) intended for recipients matching this pattern (email address or regular expression only). Typically, this only applies to submission mailboxes for user reporting to security. * **Accept Sender**: Messages will exempt messages from the `SPAM`, `SPOOF`, and `BULK` [dispositions](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/reference/dispositions-and-attributes/) (but not `MALICIOUS` or `SUSPICIOUS`). Commonly used for external domains and sources that send mail on behalf of your organization, such as marketing emails or internal tools. ## Configure allow policies To configure allow policies: 1. Log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/). 2. Select **Email security**. 3. Select **Settings**, then go to **Detection settings** \> **Allow policies**. 4. On the **Detection settings** page, select **Add a policy**. 5. On the **Add an allow policy** page, enter the policy information: * **Input method**: Choose between **Manual input**, and **Uploading an allow policy**: * **Manual input**: * **Action**: Select one of the following to choose how Email security will handle messages that match your criteria: * **Trust sender**: Messages will bypass all detections and link following. * **Exempt recipient**: Message to this recipient will bypass all detections. * **Accept sender**: Messages from this sender will be exempted from Spam, Spoof, and Bulk dispositions. * **Rule type**: Specify the scope of your policy. Choose one of the following: * **Email addresses**: Must be a valid email. * **IP addresses**: Can only be IPv4\. IPv6 and CIDR are invalid entries. * **Domains**: Must be a valid domain. * **Regular expressions**: Must be valid Java expressions. Regular expressions are matched with fields related to the sender email address (envelope from, header from, reply-to), the originating IP address, and the server name for the email. * **(Recommended) Sender verification**: This option enforces DMARC, SPF, or DKIM authentication. If you choose to enable this option, Email security will only honor policies that pass authentication. * **Notes**: Provide additional information about your allow policy. * **Uploading an allow policy**: Upload a file no larger than 150 KB. The file can only contain `Pattern`, `Notes`, `Verify Email`, `Trusted Sender`, `Exempt Recipient`, and `Acceptable Sender` fields. The first row must be a header row. 6. Select **Save**. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/create-allow-policies/#page","headline":"Create allow policies · Cloudflare Learning Paths","description":"Configure trusted sender allow policies.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/create-allow-policies/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/create-allow-policies/","name":"Create allow policies"}}]} ``` --- --- title: Add user to the impersonation registry description: Protect executives from BEC impersonation attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Add user to the impersonation registry Attackers often try to impersonate executives within an organization when sending malicious emails (with requests about banking information, trade secrets, and more), which is known as a [Business Email Compromise (BEC) ↗](https://www.cloudflare.com/en-gb/learning/email-security/business-email-compromise-bec/) attack. The impersonation registry protects against these attacks by looking for spoofs of known key users in an organization. Information about key users you either synced with your directory or entered manually in the dashboard is used by Email security to run enhanced scan techniques and find these spoofed emails. To add a user to the impersonation registry: 1. Log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/). 2. Select **Email security**. 3. Select **Settings** \> **Impersonation registry**. 4. Select **Add a user**. 5. Select **Input method**: Choose between **Manual input**, **Upload manual list**, and **Select from existing directories**: * **Manual input**: Enter the following information: * **User info**: enter a valid **Display name**. * **User email**: Enter one of the following: * **Email address**: Enter all known email addresses, separated by a comma. * **Regular expressions**: Must be valid Java expressions. * **Upload manual list**: You can upload a file no larger than 150 KB containing all variables of potential emails. The file must contain `Display_Name` and `Email`, and the first row must be the header row. * **Select from existing directories**: * **Select directory**: Select your directory. * **Add users or groups**: Choose the users or groups you want to register. 6. Select **Save**. For more information on how to edit and remove users, refer to [Impersonation Registry](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/impersonation-registry/#edit-users). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/impersonation-registry/#page","headline":"Add user to the impersonation registry · Cloudflare Learning Paths","description":"Protect executives from BEC impersonation attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/impersonation-registry/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/impersonation-registry/","name":"Add user to the impersonation registry"}}]} ``` --- --- title: Report phish description: Set up PhishNet for user phish reporting. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Report phish Before deploying Email security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox. PhishNet is an add-in button that helps users to submit phish samples missed by Email security detection. ### PhishNet for Microsoft 365 To set up PhishNet Microsoft 365: 1. Log in to the Microsoft admin panel. Go to **Microsoft 365 admin center** \> **Settings** \> **Integrated Apps**. 2. Select **Upload custom apps**. 3. Choose **Provide link to manifest file** and paste the following URL: ```txt https://phishnet-o365.area1cloudflare-webapps.workers.dev?clientId=ODcxNDA0MjMyNDM3NTA4NjQwNDk1Mzc3MDIxNzE0OTcxNTg0Njk5NDEyOTE2NDU5ODQyNjU5NzYzNjYyNDQ3NjEwMzIxODEyMDk1NQ ``` 1. Verify and complete the wizard. ### PhishNet for Google Workspace To set up PhishNet for Google Workspace: 1. Log in to the Google Workspace Marketplace using an administrator account. 2. Select **Admin install** to install Cloudflare PhishNet. Refer to [Set up PhishNet for Google Workspace](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/phish-submissions/phishnet-google-workspace/#set-up-phishnet-for-google-workspace) for more information. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/report-phish/#page","headline":"Report phish · Cloudflare Learning Paths","description":"Set up PhishNet for user phish reporting.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/report-phish/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/report-phish/","name":"Report phish"}}]} ``` --- --- title: Set additional detections description: Enable extra email threat detection rules. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Set additional detections Email security allows you to configure the following additional detections: * [Domain age](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/additional-detections/#configure-domain-age) * [Blank email detection](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/additional-detections/#configure-blank-email-detection) * [Automated Clearing House (ACH)](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/additional-detections/#configure-ach-change-from-free-email-detection) change from free email detection. * [HTML attachment email detection](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/additional-detections/#configure-html-attachment-email-detection) To configure additional detections: 1. Log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/). 2. Select **Email security**. 3. Select **Settings**. 4. On the Settings page, go to **Detection settings** \> **Additional detections**, and select **Edit**. ## Configure domain age The domain age is the time since the domain has been registered. To configure a domain age: 1. On the **Edit additional detections** page: * Select **Malicious domain age**: Controls the threshold for a malicious disposition. Maximum of 100 days. * Select **Suspicious domain age**: Controls the threshold for a suspicious disposition. Maximum of 100 days. 2. Select **Save**. ## Configure blank email detection Blank email detection detects emails with blank bodies and assigns a default disposition. You can choose between **Malicious** and **Suspicious** as dispositions. To enable blank email detection: 1. On the **Edit additional detections** page, enable **Blank email detection**. 2. Choose between **Malicious** and **Suspicious**. 3. Select **Save**. ## Configure ACH change from free email detection [Automated Clearing House (ACH) ↗](https://en.wikipedia.org/wiki/Automated%5Fclearing%5Fhouse) is a banking term related to direct deposits. ACH change from free email detection detects payroll inquiries or change requests from free email domains and assigns a default disposition. You can choose between **Malicious** and **Suspicious** as dispositions. To enable ACH change from free email detection: 1. On the **Edit additional detections** page, enable **ACH change from free email detection**. 2. Choose between **Malicious** and **Suspicious**. 3. Select **Save**. ## Configure HTML Attachment Email Detection HTML attachment email detection detects HTM and HTML attachments in emails and assigns a default disposition. To enable HTML attachment email detection: 1. On the **Edit additional detections** page, enable **HTML attachment email detection**. 2. Choose between **Malicious** and **Suspicious**. 3. Select **Save**. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/set-additional-detections/#page","headline":"Set additional detections · Cloudflare Learning Paths","description":"Enable extra email threat detection rules.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/configure-email-security/set-additional-detections/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/","name":"Configure Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/configure-email-security/set-additional-detections/","name":"Set additional detections"}}]} ``` --- --- title: Enable auto-moves description: Protect your organization from email phishing attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Enable auto-moves Now that you have set up your email environment, you can enable auto-move events. Warning Ensure you have completed the previous modules before enabling auto-moves. Auto-move events are events where emails are automatically moved to different inboxes based on the disposition assigned to them by Email security. When you set up auto-moves, you can move messages manually or set up automatic moves to send messages matching certain [dispositions](https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/email-dispositions/) to specific folders within a user's mailbox. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/#page","headline":"Enable auto-moves · Cloudflare Learning Paths","description":"Protect your organization from email phishing attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/enable-auto-moves/","name":"Enable auto-moves"}}]} ``` --- --- title: Configure auto-moves description: Automate moving suspicious emails to folders. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Configure auto-moves To configure auto-move events: 1. Log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/). 2. Select **Email security**. 3. Select **Settings**. 4. Select **Moves**. 5. Under **Auto-moves**, select **Configure**. 6. Assign actions based on malicious, spoof, suspicious, spam, and bulk dispositions. Select among: * **Soft delete - user recoverable**: Moves the message to the user's **Recoverable Items - Deleted** folder. Messages can be recovered by the user. * **Hard delete - admin recoverable**: Completely deletes messages from a user's inbox. * **Move to trash**: Moves messages to the trash or deleted items email folder. * **Move to junk**: Moves the message to the junk or spam folder. * **No action**: Messages stay in the origin folder. 7. Select **Save**. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/configure-auto-moves/#page","headline":"Configure auto-moves · Cloudflare Learning Paths","description":"Automate moving suspicious emails to folders.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/configure-auto-moves/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/enable-auto-moves/","name":"Enable auto-moves"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/enable-auto-moves/configure-auto-moves/","name":"Configure auto-moves"}}]} ``` --- --- title: Email dispositions description: Understand email threat disposition categories. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Email dispositions Email security returns five potential verdicts for every email it scans. Review the detections and consider how you would treat them once an auto-move is enabled. Below is an overview of the disposition and recommendation actions by Cloudflare: | Disposition | Description | Recommendation | | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | | MALICIOUS | Traffic invoked multiple phishing verdict triggers, met thresholds for bad behavior, and is associated with active campaigns. | Block | | | SUSPICIOUS | Traffic associated with phishing campaigns (and is under further analysis by our automated systems). | Research these messages internally to evaluate legitimacy. | | | SPOOF | Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF ↗](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM ↗](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC ↗](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)), or have mismatching Envelope From and Header From values. | Block after investigating (can be triggered by third-party mail services). | | | SPAM | Traffic associated with non-malicious, commercial campaigns. | Route to existing Spam quarantine folder. | | | BULK | Traffic associated with [Graymail ↗](https://en.wikipedia.org/wiki/Graymail), that falls in between the definitions of SPAM and SUSPICIOUS. For example, a marketing email that intentionally obscures its unsubscribe link. | Monitor or tag | | ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/email-dispositions/#page","headline":"Email dispositions · Cloudflare Learning Paths","description":"Understand email threat disposition categories.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/enable-auto-moves/email-dispositions/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/enable-auto-moves/","name":"Enable auto-moves"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/enable-auto-moves/email-dispositions/","name":"Email dispositions"}}]} ``` --- --- title: Get started with Email security description: Protect your organization from email phishing attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Get started with Email security In this learning path, you will learn how to protect your organization from phishing attacks with Email security. Your users will experience a reduction in spam and phishing emails, and have simple ways to report any suspicious activity. Administrators will be able to review detections and phishing trends that target their organization without having to tune Email security. This module will kickstart your email flow. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/#page","headline":"Get started with Email security · Cloudflare Learning Paths","description":"Protect your organization from email phishing attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}}]} ``` --- --- title: Create an Email security account description: Set up a Cloudflare Email security account. