|
| 1 | +--- |
| 2 | +pcx_content_type: configuration |
| 3 | +title: Host selectors |
| 4 | +sidebar: |
| 5 | + order: 2 |
| 6 | +--- |
| 7 | + |
| 8 | +import { Tabs, TabItem, Details, APIRequest } from "~/components"; |
| 9 | + |
| 10 | +<Details header="Feature availability"> |
| 11 | + |
| 12 | +| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | |
| 13 | +| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
| 14 | +| Gateway with WARP | Enterprise | |
| 15 | + |
| 16 | +| System | Availability | Minimum WARP version | |
| 17 | +| -------- | ------------ | -------------------- | |
| 18 | +| Windows | ✅ | 2025.4.929.0 | |
| 19 | +| macOS | ✅ | 2025.4.929.0 | |
| 20 | +| Linux | ✅ | 2025.4.929.0 | |
| 21 | +| iOS | ❌ | | |
| 22 | +| Android | ❌ | | |
| 23 | +| ChromeOS | ❌ | | |
| 24 | + |
| 25 | +</Details> |
| 26 | + |
| 27 | +When Gateway receives a DNS query for hostname covered by the [Application](/cloudflare-one/policies/gateway/egress-policies/#application), [Content Categories](/cloudflare-one/policies/gateway/egress-policies/#content-categories), [Domain](/cloudflare-one/policies/gateway/egress-policies/#domain), and [Host](/cloudflare-one/policies/gateway/egress-policies/#host) selectors in an Egress policy, Gateway initially resolves DNS to an IP in the `100.80.0.0/16` or `2606:4700:0cf1:4000::/64` range. This process allows Gateway to map a destination IP with a hostname at [layer 4](https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/) (where Gateway evaluates Egress policies). The destination IP for a hostname is not usually known at layer 4. Prior to evaluating Egress policies, the initially resolved IP is overwritten with the correct destination IP. |
| 28 | + |
| 29 | + |
| 30 | + |
| 31 | +Additional configuration is required when using policies with these selectors. |
| 32 | + |
| 33 | +## Turn on Host selectors |
| 34 | + |
| 35 | +To turn on the selectors for your account: |
| 36 | + |
| 37 | +<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard"> |
| 38 | + |
| 39 | +1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Network**. |
| 40 | +2. In **Firewall**, turn on **Host selector**. |
| 41 | + |
| 42 | +</TabItem> <TabItem label="API"> |
| 43 | + |
| 44 | +Use the [Patch Zero Trust account configuration](/api/resources/zero_trust/subresources/gateway/subresources/configurations/methods/edit/) endpoint to update your Zero Trust configuration. For example: |
| 45 | + |
| 46 | +<APIRequest |
| 47 | + path="/accounts/{account_id}/gateway/configuration" |
| 48 | + method="PATCH" |
| 49 | + json={{ |
| 50 | + settings: { |
| 51 | + host_selector: { |
| 52 | + enabled: true, |
| 53 | + }, |
| 54 | + }, |
| 55 | + }} |
| 56 | +/> |
| 57 | + |
| 58 | +</TabItem> </Tabs> |
| 59 | + |
| 60 | +## Prerequisites |
| 61 | + |
| 62 | +Traffic must be on-ramped to Gateway with the following methods: |
| 63 | + |
| 64 | +| On-ramp method | Compatibility | |
| 65 | +| ------------------------------------------------------------------------------------------ | ------------- | |
| 66 | +| [WARP](/cloudflare-one/connections/connect-devices/warp/) | ✅ | |
| 67 | +| [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/) | ✅ | |
| 68 | +| [Browser Isolation](/cloudflare-one/policies/browser-isolation/) | ✅ | |
| 69 | +| [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) | ❌ | |
| 70 | +| [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) | ❌ | |
| 71 | + |
| 72 | +Unsupported traffic will be resolved with your default Gateway settings. If you use DNS locations to send a DNS query to Gateway with IPv4, IPv6, DoT, or DoH, Gateway will not return the initial resolved IP for supported traffic nor resolve unsupported traffic. |
| 73 | + |
| 74 | +### Configuration changes |
| 75 | + |
| 76 | +:::caution |
| 77 | +Gateway will overwrite the DNS response for all supported traffic, even if you use identity or device posture selectors to limit which users or devices are affected by the policy. In these cases, while the DNS response is overwritten, Gateway will still apply the correct Egress policy. Therefore, the configuration changes below must be applied to all of your users and device profiles. |
| 78 | +::: |
| 79 | + |
| 80 | +To configure your Zero Trust organization to use Host selectors with Egress policies: |
| 81 | + |
| 82 | +1. Ensure you have deployed [WARP version 2025.4.929.0](/cloudflare-one/connections/connect-devices/warp/download-warp/) or later on your users' desktop devices. If you need to apply your policies to mobile devices or devices running a version of WARP prior to 2025.4.929.0, add and deploy the following key-value pair to your devices' [WARP configuration file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) (`mdm.xml` on Windows and Linux or `com.cloudflare.warp.plist` on macOS): |
| 83 | + |
| 84 | + ```diff lang="xml" |
| 85 | + <array> |
| 86 | + <dict> |
| 87 | + + <key>doh_in_tunnel</key> |
| 88 | + + <true/> |
| 89 | + </dict> |
| 90 | + </array> |
| 91 | + ``` |
| 92 | + |
| 93 | +{/* prettier-ignore-start */} |
| 94 | + |
| 95 | +2. In your WARP [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), configure your [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) depending on the mode: |
| 96 | + |
| 97 | + <Tabs> <TabItem label="Exclude IPs and domains"> |
| 98 | + 1. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel exclude list. |
| 99 | + 2. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses: |
| 100 | + - `100.64.0.0/12` |
| 101 | + - `100.81.0.0/16` |
| 102 | + - `100.82.0.0/15` |
| 103 | + - `100.84.0.0/14` |
| 104 | + - `100.88.0.0/13` |
| 105 | + - `100.96.0.0/11` |
| 106 | + |
| 107 | + </TabItem> <TabItem label="Include IPs and domains"> |
| 108 | + 1. Add the required [Zero Trust domains](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains) or [IP addresses](/cloudflare-one/connections/connect-devices/warp/ configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-ip-addresses) to your Split Tunnel include list. |
| 109 | + 2. [Add a route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to include the IP address `100.80.0.0/16`. |
| 110 | + |
| 111 | + </TabItem> </Tabs> |
| 112 | + |
| 113 | +The WARP client must be set to _Gateway with WARP_ mode for traffic affected by these selectors to route correctly. |
| 114 | + |
| 115 | +{/* prettier-ignore-end */} |
0 commit comments