Skip to content

Commit 2665540

Browse files
committed
Add private network policies
1 parent 1d6e4e4 commit 2665540

File tree

1 file changed

+53
-1
lines changed

1 file changed

+53
-1
lines changed

src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,17 +194,69 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
194194

195195
Restrict access to resources which you have connected through [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/).
196196

197-
The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic. Make sure that the Allow policy has higher priority (by positioning it towards the top of the list in the UI).
197+
The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic.
198198

199199
### 1. Allow company employees
200200

201+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
202+
201203
| Selector | Operator | Value | Logic | Action |
202204
| -------------- | ------------- | ---------------- | ----- | ------ |
203205
| Destination IP | in | `10.0.0.0/8` | And | Allow |
204206
| User Email | matches regex | `.*@example.com` | | |
205207

208+
</TabItem>
209+
210+
<TabItem label="API">
211+
212+
```sh
213+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
214+
--header "Content-Type: application/json" \
215+
--header "Authorization: Bearer <API_TOKEN>" \
216+
--data '{
217+
"name": "Allow company employees",
218+
"description": "Allow any users with an organization email to reach the application",
219+
"enabled": true,
220+
"action": "allow",
221+
"filters": [
222+
"l4"
223+
],
224+
"traffic": "net.dst.ip in {10.0.0.0/8}",
225+
"identity": "identity.email matches \".*@example.com\"",
226+
"device_posture": ""
227+
}'
228+
```
229+
230+
</TabItem> </Tabs>
231+
206232
### 2. Block everyone else
207233

234+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
235+
208236
| Selector | Operator | Value | Action |
209237
| -------------- | -------- | ------------ | ------ |
210238
| Destination IP | in | `10.0.0.0/8` | Block |
239+
240+
</TabItem>
241+
242+
<TabItem label="API">
243+
244+
```sh
245+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
246+
--header "Content-Type: application/json" \
247+
--header "Authorization: Bearer <API_TOKEN>" \
248+
--data '{
249+
"name": "Block everyone else",
250+
"description": "Block any other users from accessing the application",
251+
"enabled": true,
252+
"action": "block",
253+
"filters": [
254+
"l4"
255+
],
256+
"traffic": "net.dst.ip in {10.0.0.0/8}",
257+
"identity": "",
258+
"device_posture": ""
259+
}'
260+
```
261+
262+
</TabItem> </Tabs>

0 commit comments

Comments
 (0)