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Create an Email security account To create your Email security account, you will need the alphanumeric string on the URL when logged in to the Cloudflare dashboard. If you do not have a Cloudflare account, you can create one for free by referring to the [Cloudflare sign-up page ↗](https://dash.cloudflare.com/sign-up). Once you have created your account, your account team will create an Email security account for you. To establish your tenant, you will need the following information: * Average monthly inbound message volume * Number of active email users * At least one domain * Admin email address ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/create-email-security-account/#page","headline":"Create an Email security account · Cloudflare Learning Paths","description":"Set up a Cloudflare Email security account.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/create-email-security-account/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/get-started/create-email-security-account/","name":"Create an Email security account"}}]} ``` --- --- title: Deployment models description: Compare API, BCC, and inline email deployments. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Deployment models Email security offers multiple deployment models: * API for Microsoft 365 users. * BCC for Google Workspace users. * MX/Inline for all email providers. When you choose the [API deployment](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/setup/post-delivery-deployment/api/), Email security can both scan and take actions on emails after they have reached a user's inbox. If you are a Google Workspace user, you can enable Email security via [BCC setup](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/gmail-bcc-setup/). Email security scans a copy of your email after it lands in your inbox. ![Google Workspace BCC deployment diagram](https://edgetunnel-b2h.pages.dev/_astro/Gmail_Deployment_BCC.YSoTUoiz_Z1MxITR.webp) With MX/Inline, Email security scans your email before they land in your inbox, giving you the highest level of protection. ![Microsoft 365 and Google Workspace MX/Inline](https://edgetunnel-b2h.pages.dev/_astro/Email_security_Deployment_Inline.Dsh4g8YD_fMdlm.webp) Refer to [Before you begin](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/setup/) for a comprehensive comparison of each deployment method, and [Understanding Email Security Deployments](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/email-security-deployments/) to learn about each deployment method. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/deployment-models/#page","headline":"Deployment models · Cloudflare Learning Paths","description":"Compare API, BCC, and inline email deployments.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/deployment-models/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/get-started/deployment-models/","name":"Deployment models"}}]} ``` --- --- title: Prerequisites description: Review requirements before getting started. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Prerequisites To make the most of this learning path, make sure you have access to Microsoft 365 or Gmail account. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/prerequisites/#page","headline":"Prerequisites · Cloudflare Learning Paths","description":"Review requirements before getting started.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/prerequisites/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/get-started/prerequisites/","name":"Prerequisites"}}]} ``` --- --- title: Recommended deployment model description: Use API deployment for easiest email setup. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Recommended deployment model While there are multiple deployment methods, the easiest way to get started with Email security is via the API deployment method. The API deployment with Email security offers: * Easy protection for complex email architectures, without requiring any change to mail flow operations. * Agentless deployment for Microsoft 365. * Office 365 directory integration to retrieve user and group information and prevent user impersonation. ![Microsoft 365 API deployment diagram](https://edgetunnel-b2h.pages.dev/_astro/M365_API_Deployment_Graph.Czbz8tQF_ZWYsK4.webp) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/recommended-deployment-model/#page","headline":"Recommended deployment model · Cloudflare Learning Paths","description":"Use API deployment for easiest email setup.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/recommended-deployment-model/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/get-started/recommended-deployment-model/","name":"Recommended deployment model"}}]} ``` --- --- title: Set up Google Workspace description: Integrate Email security with Google Workspace. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Set up Google Workspace 1. Log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/). 2. Select **Email security** \> **Settings**. 3. Select **Connect an integration**, choose **Google Workspace CASB + EMAIL**, then select **Select Integration**. 4. Follow the wizard to create an integration, then select **Create Integration**. Refer to [Enable Gmail BCC integration](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-gmail-integration/) for further instructions. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/setup-google-workspace/#page","headline":"Set up Google Workspace · Cloudflare Learning Paths","description":"Integrate Email security with Google Workspace.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/setup-google-workspace/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/get-started/setup-google-workspace/","name":"Set up Google Workspace"}}]} ``` --- --- title: Set up Microsoft Graph API description: Integrate Email security with Microsoft 365. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Set up Microsoft Graph API 1. Log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/). 2. Select **Email security** \> **Settings**. 3. Select **Connect an integration**, choose **Microsoft CASB + EMAIL**, then select **Select Integration**. 4. Enable **Microsoft Integration**: 1. **Configure policy**: Choose how you wannt [CASB](https://edgetunnel-b2h.pages.dev/cloudflare-one/cloud-and-saas-findings/) to access the data from your integration. 2. **Name integration**: Add your integration name, then select **Continue**. 3. **Authorize integration**: * Select **Authorize**. Selecting **Authorize** will take you to the Microsoft Sign in page where you will have to enter your email address. * Once you enter your email address, select **Next**. * After selecting **Next**, the system will show a dialog box with a list of requested permissions. Select **Accept** to authorize Email security. Upon authorization, you will be redirected to a page where you can review details and enroll integration. 4. **Review details**: Review your integration details, then: * Select **Complete Email security set up** where you will be able to connect your domains and configure auto-moves. * Select **Continue to Email security**. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/setup-ms-graph-api/#page","headline":"Set up Microsoft Graph API · Cloudflare Learning Paths","description":"Integrate Email security with Microsoft 365.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/get-started/setup-ms-graph-api/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/get-started/","name":"Get started with Email security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/get-started/setup-ms-graph-api/","name":"Set up Microsoft Graph API"}}]} ``` --- --- title: Monitor your email activity description: Protect your organization from email phishing attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Monitor your email activity To access an overview of your account, the total number of emails processed, a breakdown of types of threads detected, and other useful information: 1. Log in to [Zero Trust. ↗](https://one.dash.cloudflare.com/) 2. Select **Email security**. Under **Email security**, select **Monitoring**. The dashboard will display the following metrics: * Email activity * [Disposition evaluation](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/reference/dispositions-and-attributes/) * Detection details * [Impersonations](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/impersonation-registry/) * [Phish submissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/phish-submissions/) * [Auto-move events](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/auto-moves/) * [Detection settings metrics](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/) Email activity aggregates statistics about emails scanned and dispositions assigned (the number of email flagged due to a detection) within a given timeframe. To view the live number of email scanned and dispositions scanned, enable **Live mode**. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/#page","headline":"Monitor your email activity · Cloudflare Learning Paths","description":"Protect your organization from email phishing attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/","name":"Monitor your email activity"}}]} ``` --- --- title: Monitor detections description: Review email threat detection results. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Monitor detections Spam and Malicious emails are blocked outright by Email security, but Suspicious and Spoof dispositions should be monitored. Suspicious messages should be investigated by a security analyst to determine the legitimacy of the message. [PhishGuard](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/phishguard/) (Cloudflare's managed email security service) can review these messages for you and move them from the end user inbox if they are deemed malicious. Messages that receive a Spoof disposition should be investigated because it signals that the traffic is either non-compliant with your email authentication process [SPF ↗](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM ↗](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC ↗](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/), or has a mismatching Envelope From and Header From value. In most cases, a Spoof disposition is triggered by a legitimate third-party mail service. If you determine that the Spoofed email is a legitimate business use case, you can either: * Update your email authentication records. * Add an acceptable sender [allow policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/detection-settings/allow-policies/) to exempt messages from the Spam, Spoof, or Bulk disposition, but not Malicious or Suspicious, so the content of the message can still be monitored. ## Search email messages Email security offers a variety of ways for you to better examine and understand your message traffic: You can search for emails that have been processed by Email security, whether they are marked with a [detection disposition](https://edgetunnel-b2h.pages.dev/email-security/reference/dispositions-and-attributes/) or not. There are three ways for searching emails: * Popular screen: A popular screen allows you to view messages based on common pre-defined criteria. * Regular screen: A regular screen allows you to investigate your inbox by inserting a term to screen across all criteria. * Advanced screen: The advanced screen criteria gives you the option to narrow message results based on specific criteria. The advanced screen has several options (such as keywords, subject keywords, sender domain, and more) to scan your inbox. Additional information on search can be found on the [Screen criteria](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/investigation/search-email/#screen-criteria) documentation. ### Export messages With Email security, you can export messages to a CSV file. Via the dashboard, you can export up to 1,000 rows. If you want to export all messages, you can use the [API ↗](https://edgetunnel-b2h.pages.dev/api/resources/email%5Fsecurity/subresources/investigate/methods/get/). ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/monitor-detections/#page","headline":"Monitor detections · Cloudflare Learning Paths","description":"Review email threat detection results.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/monitor-detections/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/","name":"Monitor your email activity"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/monitor-detections/","name":"Monitor detections"}}]} ``` --- --- title: Phish submissions description: Review user and admin phish submissions. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Phish submissions While Email security offers industry leading detection efficacy due to Cloudflare's Threat Intelligence, Preemptive Threat Hunting (actor and campaign infrastructure hunting with 8B, plus campaign threat signals assessed every day) and ML-Based Detection Models (Trust Graphs Computer Vision, Sentiment/Thread/Structural Analysis, Industry/Natural Language Understanding Modeling) false negatives and false positive can occur. There are two different ways to [submit a phish](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/phish-submissions/) sample: * User submission: * Submitted directly by the end user, and used with phish submission buttons. To learn more about user-submitted phish, refer to [PhishNet for Microsoft 365](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/phish-submissions/#phishnet-o365) or [PhishNet for Google Workspace](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/settings/phish-submissions/phishnet-google-workspace/). * User submissions can create another challenge for your organization. While it is important for end users to be vigilant and report what they believe may be a phishing email, they are often wrong. About 90% of the time, when an end user reports a missed phishing email, they are mistaken. This puts an extra burden on busy security teams as they sift through end user reports. The PhishGuard team at Cloudflare can solve this problem for your organization by reviewing end user submissions for you. * Admin submission: * To be used when IT administrators or security teams submit to Email security. Submit original phish samples as an attachment in EML format to the appropriate team submission address. * Within the Email security dashboard, Phish submissions will allow you to have a full understanding of what reclassification has been made and what the outcomes of those submissions are. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/phish-submissions/#page","headline":"Phish submissions · Cloudflare Learning Paths","description":"Review user and admin phish submissions.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/phish-submissions/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/","name":"Monitor your email activity"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/phish-submissions/","name":"Phish submissions"}}]} ``` --- --- title: PhishGuard description: Use managed PhishGuard threat monitoring. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # PhishGuard [PhishGuard](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/phishguard/) serves as an extension of your Security Operations team with dedicated Email security technical resources providing real-time monitoring of your email environment. The Active Defense Service provides: * Customized notification and responses for fraud and insider threats. * Reclassification of messages if the disposition is incorrect. * PhishGuard monitors and reviews Suspicious email traffic. * Quarantine and auto-move of identified threats. * Tailored threat hunting for your email environment. * Custom detections. As a PhishGuard customer, the following service offerings should be enabled: * Escalation contacts must be configured in the Email security dashboard: This allows for email reports to be delivered regarding high risk items identified and responded to by the team. * Auto-moves should be enabled and configured for quarantine of identified items: Malicious should be prioritized, but configuring Spam for a move to junk/trash or even soft delete may also be highly useful to the client. Refer to the [PhishGuard](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/phishguard/) documentation to learn more about this add-on service. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/phishguard/#page","headline":"PhishGuard · Cloudflare Learning Paths","description":"Use managed PhishGuard threat monitoring.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/secure-your-email/monitor-your-inbox/phishguard/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/","name":"Monitor your email activity"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/secure-your-email/monitor-your-inbox/phishguard/","name":"PhishGuard"}}]} ``` --- --- title: Prerequisites description: Prepare your site for traffic surges. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Prerequisites Reach out to your Customer Success Manager at least 30 days prior to the expected traffic surge to schedule a Security Optimization walkthrough with your Customer Solution Engineer. To learn more about our service offerings, refer to [Customer Success offerings ↗](https://www.cloudflare.com/success-offerings/). ## Register your users For the security and protection of your account, be sure to register all account users. 1. In the Cloudflare dashboard, go to the **Manage Account** \> **Members** page. [ Go to **Members** ](https://dash.cloudflare.com/?to=/:account/members) 2. Select more than one Super Administrator to ensure appropriate access when needed. Note Refer to [Manage members](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/) to learn how to review and update registered account users. Failure to register account users can create issues with our ticketing system. Unverified users who contact support will be funneled to the self-serve queue rather than the Enterprise queue which can result in long wait times. We strongly advise against credential-sharing which can jeopardize the trust and safety of your account. ## Confirm user and domain administration * **Multi-User:** Provide role-based permissions to a group of users to better control the administration of your domains. Each user has their own role and limited API key. * **Enforce 2FA:** Ensure your entire dashboard is secure by [enforcing 2-factor authentication](https://edgetunnel-b2h.pages.dev/fundamentals/user-profiles/2fa/) for your organization. * To disable 2FA, submit a support ticket and allow 1-2 business days to validate your request. * **Leverage API Access:** Work easily with our system programmatically using our [API ↗](https://api.cloudflare.com). ## Additional items * Check when your [SSL Certificates expire (only custom and origin certificates)](https://edgetunnel-b2h.pages.dev/ssl/edge-certificates/custom-certificates/renewing/) Note Certificates managed by Cloudflare are auto-renewed. * Review your Operational and Disaster recovery preparedness * Enable Load Balancing with smart cache strategies: Use [Cloudflare Load Balancing](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/load-balancing) to distribute traffic across multiple healthy origins, and increase cache-hit ratios by leveraging [custom cache rules](https://edgetunnel-b2h.pages.dev/cache/performance-review/cache-analytics) and [edge compute ↗](https://www.cloudflare.com/learning/cdn/caching-static-and-dynamic-content/) (e.g., Cloudflare Workers) to offload origin traffic during high-demand periods. * Configure failover pools and back up DNS with a playbook: Set up [Cloudflare Load Balancer failover pools](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/load-balancing) to automatically redirect traffic to healthy origins if one fails. Export DNS records for safekeeping and prepare a clear [incident response plan ↗](https://www.cloudflare.com/learning/performance/preventing-downtime) that includes steps for re-routing or recovery. * Review and update your current users' access * Check your domain registry validity ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/concepts/#page","headline":"Prerequisites · Cloudflare Learning Paths","description":"Prepare your site for traffic surges.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/concepts/","name":"Prerequisites"}}]} ``` --- --- title: Custom pages description: Configure custom error and block pages. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Custom pages Design your custom HTML page and host it online anywhere. Once published, Cloudflare will use the customized page instead of serving our standard page to your visitors. Note We encourage you to customize every page to provide a consistent branding experience for your users. You can also [turn on Origin Error Pages](https://edgetunnel-b2h.pages.dev/rules/custom-errors/#error-pages) for 5XX errors (except errors `520`\-`527`). Pages you can customize: * WAF block * IP/Country block * IP/Country challenge * 500 class errors * 1000 class errors * Managed challenge / I'm Under Attack Mode * Rate limiting block ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/concepts/custom-pages/#page","headline":"Custom pages · Cloudflare Learning Paths","description":"Configure custom error and block pages.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/concepts/custom-pages/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/concepts/","name":"Prerequisites"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/concepts/custom-pages/","name":"Custom pages"}}]} ``` --- --- title: Performance description: Prepare your site for traffic surges. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Performance ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/#page","headline":"Performance · Cloudflare Learning Paths","description":"Prepare your site for traffic surges.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/performance/","name":"Performance"}}]} ``` --- --- title: Analytics description: Monitor traffic with Cloudflare analytics. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Analytics ## Workers Analytics Engine Use the [Workers Analytics Engine](https://edgetunnel-b2h.pages.dev/analytics/analytics-engine/) to send unlimited-cardinality data from your Worker to a time-series database. Query it with SQL. ## Account and zone analytics Use [Account and zone analytics](https://edgetunnel-b2h.pages.dev/analytics/account-and-zone-analytics/) to provide details about the requests and traffic related to your Cloudflare accounts and zones. ## Cloudflare Network Analytics Use [Cloudflare Network Analytics](https://edgetunnel-b2h.pages.dev/analytics/network-analytics/) to provide near real-time visibility into network and transport-layer traffic patterns and DDoS attacks. ## GraphQL Analytics API Use the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/) to provide\\ all of your performance, security, and reliability data from one endpoint. Select exactly what you need, from one metric for a domain to multiple metrics aggregated for your account. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/analytics/#page","headline":"Analytics · Cloudflare Learning Paths","description":"Monitor traffic with Cloudflare analytics.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/analytics/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/performance/","name":"Performance"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/performance/analytics/","name":"Analytics"}}]} ``` --- --- title: Caching description: Optimize caching for surge readiness. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Caching ## Optimize caching By default, Cloudflare [caches static content](https://edgetunnel-b2h.pages.dev/cache/concepts/default-cache-behavior/) such as images, CSS, and JavaScript. However, you can extend Cloudflare caching to work with HTML by creating custom [Cache Rules](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-rules/). ### Cache more requests 1. In the Cloudflare dashboard, go to the **Caching** \> **Cache Rules** page. [ Go to **Cache Rules** ](https://dash.cloudflare.com/?to=/:account/:zone/caching/cache-rules) 2. Select **Create rule**. 3. For When incoming requests match, enter either your entire website or a specific path on your application, based on the Hostname or URI Path. Refer to the [available fields](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-rules/settings/#fields). 4. For Cache eligibility, define how these requests should be cached and for how long. Refer to the available [cache eligibility settings](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-rules/settings/#eligible-for-cache-settings). 5. You can then monitor the effectiveness of your cache settings using [Cache Analytics](https://edgetunnel-b2h.pages.dev/cache/performance-review/cache-analytics/) and update your configuration according to our [Cache performance guide](https://edgetunnel-b2h.pages.dev/cache/performance-review/cache-performance/). ### Advanced cache optimizations * [Custom Cache Keys](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-keys/) allows you to precisely set the cacheability setting for any resource. * [Origin Cache Control](https://edgetunnel-b2h.pages.dev/cache/concepts/cache-control/) can be used to let the Cache-Control headers tell Cloudflare how to handle content from the origin server. ## Tiered Cache [Tiered Cache](https://edgetunnel-b2h.pages.dev/cache/how-to/tiered-cache/) uses the size of Cloudflare's network to reduce requests to customer origin servers by dramatically increasing cache hit ratios. It works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier requests an upper-tier for the content. If the upper-tier does not have the content, only the upper-tier will initiate a request to the origin. This practice improves bandwidth efficiency by limiting the number of Cloudflare data centers that can ask the origin for content. Refer to [Enable Tiered Cache](https://edgetunnel-b2h.pages.dev/cache/how-to/tiered-cache/#enable-tiered-cache) to get started. ### Cache Reserve [Cache Reserve](https://edgetunnel-b2h.pages.dev/cache/advanced-configuration/cache-reserve/) is a large, persistent data store implemented on top of [R2](https://edgetunnel-b2h.pages.dev/r2/). With a single click in the dashboard, your cacheable content will be written to Cache Reserve. In the same way that Tiered Cache builds a hierarchy of caches between your visitors and your origin, Cache Reserve serves as the ultimate [upper-tier cache](https://edgetunnel-b2h.pages.dev/cache/how-to/tiered-cache/) that will reserve storage space for your assets for as long as you want. This ensures that your content is served from cache longer, shielding your origin from unneeded egress fees. ## Cloudflare Waiting Room [Cloudflare Waiting Room](https://edgetunnel-b2h.pages.dev/waiting-room/) allows you to route excess users of your website to a customized waiting room, helping preserve customer experience and protect origin servers from being overwhelmed with requests. ## Use Cloudflare IP addresses Take action to prevent attacks to your application during peak season by configuring your firewall to only accept traffic from Cloudflare IP addresses. By only allowing [Cloudflare IPs ↗](https://www.cloudflare.com/ips), you can prevent attackers from bypassing Cloudflare and sending requests directly to your origin. Refer to [Cloudflare IP addresses](https://edgetunnel-b2h.pages.dev/fundamentals/concepts/cloudflare-ip-addresses/) for more information. ## Monitor traffic You can use the Cloudflare dashboard to closely monitor the traffic on your domain and fine-tune your cache and security settings accordingly. ### Zone and Account analytics [Cloudflare zone analytics](https://edgetunnel-b2h.pages.dev/analytics/account-and-zone-analytics/zone-analytics/) gives you access to a wide range of metrics, collected at the website or domain level. [Cloudflare account analytics](https://edgetunnel-b2h.pages.dev/analytics/account-and-zone-analytics/account-analytics/) lets you access a wide range of aggregated metrics from all the sites under a specific Cloudflare account. ### Security Analytics and Security Events [Security Analytics](https://edgetunnel-b2h.pages.dev/waf/analytics/security-analytics/) displays information about all incoming HTTP requests for your domain, including requests not handled by Cloudflare security products. You can also use the [Security Events](https://edgetunnel-b2h.pages.dev/waf/analytics/security-events/) to review mitigated requests and tailor your security configurations. ### Cache Analytics You can use [Cache Analytics](https://edgetunnel-b2h.pages.dev/cache/performance-review/cache-analytics/) to improve site performance or reduce origin web server traffic. Cache Analytics helps determine if resources are missing from cache, expired, or ineligible for caching. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/caching/#page","headline":"Caching · Cloudflare Learning Paths","description":"Optimize caching for surge readiness.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/caching/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/performance/","name":"Performance"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/performance/caching/","name":"Caching"}}]} ``` --- --- title: Logs description: Set up logging for traffic monitoring. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Logs ## Logpush Use [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/) to push your request or event logs to your cloud service provider using Logpush, which can be configured via the Cloudflare dashboard or API. ## Instant Logs Use [Instant Logs](https://edgetunnel-b2h.pages.dev/logs/instant-logs/) to view HTTP request logs instantly in the Cloudflare dashboard or the CLI. ## Logs Engine Use the [Logs Engine](https://edgetunnel-b2h.pages.dev/logs/r2-log-retrieval/) to store your logs in R2 and query them directly. ## Log Explorer Use the [Log Explorer](https://edgetunnel-b2h.pages.dev/log-explorer/) to store and explore your Cloudflare logs directly within the Cloudflare dashboard or API. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/logs/#page","headline":"Logs · Cloudflare Learning Paths","description":"Set up logging for traffic monitoring.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/performance/logs/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/performance/","name":"Performance"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/performance/logs/","name":"Logs"}}]} ``` --- --- title: Security description: Prepare your site for traffic surges. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Security ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/#page","headline":"Security · Cloudflare Learning Paths","description":"Prepare your site for traffic surges.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}}]} ``` --- --- title: Block user agents and lock zones description: Block user agents and restrict zone access. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Block user agents and lock zones [User Agent (UA) Blocking](https://edgetunnel-b2h.pages.dev/waf/tools/user-agent-blocking/) rules match against specific User-Agent request headers sent by the browser or application accessing your site. UA rules are applied against the entire domain, and after a rule is triggered, you can decide which action to take against the visitor. Actions: * Block: Ensures that an IP address will never be allowed to access your site * Interactive Challenge: Visitors will be shown an interactive challenge before allowed access * Non-Interactive Challenge: Visitors will be shown a non-interactive challenge before allowed access ## Zone Lockdown [Zone Lockdown](https://edgetunnel-b2h.pages.dev/waf/tools/zone-lockdown/) rules allow you to define paths and only allow specific, trusted IPs to those paths. Any requests to those paths from non-whitelisted IPs will be automatically blocked with an 1106 HTTP code. This ability is particularly useful for locking down administrative or staging portions of your application. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/block-agents-lock-zones/#page","headline":"Block user agents and lock zones · Cloudflare Learning Paths","description":"Block user agents and restrict zone access.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/block-agents-lock-zones/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/block-agents-lock-zones/","name":"Block user agents and lock zones"}}]} ``` --- --- title: Control domain access description: Manage domain access with IP rules. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Control domain access [IP Access Rules](https://edgetunnel-b2h.pages.dev/waf/tools/ip-access-rules/) specify an action based on the origin of your user across a single domain or all of the domains in your account. IP Access Rules can be applied based on: * IPv4 address or range: Specified in CIDR notation as `/16` or `/24` * IPv6 address or range: Specified in CIDR notation as `/32`, `/48`, `/64` * ASN * Country or the Tor network Note We recommend locking down your origin with an Access Control List (ACL) which only allows [Cloudflare IPs ↗](http://www.cloudflare.com/ips). Actions: * Block: Ensures that an IP address will never be allowed to access your site. * Non-Interactive Challenge: Visitors will be shown a non-interactive challenge before allowed access. * Interactive Challenge: Visitors will be shown an interactive challenge before allowed access. * Allowlist: Ensures that an IP address will never be blocked from accessing your site. This supersedes any Cloudflare security profile. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/control-domain-access/#page","headline":"Control domain access · Cloudflare Learning Paths","description":"Manage domain access with IP rules.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/control-domain-access/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/control-domain-access/","name":"Control domain access"}}]} ``` --- --- title: Control incoming requests description: Filter incoming requests with WAF rules. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Control incoming requests Use [Custom rules](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) to allow you to control incoming traffic by filtering requests to a zone. They work as customized web application firewall (WAF) rules that you can use to perform actions like Block or Managed Challenge on incoming requests. Use WAF [Managed Rules](https://edgetunnel-b2h.pages.dev/waf/managed-rules/) to apply custom criteria for all incoming HTTP requests. ## Understand hosting plan limits Cloudflare offsets most of the load to your website via caching and request filtering, but some traffic will still pass through to your origin. Knowing the limits of your hosting plan can help prevent a bottleneck from your host. Once you are aware of your plan limits, you can use [Rate Limiting](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/) to restrict how many times a requesting entity can make a request to your website. To help you define the best rate limiting setting for your use case, refer to [How Cloudflare determines the request rate](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/request-rate/). ## Security models * Positive Security policy: Allow specific requests and deny everything else. * Negative Security policy: Block specific requests and allow everything else. ## Actions * Log: Test rule effectiveness before committing to a more severe action. * Allow: Allow matching requests to access the site. * Block: Block matching requests from accessing the site. * Non-Interactive Challenge: Visitors will be shown a non-interactive challenge before proceeding. * Interactive Challenge: Visitors will be shown an interactive challenge before proceeding. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/control-incoming-requests/#page","headline":"Control incoming requests · Cloudflare Learning Paths","description":"Filter incoming requests with WAF rules.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/control-incoming-requests/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/control-incoming-requests/","name":"Control incoming requests"}}]} ``` --- --- title: Defend content with Scrape Shield description: Protect content from scraping and hotlinking. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Defend content with Scrape Shield Scrape Shield is a collection of settings meant to protect your site's content. ## Email Address Obfuscation [Email Address Obfuscation](https://edgetunnel-b2h.pages.dev/waf/tools/scrape-shield/email-address-obfuscation/) uses JavaScript to encrypt addresses and prevents harvesting by spammers and bots while keeping addresses easy to read and use for human visitors. ## Hotlink Protection [Hotlink Protection](https://edgetunnel-b2h.pages.dev/waf/tools/scrape-shield/hotlink-protection/) prevents your images from being used by other sites, which can reduce the bandwidth consumed by your origin server. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/defend-content/#page","headline":"Defend content with Scrape Shield · Cloudflare Learning Paths","description":"Protect content from scraping and hotlinking.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/defend-content/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/defend-content/","name":"Defend content with Scrape Shield"}}]} ``` --- --- title: What to do when under attack description: Respond to active DDoS attacks. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # What to do when under attack ## Enable "I'm Under Attack" mode (IAUM) If you are under attack and have this feature enabled during the attack, visitors will receive an interstitial page for about five seconds while the traffic is analyzed to make sure it is a legitimate human visitor. The vast majority of Layer 7 attack scripts are defeated by IUAM and can be honed via Page Rules. Refer to [I'm Under Attack Mode ↗](https://edgetunnel-b2h.pages.dev/fundamentals/reference/under-attack-mode/) for more information. ## Change Access Control List (ACL) An ACL refers to rules that are applied to port numbers or IP addresses that are available on a host permitting use of the service. When you only allow Cloudflare IPs, you eliminate threats attempting to attack your origin IP range. Refer to [Cloudflare IP Ranges ↗](https://www.cloudflare.com/ips) for more information. ## Change Origin IPs and update Cloudflare DNS records If your origin is still being attacked, consider moving your Origin IPs and updating your Cloudflare DNS records. Refer to [Prevent DDoS attacks](https://edgetunnel-b2h.pages.dev/learning-paths/prevent-ddos-attacks/concepts/) for detailed guidance. Note To learn about best practices for DDoS protection, review [Proactive DDoS defense](https://edgetunnel-b2h.pages.dev/ddos-protection/best-practices/proactive-defense/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/enable-iaum/#page","headline":"What to do when under attack · Cloudflare Learning Paths","description":"Respond to active DDoS attacks.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/enable-iaum/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/enable-iaum/","name":"What to do when under attack"}}]} ``` --- --- title: Prepare for surges and mitigate DDoS attacks description: Reduce server strain during traffic surges. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Prepare for surges and mitigate DDoS attacks ## Reduce server strain Utilize Cloudflare's [caching](https://edgetunnel-b2h.pages.dev/cache/) to enhance load times and reduce server strain. Also, features like the [Waiting Room](https://edgetunnel-b2h.pages.dev/waiting-room) and [Rate Limiting](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/) can be used to effectively manage excess demand and ensure a stable user experience. ## Unlimited DDoS Protection Cloudflare's Advanced [DDoS protection](https://edgetunnel-b2h.pages.dev/ddos-protection/) is always on for Enterprise customers and is used to mitigate DDoS attacks of all forms and sizes including those that target UDP and ICMP protocols, as well as SYN/ACK, DNS amplification, SMURF, and Layer 7 attacks. ## Browser Integrity Check [Browser Integrity Check](https://edgetunnel-b2h.pages.dev/waf/tools/browser-integrity-check/) looks for requests with HTTP headers commonly used by spammers, bots, and crawlers such as requests with a missing or non-standard user agent. If a threat is found, Cloudflare will present a challenge page before allowing access. This may affect your API and can be selectively disabled using [Page Rules](https://edgetunnel-b2h.pages.dev/rules/page-rules/). ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/prepare-for-surges/#page","headline":"Prepare for surges and mitigate DDoS attacks · Cloudflare Learning Paths","description":"Reduce server strain during traffic surges.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/prepare-for-surges/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/prepare-for-surges/","name":"Prepare for surges and mitigate DDoS attacks"}}]} ``` --- --- title: Secure against attacks description: Proxy all subdomains through Cloudflare. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Secure against attacks Review the different actions you can take to secure your website against attacks. ## Orange cloud all proper subdomains When a subdomain is set to Proxied (also known as orange-clouded), Cloudflare proxying is active for that record and the record will resolve to a Cloudflare IP. Refer to [Proxy status](https://edgetunnel-b2h.pages.dev/dns/proxy-status/) for more information. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/secure-against-attacks/#page","headline":"Secure against attacks · Cloudflare Learning Paths","description":"Proxy all subdomains through Cloudflare.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/security/secure-against-attacks/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/security/","name":"Security"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/security/secure-against-attacks/","name":"Secure against attacks"}}]} ``` --- --- title: Support description: Prepare your site for traffic surges. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Support ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/support/#page","headline":"Support · Cloudflare Learning Paths","description":"Prepare your site for traffic surges.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/support/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/support/","name":"Support"}}]} ``` --- --- title: Support resources description: Access Cloudflare support and resources. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Support resources | Support type | Resource | | ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Self-serve questions | [https://support.cloudflare.com ↗](https://support.cloudflare.com) [https://edgetunnel-b2h.pages.dev/fundamentals ↗](https://edgetunnel-b2h.pages.dev/fundamentals) | | Strategic guidance and best practices (proactive) | Reach out to your dedicated account team | | Non-critical production issues (reactive) | \- [Support portal ↗](https://dash.cloudflare.com/?to=/:account/support) \- Dashboard chat | | Critical issues such as attacks (reactive) | \- Call the 24/7 Emergency Support line - [www.cloudflare.com/ecp/support ↗](http://www.cloudflare.com/ecp/support) (global lines) | Note For security reasons, Cloudflare Support only assists individuals whose email addresses are validated against the list of registered account contacts. Review and update all contacts accordingly in your Cloudflare Dashboard. For more information, refer to [Manage members](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/). ## Additional resources * For help with an issue, refer to [guidance for submitting support tickets](https://edgetunnel-b2h.pages.dev/support/contacting-cloudflare-support/). * Reference our [Support Docs](https://edgetunnel-b2h.pages.dev/support/), including [Priority definitions](https://edgetunnel-b2h.pages.dev/support/contacting-cloudflare-support/#priority-definitions). * Learn the basic countermeasures to [prevent an ongoing DDoS attack](https://edgetunnel-b2h.pages.dev/ddos-protection/best-practices/proactive-defense/). * Let [Cloudflare's Security Operations Center-as-a-Service (SOC) ↗](https://www.cloudflare.com/soc-as-a-service/) monitor your environment for volumetric security threats and potential operational disruptions, perform analysis to identify attack vectors, and help you implement countermeasures to mitigate future incidents. * If a customer has purchased Technical Account Management Service, utilize the [Technical Account Management Service ↗](https://www.cloudflare.com/technical-account-management-service/) which operates as an extension of your team, as the Cloudflare support expert who knows your tech stack, unique infrastructure, and Cloudflare portfolio requirements. * Learn [what's new ↗](https://www.cloudflare.com/whats-new/) and subscribe to product release email summaries. * Read the [Cloudflare blog ↗](https://blog.cloudflare.com/) for the latest announcements from Cloudflare. * Refer to the [Cloudflare Community ↗](https://community.cloudflare.com/) to seek advice and share insights about using Cloudflare with other Cloudflare users. * [Maximize Revenue and Minimize Risk in Peak Season webinar ↗](https://www.google.com/url?q=https://cloudflare.ondemand.goldcast.io/on-demand/28262595-9ddf-4e26-91bf-241117f4b5fe&sa=D&source=docs&ust=1758134183832896&usg=AOvVaw3-v4hp23nSzNj0s6j-xxyc) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/support/resources/#page","headline":"Support resources · Cloudflare Learning Paths","description":"Access Cloudflare support and resources.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/surge-readiness/support/resources/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/surge-readiness/support/","name":"Support"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/surge-readiness/support/resources/","name":"Support resources"}}]} ``` --- --- title: Overview description: Learn Cloudflare WARP client basics and diagnostics. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Overview ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/#page","headline":"Overview · Cloudflare Learning Paths","description":"Learn Cloudflare WARP client basics and diagnostics.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/warp-overview-course/series/","name":"Overview"}}]} ``` --- --- title: Understand Cloudflare WARP basics description: Learn WARP client modes and configuration. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Understand Cloudflare WARP basics * [ Watch this episode ](#tab-panel-10148) * [ Series overview ](#tab-panel-10149) In this episode, we explain the core features of the Cloudflare WARP client and how to troubleshoot common issues. After watching, you will have an understanding of the GUI, the differences between the consumer and corporate WARP, device profiles, the various operating modes of WARP, split tunneling and more. Chapters * ![Introduction and WARP GUI Basics](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction and WARP GUI Basics** 0s * ![Consumer vs. Corporate WARP](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=57s) **Consumer vs. Corporate WARP** 57s * ![Device Profiles Explained](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=95s) **Device Profiles Explained** 1m35s * ![WARP Operating Modes](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=132s) **WARP Operating Modes** 2m12s * ![Split Tunneling](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=224s) **Split Tunneling** 3m44s * ![Conclusion](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=296s) **Conclusion** 4m56s **Related content** Explore the following resources on WARP, device profiles, operating modes, and split tunneling: * [Introduction to Cloudflare WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) * [Set up WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/set-up/) * [Configure Device Profiles for Cloudflare WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) * [Cloudflare WARP Operating Modes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/) * [Split Tunneling with Cloudflare WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) * [WARP troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/) [ Watch Episode 1: Understand and troubleshoot Cloudflare WARP ](https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-1/) In this episode, we explain the core features of the Cloudflare WARP client and how to troubleshoot common issues. [ Watch Episode 2: WARP diagnostic logs ](https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-2/) In this episode, we explain how to troubleshoot Cloudflare WARP by analyzing diagnostic logs and understand how the client connects in different modes. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-1/#page","headline":"Understand Cloudflare WARP basics · Cloudflare Learning Paths","description":"Learn WARP client modes and configuration.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/warp-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/warp-overview-course/series/warp-basics-1/","name":"Understand Cloudflare WARP basics"}}]} ``` --- --- title: WARP diagnostic logs description: Analyze WARP diagnostic log files. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # WARP diagnostic logs * [ Watch this episode ](#tab-panel-10150) * [ Series overview ](#tab-panel-10151) In this more advanced episode, we explain how to use warp-diag files to identify and resolve connection issues with the WARP client. You will learn how to locate and interpret three key files: `warp-status`, `warp-settings`, and `daemon.log`. The video also provides troubleshooting tips including specific keyword searches and guidance on how to cross-reference logs to identify a bigger picture of the problem. Chapters * ![Introduction](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=0s) **Introduction** 0s * ![What are warp-diag files?](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=44s) **What are warp-diag files?** 44s * ![How to download and navigate warp-diag files](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=76s) **How to download and navigate warp-diag files** 1m16s * ![warp-status.txt](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=126s) **warp-status.txt** 2m06s * ![warp-settings.txt](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=149s) **warp-settings.txt** 2m29s * ![daemon.log](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=217s) **daemon.log** 3m37s * ![Addition tips](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=487s) **Addition tips** 8m07s * ![Conclusion](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/c29964ab3dcf7c3432ebb2b4e93c3aca/thumbnails/thumbnail.jpg?fit=crop&time=523s) **Conclusion** 8m43s **Related content** Explore the following resources on WARP, device profiles, operating modes, and split tunneling: * [Introduction to Cloudflare WARP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) * [WARP troubleshooting guide](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/troubleshooting-guide/) [ Watch Episode 1: Understand and troubleshoot Cloudflare WARP ](https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-1/) In this episode, we explain the core features of the Cloudflare WARP client and how to troubleshoot common issues. [ Watch Episode 2: WARP diagnostic logs ](https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-2/) In this episode, we explain how to troubleshoot Cloudflare WARP by analyzing diagnostic logs and understand how the client connects in different modes. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-2/#page","headline":"WARP diagnostic logs · Cloudflare Learning Paths","description":"Analyze WARP diagnostic log files.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/warp-overview-course/series/warp-basics-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/warp-overview-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/warp-overview-course/series/warp-basics-2/","name":"WARP diagnostic logs"}}]} ``` --- --- title: Concepts description: Build and deploy serverless applications with Workers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Concepts ## Workers concepts Learn the concepts behind what makes Cloudflare Workers reliable, scalable and fast. ## Objectives By the end of this module, you will learn: * What Cloudflare is. * The difference between serverless computing and cloud computing paradigms. * How Workers works. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/#page","headline":"Concepts · Cloudflare Learning Paths","description":"Build and deploy serverless applications with Workers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/concepts/","name":"Concepts"}}]} ``` --- --- title: Introduction to Cloudflare description: Learn about Cloudflare's network and products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Introduction to Cloudflare [Cloudflare ↗](https://www.cloudflare.com/learning/what-is-cloudflare/) is a global network of [servers ↗](https://www.cloudflare.com/learning/cdn/glossary/edge-server/). It is one of the largest [networks ↗](https://www.cloudflare.com/network/) on the Internet. Cloudflare's product offering is composed of [SASE and SSE services ↗](https://www.cloudflare.com/zero-trust/), [application ↗](https://www.cloudflare.com/application-services/) and [infrastructure services ↗](https://www.cloudflare.com/network-services/), and [Developer Platform ↗](https://www.cloudflare.com/developer-platform/solutions/). Cloudflare's products offer something to developers, private and public organizations, businesses, governments, and individual consumers. ## Cloudflare Developer Platform The [Cloudflare Developer Platform ↗](https://www.cloudflare.com/developer-platform/products/) includes [Cloudflare Workers](https://edgetunnel-b2h.pages.dev/workers/), which allows you to deploy serverless code instantly across the globe. You will learn more about [the Developer Platform in this module](https://edgetunnel-b2h.pages.dev/learning-paths/workers/devplat/). ## Built on Cloudflare If your application is built on Cloudflare, then Cloudflare would act as the origin server of your application. An example tech stack for an application built on Cloudflare would look like: * [Domain Registrar](https://edgetunnel-b2h.pages.dev/registrar/) to buy a new your domain. * [Cloudflare Pages](https://edgetunnel-b2h.pages.dev/pages/) to configure and deploy a front-end site. * [Cloudflare Workers](https://edgetunnel-b2h.pages.dev/workers/) or [Pages Functions](https://edgetunnel-b2h.pages.dev/pages/functions/) (which are Workers under the hood) to add dynamic functionality to your site. * [Storage resources](https://edgetunnel-b2h.pages.dev/workers/platform/storage-options/) to persist different types of data. * [Application security (DDoS protection, WAF, and more) ↗](https://www.cloudflare.com/application-services/products/#security-services) to secure your site. * [Application performance (CDN, Load Balancing, and more) ↗](https://www.cloudflare.com/application-services/products/#performance-services) to customize and enhance your site's performance. * [AI](https://edgetunnel-b2h.pages.dev/use-cases/ai/) to run machine learning models. And more depending on your use case. ## Built with Cloudflare When you add your application to Cloudflare, Cloudflare's global network of servers will sit in between requests to your application and your application's [origin server ↗](https://www.cloudflare.com/learning/cdn/glossary/origin-server/). ![Cloudflare sits in between requests and your origin server.](https://edgetunnel-b2h.pages.dev/_astro/website-with-cloudflare.D3VGvGsa_Z19Ojss.svg) After you add your application to [Cloudflare](https://edgetunnel-b2h.pages.dev/fundamentals/concepts/how-cloudflare-works/), you can: * Use Workers to augment the application by deploying code. * Add storage resources available on the Developer Platform. * Enhance your application's performance by speeding up content delivery and user experience ([CDN ↗](https://www.cloudflare.com/learning/cdn/what-is-a-cdn/)). * Protect your website from malicious activity ([DDoS ↗](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/) by configuring the [Web Application Firewall ↗](https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/)). * Route traffic ([Load balancing](https://edgetunnel-b2h.pages.dev/load-balancing/), [Waiting Room](https://edgetunnel-b2h.pages.dev/waiting-room/)). And more depending on your use case. ## Summary By reading this page, you have: * Learned the scale of Cloudflare's global network. * Explored the product offering to know what Cloudflare can offer for users like you. * Reviewed how you can build your applications with Cloudflare and Cloudflare Workers. In the next section, you will be introduced to the fundamentals of serverless computing, the concept behind Cloudflare Workers. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/cloudflare-intro/#page","headline":"Introduction to Cloudflare · Cloudflare Learning Paths","description":"Learn about Cloudflare's network and products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/cloudflare-intro/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/concepts/cloudflare-intro/","name":"Introduction to Cloudflare"}}]} ``` --- --- title: Serverless computing description: Understand serverless versus cloud computing. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Serverless computing Cloudflare Workers allows you to build serverless applications or augment existing ones by writing code that is deployed instantly across the globe. To understand the significance of Workers technology, we begin by understanding the environment in which it was developed. Workers is a serverless computing provider. [Serverless computing ↗](https://www.cloudflare.com/learning/serverless/what-is-serverless/) refers to a cloud computing model where providers, like Cloudflare, manage servers on behalf of users, allowing developers and businesses to focus entirely on writing and deploying application logic. ## Cloud computing [Cloud computing ↗](https://www.cloudflare.com/learning/cloud/what-is-the-cloud/) is defined as hosting computing resources (such as virtual machines, storage, databases, and networking services) on third-party servers. Cloud computing service providers include Amazon Web Services, Microsoft Azure, Google Cloud Platform, and Cloudflare. ### Serverless computing Serverless computing is a subset of cloud computing. Serverless computing is a method of providing backend services on an as-used basis. A serverless provider allows users to write and deploy code without the hassle of worrying about the underlying infrastructure. Serverless computing has unique characteristics that set it apart from other cloud computing models. #### Resource management Cloud computing allows organizations to rent a fixed number of servers or server space. To prepare for seasonal or unplanned spikes in request traffic to their applications, organizations may overpurchase server space to ensure their applications do not go down because of high request volume from end users or customers. In the serverless computing model, organizations and individuals are not required to calculate how much server space or machines they need to rent. Serverless computing providers take care of server management, and provisioning, allowing developers and organizations to focus on writing and deploying logic. Serverless computing providers scale automatically to handle surges and low points in request traffic. The serverless computing provider is responsible for the scalability of your application and will work to match resources to the volume of requests your application is receiving, ensuring your application stays online. #### Execution model Serverless computing providers differ in their approach to how your application's code is executed. Many serverless computing providers, like Cloudflare, use an event-driven model. When an event (such as an HTTP request or a [Cron Trigger](https://edgetunnel-b2h.pages.dev/workers/configuration/cron-triggers/)) invokes a Worker, the Worker code will execute. The total amount of time from the start to end of an invocation of a Worker is known as [duration](https://edgetunnel-b2h.pages.dev/workers/platform/limits/#duration). The amount of time the CPU actually spends doing work during a given request is known as [CPU time](https://edgetunnel-b2h.pages.dev/workers/platform/pricing/#workers). #### Billing model Developers and organizations using serverless computing are billed on a usage model paradigm. Instead of paying for a fixed amount of computing resources that may be underutilized or exceeded, users pay as much as they use in the serverless model. Usage is defined differently per serverless computing provider. Usage in Workers is defined as CPU time. ## Summary By reading this page, you have: * Been introduced to the serverless computing concept that is behind Cloudflare Workers. * Reviewed the differences between legacy on-premise and cloud computing infrastructure. * Analyzed the key differences between the cloud computing and serverless computing paradigms. In the next section, you will learn about what makes Workers, a serverless computing platform that is part of the larger Cloudflare Developer Platform, unique in its architecture from other serverless computing providers. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/serverless-computing/#page","headline":"Serverless computing · Cloudflare Learning Paths","description":"Understand serverless versus cloud computing.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/serverless-computing/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/concepts/serverless-computing/","name":"Serverless computing"}}]} ``` --- --- title: Cloudflare Workers description: Learn Workers runtime and execution model. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Cloudflare Workers Cloudflare Workers gives developers the power to deploy serverless code instantly to Cloudflare's global network. Cloudflare Workers significantly differs from other serverless computing providers in its execution model and architecture. ## What you can do with Workers A single Worker project can have logic as complex or as simple as the developer desires. A project of smaller scale might look like a Worker that [returns a small HTML page](https://edgetunnel-b2h.pages.dev/workers/examples/return-html/) on a single route. A more complex Worker project would span multiple domains, multiple routes for each domain, and different logic for each route. The developer decides the architectural complexity of their Worker project. Your application can be made up of multiple Workers that work together and deliver a single experience to end users. Workers can also integrate with other Cloudflare Developer Platform functionality such as storage, media and AI. You will learn more about this in the [Developer Platform module](https://edgetunnel-b2h.pages.dev/learning-paths/workers/devplat/). ## Runtime The [Workers runtime ↗](https://blog.cloudflare.com/workerd-open-source-workers-runtime) is designed to be JavaScript-standards compliant and web-interoperable. The Workers runtime uses the V8 engine — the same engine used by Chromium and Node.js, and has an open-source version, [workerd ↗](https://github.com/cloudflare/workerd). ## Execution The Cloudflare Workers runtime runs in every data center of [Cloudflare's global network ↗](https://www.cloudflare.com/network/). Every Worker run within its own isolate. Isolate architecture is what makes Workers efficient. ### Isolates Workers uses [isolates](https://edgetunnel-b2h.pages.dev/workers/reference/how-workers-works/#isolates): lightweight contexts that provide your code with variables it can access and a safe environment to be executed within. You could even consider an isolate a sandbox for your function to run in. A single instance of the runtime can run hundreds or thousands of isolates, seamlessly switching between them. Each isolate's memory is completely isolated, so each piece of code is protected from other untrusted or user-written code on the runtime. Isolates are also designed to start very quickly. Instead of creating a virtual machine for each function, an isolate is created within an existing environment. This model eliminates the cold starts of the virtual machine model. Unlike other serverless providers which use [containerized processes ↗](https://www.cloudflare.com/learning/serverless/serverless-vs-containers/) each running an instance of a language runtime, Workers pays the overhead of a JavaScript runtime once on the start of a container. Workers processes are able to run essentially limitless scripts with almost no individual overhead. Any given isolate can start around a hundred times faster than a Node process on a container or virtual machine. Notably, on startup isolates consume an order of magnitude less memory. Scheduling and routing Scheduling and routing HTTP client HTTP client HTTP server HTTP server Inbound HTTP proxy \[Not supported by viewer\] Outbound HTTP proxy \[Not supported by viewer\] Supervisor \[Not supported by viewer\] Main Runtime Process Main Runtime Process Outer Sandbox Outer Sandbox Disk Disk Control plane \[Not supported by viewer\] HTTP \[Not supported by viewer\] Cap'n Proto RPC \[Not supported by viewer\] In-process calls \[Not supported by viewer\] Other \[Not supported by viewer\] V8 Isolate \[Not supported by viewer\] V8 Isolate \[Not supported by viewer\] V8 Isolate \[Not supported by viewer\] V8 Isolate \[Not supported by viewer\] Process Sandbox \[Not supported by viewer\] V8 Isolate \[Not supported by viewer\] Scheduling and routing Scheduling and routing Process Sandbox \[Not supported by viewer\] V8 Isolate \[Not supported by viewer\] Scheduling and routing Scheduling and routing ## Compute per request Most Workers are a variation on the default Workers flow: * [ JavaScript ](#tab-panel-10152) * [ TypeScript ](#tab-panel-10153) **JavaScript** ```js export default { async fetch(request, env, ctx) { return new Response('Hello World!'); }, }; ``` **TypeScript** ```ts export default { async fetch(request, env, ctx): Promise { return new Response('Hello World!'); }, } satisfies ExportedHandler; ``` For Workers written in [ES modules syntax](https://edgetunnel-b2h.pages.dev/workers/reference/migrate-to-module-workers/), when a request to your `*.workers.dev` subdomain or to your Cloudflare-managed domain is received by any of Cloudflare's data centers, the request invokes the [fetch() handler](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/handlers/fetch/) defined in your Worker code with the given request. You can respond to the request by returning a [Response](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/response/) object. ## Summary By reading this page, you have learned: * The basics of how Worker projects are organized. * The fundamentals of how Workers execute on the Cloudflare network. * How the request to response flow executes. In the next module, you build and deploy your first Worker to the Cloudflare global network. ## Related resources * [Cloud computing without containers ↗](https://blog.cloudflare.com/cloud-computing-without-containers) \- A blog post detailing the containers versus isolates difference in the context of Cloudflare. * [How Workers works](https://edgetunnel-b2h.pages.dev/workers/reference/how-workers-works/) \- Learn the difference between the Workers runtime versus traditional browsers and Node.js. * [How the cache works](https://edgetunnel-b2h.pages.dev/workers/reference/how-the-cache-works/) \- Learn how Workers interacts with the Cloudflare cache. ## Feedback To improve this learning path or report any missing or incorrect information, [file an issue on GitHub ↗](https://github.com/cloudflare/cloudflare-docs/issues/new/choose). ## Community Connect with the [Cloudflare Developer Platform community on Discord ↗](https://discord.cloudflare.com) to ask questions, share what you are building, and discuss the platform with other developers. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/workers-concepts/#page","headline":"Cloudflare Workers · Cloudflare Learning Paths","description":"Learn Workers runtime and execution model.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/concepts/workers-concepts/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/concepts/","name":"Concepts"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/concepts/workers-concepts/","name":"Cloudflare Workers"}}]} ``` --- --- title: Learn about Cloudflare's Developer Platform description: Build and deploy serverless applications with Workers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Learn about Cloudflare's Developer Platform ## Build applications with Cloudflare's Developer Platform The Cloudflare Developer Platform allows you to build full-stack applications with Workers. ## Objectives By the end of this module, you will learn: * Cloudflare Developer Platform's product offering. * What storage options are available to your Worker. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/devplat/#page","headline":"Learn about Cloudflare's Developer Platform · Cloudflare Learning Paths","description":"Build and deploy serverless applications with Workers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/devplat/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/devplat/","name":"Learn about Cloudflare's Developer Platform"}}]} ``` --- --- title: Cloudflare Developer Platform description: Explore Cloudflare's developer platform products. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Cloudflare Developer Platform The [Cloudflare Developer Platform ↗](https://www.cloudflare.com/developer-platform/products/) offers various services to empower developers to build full-stack applications, including: [compute ↗](https://www.cloudflare.com/developer-platform/products/#compute), [storage ↗](https://www.cloudflare.com/developer-platform/products/#storage), [web development, image optimization, video streaming ↗](https://www.cloudflare.com/developer-platform/products/#webdev) and [AI ↗](https://ai.cloudflare.com/). It is important to note that the developer platform product offering is growing with new releases and features updates. To review a list of product documentation related to Cloudflare Developer Platform: 1. Go to [Cloudflare Docs ↗](https://edgetunnel-b2h.pages.dev). 2. Select **Product directory** in the top menu. 3. Select the **Developer platform** filter to view [product documentation for Cloudflare Developer Platform products](https://edgetunnel-b2h.pages.dev/directory/?product-group=Developer+platform). ## Web development [Cloudflare Pages](https://edgetunnel-b2h.pages.dev/pages/) allows you to build full-stack applications at scale. With Pages, you can deploy front-end applications using [C3, Git integration or Direct Upload](https://edgetunnel-b2h.pages.dev/pages/get-started/). Pages supports a large set of frameworks including [Astro](https://edgetunnel-b2h.pages.dev/pages/framework-guides/deploy-an-astro-site/), [Gatsby](https://edgetunnel-b2h.pages.dev/pages/framework-guides/deploy-a-gatsby-site/), [Hugo](https://edgetunnel-b2h.pages.dev/pages/framework-guides/deploy-a-hugo-site/), [Next.js](https://edgetunnel-b2h.pages.dev/pages/framework-guides/nextjs/), [Nuxt](https://edgetunnel-b2h.pages.dev/pages/framework-guides/deploy-a-nuxt-site/), [React](https://edgetunnel-b2h.pages.dev/pages/framework-guides/deploy-a-react-site/), [Remix](https://edgetunnel-b2h.pages.dev/pages/framework-guides/deploy-a-remix-site/), and [more](https://edgetunnel-b2h.pages.dev/pages/framework-guides/). ## Compute **Cloudflare Workers** As you have learned in previous sections, [Cloudflare Workers](https://edgetunnel-b2h.pages.dev/workers/) allow you to build and deploy serverless applications instantly across the globe. To explore what you can build with Workers, refer to [Examples](https://edgetunnel-b2h.pages.dev/workers/examples/) and [Tutorials](https://edgetunnel-b2h.pages.dev/workers/tutorials/). **Email Routing** [Cloudflare Email Routing](https://edgetunnel-b2h.pages.dev/email-service/) allows you to create custom email addresses for your domain and route incoming emails to your preferred mailbox. If you already have a website, refer to [Enable Email Routing](https://edgetunnel-b2h.pages.dev/email-service/get-started/route-emails/) to set up a custom email address for your site. ## Storage Cloudflare storage offerings differ per use case. | Use-case | Product | Ideal for | | ----------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Key-value storage | [Workers KV](https://edgetunnel-b2h.pages.dev/kv/) | Configuration data, service routing metadata, personalization (A/B testing) | | Object storage / blob storage | [R2](https://edgetunnel-b2h.pages.dev/r2/) | User-facing web assets, images, machine learning and training datasets, analytics datasets, log and event data. | | Accelerate a Postgres or MySQL database | [Hyperdrive](https://edgetunnel-b2h.pages.dev/hyperdrive/) | Connecting to an existing database in a cloud or on-premise using your existing database drivers & ORMs. | | Global coordination & stateful serverless | [Durable Objects](https://edgetunnel-b2h.pages.dev/durable-objects/) | Building collaborative applications; global coordination across clients; real-time WebSocket applications; strongly consistent, transactional storage. | | Lightweight SQL database | [D1](https://edgetunnel-b2h.pages.dev/d1/) | Relational data, including user profiles, product listings and orders, and/or customer data. | | Task processing, batching and messaging | [Queues](https://edgetunnel-b2h.pages.dev/queues/) | Background job processing (emails, notifications, APIs), message queuing, and deferred tasks. | | Vector search & embeddings queries | [Vectorize](https://edgetunnel-b2h.pages.dev/vectorize/) | Storing [embeddings](https://edgetunnel-b2h.pages.dev/workers-ai/models/?tasks=Text+Embeddings) from AI models for semantic search and classification tasks. | | Streaming ingestion | [Pipelines](https://edgetunnel-b2h.pages.dev/pipelines/) | Streaming data ingestion and processing, including clickstream analytics, telemetry/log data, and structured data for querying | | Time-series metrics | [Analytics Engine](https://edgetunnel-b2h.pages.dev/analytics/analytics-engine/) | Write and query high-cardinality time-series data, usage metrics, and service-level telemetry using Workers and/or SQL. | For a detailed guide to choosing the correct storage option, refer to [Choose a data or storage product](https://edgetunnel-b2h.pages.dev/workers/platform/storage-options/). ## Image optimization and video streaming [Cloudflare Stream](https://edgetunnel-b2h.pages.dev/stream/) and [Cloudflare Images](https://edgetunnel-b2h.pages.dev/images/) deliver videos and pictures to your end-users without configuring or maintaining infrastructure. ## AI [Workers AI](https://edgetunnel-b2h.pages.dev/workers-ai/) allow you to build and deploy AI applications that run machine learning models powered by serverless GPUs. ## Summary You have learned: * More about what the Cloudflare Developer Platform offers. * The difference between compute, storage, application development, and AI products. ## Feedback To improve this learning path, [file an issue on GitHub ↗](https://github.com/cloudflare/cloudflare-docs/issues/new/choose). ## Community Connect with the [Cloudflare Developer Platform community on Discord ↗](https://discord.cloudflare.com) to ask questions, share what you are building, and discuss the platform with other developers. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/devplat/intro-to-devplat/#page","headline":"Cloudflare Developer Platform · Cloudflare Learning Paths","description":"Explore Cloudflare's developer platform products.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/devplat/intro-to-devplat/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-06-09","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/devplat/","name":"Learn about Cloudflare's Developer Platform"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/devplat/intro-to-devplat/","name":"Cloudflare Developer Platform"}}]} ``` --- --- title: Deploy your first Worker description: Build and deploy serverless applications with Workers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Deploy your first Worker Deploy your first Worker to the Cloudflare global network by ## Objectives By the end of this module, you will learn: * The difference between C3 (`create-cloudflare` CLI) and Wrangler. * How to use the Cloudflare dashboard to manage your Workers. * How to create and deploy your first Worker. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/#page","headline":"Deploy your first Worker · Cloudflare Learning Paths","description":"Build and deploy serverless applications with Workers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/get-started/","name":"Deploy your first Worker"}}]} ``` --- --- title: C3 & Wrangler description: Use C3 and Wrangler CLI for Workers. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # C3 & Wrangler Before deploying your first Worker, learn about the CLI tools you will use to build and deploy your Worker project. ## Cloudflare dashboard You can build and develop your Worker on the Cloudflare dashboard, without needing to install and use C3 and Wrangler. Continue to the next page to get started with Workers on the Cloudflare dashboard. ## CLI The Cloudflare Developer Platform ecosystem has two command-line interfaces (CLI): * C3: To create new projects. * Wrangler: To build and deploy your projects. ## C3 [C3](https://edgetunnel-b2h.pages.dev/pages/get-started/c3/) (`create-cloudflare` CLI) is a command-line tool designed to help you set up and deploy new applications to Cloudflare. In addition to speed, it leverages officially developed templates for Workers and framework-specific setup guides to ensure each new application that you set up follows Cloudflare and any third-party best practices for deployment on the Cloudflare network. You will use C3 for new project creation. ## Wrangler [Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/) is a command-line tool for building with Cloudflare developer products. With Wrangler, you can [develop](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#dev) your Worker locally and remotely, [roll back](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#rollback) to a previous deployment of your Worker, [delete](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#delete) a Worker and its bound Developer Platform resources, and more. Refer to [Wrangler Commands](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/) to view the full reference of Wrangler commands. When you run C3 to create your project, C3 will install the latest version of Wrangler and you do not need to install Wrangler again. You can [update Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/install-and-update/#update-wrangler) to a newer version in your project to access new Wrangler capabilities and features. ## Source of truth If you are building your Worker on the Cloudflare dashboard, you will set up your project configuration (such as environment variables, bindings, and routes) through the dashboard. If you are building your project programmatically using C3 and Wrangler, you will rely on a [Wrangler configuration file](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/) to configure your Worker. Cloudflare recommends choosing and using one [source of truth](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/#source-of-truth), the dashboard or the [Wrangler configuration file](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/), to avoid errors in your project. ## Summary By reading this page, you have learned: * How to use C3 to create new Workers and Pages projects. * How to use Wrangler to develop, configure, and delete your projects. In the next section, you will learn more about the Cloudflare dashboard before moving on to deploy your first Worker. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/c3-and-wrangler/#page","headline":"C3 & Wrangler · Cloudflare Learning Paths","description":"Use C3 and Wrangler CLI for Workers.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/c3-and-wrangler/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/get-started/","name":"Deploy your first Worker"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/get-started/c3-and-wrangler/","name":"C3 & Wrangler"}}]} ``` --- --- title: First application description: Build an AI application with Hono. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # First application ## Build an AI application with Hono and Workers If you have already created your first Worker and want to learn what more you can do with your project, review the following Learn Cloudflare Workers course for beginners. In this course, you will: * Deploy your first Worker. * Develop your application locally. * Add the Hono framework to your project. * Integrate Workers AI into your project. Find [the video on YouTube ↗](https://youtu.be/H7Qe96fqg1M?si=GVkdGLrmb1faiHma) and explore other Cloudflare Workers tutorials. In the next section, you will learn about the Cloudflare Developer Platform. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/first-application/#page","headline":"First application · Cloudflare Learning Paths","description":"Build an AI application with Hono.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/first-application/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"},"keywords":["Hono"]} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/get-started/","name":"Deploy your first Worker"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/get-started/first-application/","name":"First application"}}]} ``` --- --- title: First Worker description: Build and deploy your first Worker. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # First Worker ## Build and deploy your first Worker You can deploy your first Worker via the Cloudflare dashboard or programmatically using your terminal. You must have a Cloudflare account to create a Worker. To get started with Cloudflare, refer to [Create account](https://edgetunnel-b2h.pages.dev/fundamentals/account/create-account/). ### Via the Cloudflare dashboard To create your first Worker using the Cloudflare dashboard: 1. In the Cloudflare dashboard, go to the **Workers & Pages** page. [ Go to **Workers & Pages** ](https://dash.cloudflare.com/?to=/:account/workers-and-pages) 2. Select **Create application**. 3. Select **Create Worker** \> **Deploy**. ### Via C3 and Wrangler #### Prerequisites 1. Sign up for a [Cloudflare account ↗](https://dash.cloudflare.com/sign-up/workers-and-pages). 2. Install [Node.js ↗](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm). Node.js version manager Use a Node version manager like [Volta ↗](https://volta.sh/) or [nvm ↗](https://github.com/nvm-sh/nvm) to avoid permission issues and change Node.js versions. [Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/install-and-update/), discussed later in this guide, requires a Node version of `16.17.0` or later. #### Create and deploy your first Worker [C3 (create-cloudflare-cli) ↗](https://github.com/cloudflare/workers-sdk/tree/main/packages/create-cloudflare) is a command-line tool designed to help you set up and deploy new applications to Cloudflare. In addition to speed, it leverages officially developed templates for Workers and framework-specific setup guides to ensure each new application that you set up follows Cloudflare and any third-party best practices for deployment on the Cloudflare network. To create your Worker project, run: npm yarn pnpm ``` npm create cloudflare@latest -- first-worker ``` ``` yarn create cloudflare first-worker ``` ``` pnpm create cloudflare@latest first-worker ``` This will prompt you to install the [create-cloudflare ↗](https://www.npmjs.com/package/create-cloudflare) package, and lead you through setup. For setup, select the following options: * For _What would you like to start with?_, choose `Hello World example`. * For _Which template would you like to use?_, choose `Worker only`. * For _Which language do you want to use?_, choose `JavaScript`. * For _Do you want to use git for version control?_, choose `Yes`. * For _Do you want to deploy your application?_, choose `No` (we will be making some changes before deploying). You will be asked if you would like to deploy the project to Cloudflare. * If you choose to deploy, you will be asked to authenticate (if not logged in already), and your project will be deployed to the Cloudflare global network and available on your custom [workers.dev subdomain](https://edgetunnel-b2h.pages.dev/workers/configuration/routing/workers-dev/). * If you choose not to deploy, go to the newly created project directory to begin writing code. Deploy your project by running the [wrangler deploy](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#deploy) command. Refer to [How to run Wrangler commands](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/#how-to-run-wrangler-commands) to learn how to run Wrangler commands according to your package manager. In your Worker project directory, C3 has generated the following: 1. `wrangler.jsonc`: Your [Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/#sample-wrangler-configuration) configuration file. 2. `index.js` (in `/src`): A minimal `'Hello World!'` Worker written in [ES module](https://edgetunnel-b2h.pages.dev/workers/reference/migrate-to-module-workers/) syntax. 3. `package.json`: A minimal Node dependencies configuration file. 4. `package-lock.json`: Refer to [npm documentation on package-lock.json ↗](https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json). 5. `node_modules`: Refer to [npm documentation node\_modules ↗](https://docs.npmjs.com/cli/v7/configuring-npm/folders#node-modules). To continue building your Worker, open the `index.js` file to write your code. Refer to [Examples](https://edgetunnel-b2h.pages.dev/workers/examples/) to use ready-made code you can experiment with. ## Summary You have learned how to: * Create and deploy a Worker project using the Cloudflare dashboard and programmatically, using your terminal. In the next section, you can follow a video tutorial to create your first Cloudflare Workers application. ### Related resources * [Get started guide](https://edgetunnel-b2h.pages.dev/workers/get-started/guide/) \- Create a new Worker with Cloudflare Workers' Get started guide. ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/first-worker/#page","headline":"First Worker · Cloudflare Learning Paths","description":"Build and deploy your first Worker.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workers/get-started/first-worker/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workers/get-started/","name":"Deploy your first Worker"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workers/get-started/first-worker/","name":"First Worker"}}]} ``` --- --- title: Overview description: Create durable, reliable background workflows. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Overview ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/#page","headline":"Overview · Cloudflare Learning Paths","description":"Create durable, reliable background workflows.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workflows-course/series/","name":"Overview"}}]} ``` --- --- title: Introduction to Workflows description: Cloudflare Workflows provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. Workflows are designed to resume execution even if the underlying compute fails, ensuring that tasks complete eventually. They are built on top of Cloudflare Workers and handle scaling and provisioning automatically. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Introduction to Workflows * [ Watch this episode ](#tab-panel-10154) * [ Step-by-step tutorial ](#tab-panel-10155) * [ Series overview ](#tab-panel-10156) Cloudflare Workflows provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. Workflows are designed to resume execution even if the underlying compute fails, ensuring that tasks complete eventually. They are built on top of Cloudflare Workers and handle scaling and provisioning automatically. Workflows are triggered by events, such as Event Notifications consumed from a Queue, HTTP requests, another Worker, or even scheduled timers. Individual steps within a Workflow are designed as retryable units of work. The state is persisted between steps, allowing workflows to resume from the last successful step after failures. Workflows automatically generate metrics for each step, aiding in debugging and observability. **Related content** If you want to dive into detail, refer to the following pages: * [Source code for the Punderful repository ↗](https://github.com/craigsdennis/punderful-workflows) * [Cloudflare Workflows](https://edgetunnel-b2h.pages.dev/workflows/) * [Cloudflare Workers AI](https://edgetunnel-b2h.pages.dev/workers-ai/) Punderful is a sample application that showcases the use of various Cloudflare primitives, including Workers, D1, Vectorize, Workers AI, and Workflows. The application displays a list of puns stored in a D1 database. The homepage lists the latest puns stored in D1\. The application also includes a semantic search feature powered by Vectorize. To perform a search: 1. Go to the Punderful search page. 2. Type a search query in the "Search for a pun..." input box. 3. Observe the search results appearing instantly below the search box. To demonstrate adding a new pun: 1. Go to the Punderful creation page. 2. Enter a new pun in the "Enter your pun here..." textarea. 3. Observe the preview of the pun updating as you type. 4. Click the "Submit Pun" button. When a new pun is submitted, it needs to be indexed in Vectorize for the semantic search to work. This indexing process involves creating embeddings from the pun text. This is a task suitable for background processing using Cloudflare Workflows, avoiding delays for the user in the request-response loop. ### Implementing a Workflow to Process New Puns A workflow is implemented to handle the background processing required when a new pun is submitted. #### Triggering the Workflow When a new pun is submitted via the `/api/puns` endpoint, the data is first inserted into the D1 database. Then, a new Workflow instance is created and triggered to perform the subsequent background tasks. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/index.tsx#L165) In this handler, `c.env.PUBLISH.create(crypto.randomUUID(), { punId, pun: payload.pun })` creates a new instance of the workflow bound as `PUBLISH`, assigns it a unique ID, and passes the `punId` and `pun` text as the payload. #### Defining the Workflow Class The workflow logic is defined in a class that extends `WorkflowEntrypoint`. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/workflows/publish.ts#L12) The `run` method is the entrypoint for the workflow execution. It receives the `event` containing the payload and a `step` object to define individual, durable steps. #### Workflow Steps Each discrete, retryable task in the workflow is defined using `await step.do()`. ##### Content Moderation Optionally, the workflow can perform content moderation using an external service like OpenAI's moderation API if an API key is available in the environment. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/workflows/publish.ts#L16) This step calls the OpenAI moderation API. If the content is flagged as inappropriate, the pun's status is updated in the database, and a `NonRetryableError` is thrown. Throwing a `NonRetryableError` prevents the workflow from retrying this step, as the content is permanently deemed inappropriate. ##### Creating Embeddings Next, create vector embeddings for the pun text using a Workers AI model. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/workflows/publish.ts#L34) This step uses the `@cf/baai/bge-large-en-v1.5` model from Workers AI to generate a vector embedding for the `pun` text. The result (the embedding vector) is returned by the step and can be used in subsequent steps. `step.do()` ensures this step will be retried if it fails, guaranteeing that embeddings are eventually created. ##### Categorizing the Pun Optionally, use a Workers AI language model to categorize the pun. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/workflows/publish.ts#L41) This step uses the `@cf/meta/llama-3.1-8b-instruct` model with a specific system prompt to generate categories for the pun. The generated categories string is returned by the step. This step also benefits from `step.do()`'s reliability. ##### Adding Embeddings to Vectorize Insert the created pun embedding and potentially categories embedding into the Vectorize database. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/workflows/publish.ts#L78) This step uses `this.env.VECTORIZE.upsert()` to add the generated embeddings and associated metadata to the Vectorize database. This makes the pun searchable semantically. `step.do()` ensures this critical indexing step is completed reliably. ##### Updating Database Status The final step updates the status of the pun in the D1 database to indicate that it has been published and processed by the workflow. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/7cec7f4bd7d6b17085cb6d6cb3e56b6a4b5b7c9d/src/workflows/publish.ts#L104) This step updates the `status` column in the D1 database to "published" for the corresponding pun ID. Once this step is complete, the pun is considered fully processed and ready to be displayed on the homepage. #### Workflow Bindings To make the `PublishWorkflow` class available to the main Worker and to provide access to necessary resources (like D1, AI, Vectorize), bindings are configured in the Wrangler configuration file. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/wrangler.toml) This configuration defines a workflow named `publish`, binds it to the environment variable `PUBLISH`, and links it to the `PublishWorkflow` class in `src/index.ts`. It also shows bindings for Workers AI (`AI`) and Vectorize (`VECTORIZE`), which are accessed via `this.env` within the workflow. ### Vectorize for Semantic Search Vectorize is a vector database used in this application to enable semantic search for puns. It stores the vector embeddings created by Workers AI. The search functionality queries this Vectorize index to find puns similar in meaning to the user's query. The homepage displays recently published puns (status "published"). The detail page for a specific pun displays "Similar Puns", which are found by querying Vectorize with the embedding of the current pun. ### Scalability Cloudflare Workers and Workflows are designed to scale automatically based on demand, handling concurrent requests and background tasks efficiently without requiring manual provisioning. [ Watch Episode 1: Understand Cloudflare Workflows ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-1/) In this episode, we introduce Cloudflare Workflows, which provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. [ Watch Episode 2: Monitor and batch your website data ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-2/) In this episode, we describe how Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. [ Watch Episode 3: Use cron triggers to develop time-aware applications ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-3/) In this episode, we review Workflows ability to explicitly schedule tasks using cron triggers and pause execution with \`step.sleep\` allows developers to build sophisticated, time-aware applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-1/#page","headline":"Introduction to Workflows · Cloudflare Learning Paths","description":"Cloudflare Workflows provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. Workflows are designed to resume execution even if the underlying compute fails, ensuring that tasks complete eventually. They are built on top of Cloudflare Workers and handle scaling and provisioning automatically.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-1/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workflows-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workflows-course/series/workflows-1/","name":"Introduction to Workflows"}}]} ``` --- --- title: Monitor and batch your website data description: Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. This section demonstrates processing a batch of puns using the Punderful application as an example. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Monitor and batch your website data * [ Watch this episode ](#tab-panel-10157) * [ Step-by-step tutorial ](#tab-panel-10158) * [ Series overview ](#tab-panel-10159) Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. This section demonstrates processing a batch of puns using the Punderful application as an example. **Related content** If you want to dive into detail, refer to the following pages: * [Source code for the Punderful repository ↗](https://github.com/craigsdennis/punderful-workflows) * [Cloudflare Workflows](https://edgetunnel-b2h.pages.dev/workflows/) * [Cloudflare Workers AI](https://edgetunnel-b2h.pages.dev/workers-ai/) The Punderful application processes user-submitted puns by performing content moderation, creating embeddings, categorizing, and adding them to a vector store. This process is defined as a Workflow. To process a batch of existing puns (from an open-source dataset called OPun), a batch endpoint is created that iterates through the puns and triggers the defined Workflow for each one. #### Batch Processing Code The following code snippet shows the endpoint responsible for batch processing: [See here ↗](https://github.com/craigsdennis/punderful-workflows/tree/main/src/index.tsx#L291) This code: 1. Fetches the list of puns from a JSON file (`puns.json`). 2. Logs the number of puns being processed. 3. Sets a user ID for tracking. 4. Loops through each pun. 5. Performs basic text cleaning on the pun. 6. Inserts the pun into the database (handled by `insertPun`). 7. Triggers the `PUBLISH` Workflow for each individual pun using `c.env.PUBLISH.create()`. The Workflow is given a unique ID using `crypto.randomUUID()`. ### Monitoring Workflow Instances via CLI The Cloudflare Wrangler CLI provides commands to monitor and manage Workflows and their instances. To list the available workflows associated with your account: ```bash npx wrangler workflows list ``` To list the instances of a specific workflow (for example, the `publish` workflow): ```bash npx wrangler workflows instances list publish ``` This command will show a list of workflow instances, their status (Queued, Running, Completed, Errored), and timestamps. To view the details of a specific workflow instance, including its steps and their status, duration, and output: ```bash npx wrangler workflows instances describe publish ``` Replace `` with the actual ID of a running or completed instance from the `list` command output. #### Example CLI Output (Describe Instance) Describing a workflow instance provides a detailed breakdown of its execution: ```plaintext Workflow Name: publish Instance ID: oPun-batch-aea07d75-95fa-448f-9573-6e435388eff7 Version ID: 75665fce-24a1-4c83-a561-088aabc91e5f Status: Completed Trigger: API Queued: 10/24/2024, 1:43:45 AM Success: Yes Start: 10/24/2024, 1:43:45 AM End: 10/24/2024, 1:43:49 AM Duration: 4 seconds Last Successful Step: update-status-to-published-1 Steps: Name: content-moderation-1 Type: Step Start: 10/24/2024, 1:43:45 AM End: 10/24/2024, 1:43:45 AM Duration: 0 seconds Success: Yes Output: "true" Config: {"retries":{"limit":5,"delay":1000,"backoff":"exponential"},"timeout":"10 minutes"} Attempts: Status: Completed Start Time: Oct 23, 2024 6:44:57 PM End Time: Oct 23, 2024 6:44:57 PM Wall Time: 180 ms ... (additional steps like create-pun-embedding-1, categorize-pun-1, add-embeddings-to-vector-store-1, update-status-to-published-1) ``` This output shows the status, start/end times, duration, success status, and even the output and configuration for each step within the workflow instance. ### Monitoring Workflow Instances via Cloudflare Dashboard You can also monitor Workflows and their instances directly in the Cloudflare Dashboard. This dashboard view provides a user-friendly way to observe the progress of your batch jobs, identify failed instances, and inspect the execution details of each step. [ Watch Episode 1: Understand Cloudflare Workflows ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-1/) In this episode, we introduce Cloudflare Workflows, which provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. [ Watch Episode 2: Monitor and batch your website data ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-2/) In this episode, we describe how Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. [ Watch Episode 3: Use cron triggers to develop time-aware applications ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-3/) In this episode, we review Workflows ability to explicitly schedule tasks using cron triggers and pause execution with \`step.sleep\` allows developers to build sophisticated, time-aware applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-2/#page","headline":"Monitor and batch your website data · Cloudflare Learning Paths","description":"Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. This section demonstrates processing a batch of puns using the Punderful application as an example.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workflows-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workflows-course/series/workflows-2/","name":"Monitor and batch your website data"}}]} ``` --- --- title: Use cron triggers to develop time-aware applications description: Cloudflare Workflows provide a powerful way to manage asynchronous, durable processes. The ability to explicitly schedule tasks using scheduled handlers and pause execution with `step.sleep` allows developers to build sophisticated, time-aware applications. image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Use cron triggers to develop time-aware applications * [ Watch this episode ](#tab-panel-10162) * [ Step-by-step tutorial ](#tab-panel-10163) * [ Series overview ](#tab-panel-10164) Cloudflare Workflows provide a powerful way to manage asynchronous, durable processes. The ability to explicitly schedule tasks using scheduled handlers and pause execution with `step.sleep` allows developers to build sophisticated, time-aware applications. **Related content** If you want to dive into detail, refer to the following pages: * [Source code for the Punderful repository ↗](https://github.com/craigsdennis/punderful-workflows) * [Cloudflare Workflows](https://edgetunnel-b2h.pages.dev/workflows/) * [Cloudflare Workers AI](https://edgetunnel-b2h.pages.dev/workers-ai/) Workflows allow you to kick off asynchronous processes without blocking the user. This is demonstrated in the `addInteraction` function, which creates a new instance of the `INTERACTION` workflow. Locate the `addInteraction` function in `src/index.tsx`: [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/index.tsx#L237) This function is called when a user interacts with a pun (for example, likes it). Instead of performing the interaction logic directly, it offloads the work to a workflow. Examine the `InteractionWorkflow` definition in `src/workflows/interaction.ts`. This workflow performs tasks like checking if the user/session exists and recording the interaction in the database. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/workflows/interaction.ts) ### Leaderboard Code A common use case for background processes is crunching data and caching results, such as building a leaderboard. Examine the `LeaderboardWorkflow` in `src/workflows/leaderboard.ts`. This workflow performs a database query to find trending puns and then stores the results in Cloudflare KV (Key-Value Store). [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/workflows/leaderboard.ts) This workflow can be scheduled to run periodically to update the leaderboard data. ### Wrangler Configuration The Wrangler configuration file is used to configure your Worker and Workflows. This includes defining bindings to resources like KV namespaces and setting up schedules for workflows. The episode repository uses the older pattern of a top-level `[triggers]` section plus a `scheduled` handler in the main Worker to create a `LEADERBOARD_WORKFLOW` instance on a timer. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/wrangler.toml#L68) In current Workflows projects, you can usually schedule the Workflow directly on its binding instead: * [ wrangler.jsonc ](#tab-panel-10160) * [ wrangler.toml ](#tab-panel-10161) **JSONC** ```jsonc { "$schema": "./node_modules/wrangler/config-schema.json", "workflows": [ { "name": "leaderboard-workflow", "binding": "LEADERBOARD_WORKFLOW", "class_name": "LeaderboardWorkflow", "schedules": [ "*/30 * * * *" ] } ] } ``` **TOML** ```toml [[workflows]] name = "leaderboard-workflow" binding = "LEADERBOARD_WORKFLOW" class_name = "LeaderboardWorkflow" schedules = ["*/30 * * * *"] ``` Use a separate Cron Trigger and `scheduled` handler only when you need custom logic before deciding whether to create a Workflow instance. Use the latest Wrangler release when configuring Workflow schedules. ### Puntificator: Using AI to Develop More Puns Automatically Workflows can also be used for more complex, multi-step processes, including interacting with AI models. The `PuntificatorWorkflow` is an example that leverages AI to generate and evaluate new puns. Examine the `PuntificatorWorkflow` definition in `src/workflows/puntificator.ts`. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/workflows/puntificator.ts) This workflow includes steps to: 1. Retrieve trending puns. 2. Create a new pun based on trends using an AI model. 3. Judge the quality of the created pun using another AI model. 4. Save the pun if it meets a certain rating threshold. Crucially, this workflow includes a `step.sleep` call: [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/workflows/puntificator.ts#L135) This step pauses the workflow execution for a specified duration. This is useful for waiting to consider user feedback on a published pun before potentially taking further action based on its popularity. ### Nested Workflows Workflows can initiate other workflows, allowing you to compose complex processes from smaller, modular units. In the `PuntificatorWorkflow`, find where it calls the `PUBLISH` workflow. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/workflows/puntificator.ts#L115) This demonstrates how one workflow can trigger another, enabling the separation of concerns and modular design. Examine the `PublishWorkflow` in `src/workflows/publish.ts`. [See here ↗](https://github.com/craigsdennis/punderful-workflows/blob/main/src/workflows/publish.ts) This workflow handles the logic for publishing a pun, likely involving saving it to the database and making it visible on the site. ### Workflow Instances You can trigger workflows manually and inspect their execution status and output using the `wrangler` command-line tool. To trigger the `PuntificatorWorkflow` manually: ```bash npx wrangler workflows trigger puntificator ``` This command will queue an instance of the workflow. You will receive a success message and the instance ID. To describe the latest instance of a workflow: ```bash npx wrangler workflows instances describe puntificator latest ``` This command will show details about the most recent run of the specified workflow, including its start time, end time, duration, state, and the state of each individual step within the workflow. You can observe steps like `create-new-pun-based-on-trends`, `judge-pun`, `save-pun`, `publish`, and `wait-for-publish` (which shows a 'Sleeping' state). [ Watch Episode 1: Understand Cloudflare Workflows ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-1/) In this episode, we introduce Cloudflare Workflows, which provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. [ Watch Episode 2: Monitor and batch your website data ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-2/) In this episode, we describe how Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. [ Watch Episode 3: Use cron triggers to develop time-aware applications ](https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-3/) In this episode, we review Workflows ability to explicitly schedule tasks using cron triggers and pause execution with \`step.sleep\` allows developers to build sophisticated, time-aware applications. ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-3/#page","headline":"Use cron triggers to develop time-aware applications · Cloudflare Learning Paths","description":"Cloudflare Workflows provide a powerful way to manage asynchronous, durable processes. The ability to explicitly schedule tasks using scheduled handlers and pause execution with step.sleep allows developers to build sophisticated, time-aware applications.","url":"https://edgetunnel-b2h.pages.dev/learning-paths/workflows-course/series/workflows-3/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","dateModified":"2026-06-02","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/learning-paths/","name":"Learning Paths"}},{"@type":"ListItem","position":3,"item":{"@id":"/learning-paths/workflows-course/series/","name":"Overview"}},{"@type":"ListItem","position":4,"item":{"@id":"/learning-paths/workflows-course/series/workflows-3/","name":"Use cron triggers to develop time-aware applications"}}]} ```