Skip to content

Commit 4e9691a

Browse files
maxvpthomasgauvin
authored andcommitted
Reorder priority between policy types (#24371)
1 parent 4bf0431 commit 4e9691a

File tree

1 file changed

+5
-9
lines changed

1 file changed

+5
-9
lines changed

src/content/partials/cloudflare-one/gateway/order-of-enforcement.mdx

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -89,17 +89,13 @@ Connections to Zero Trust will always appear in your [Zero Trust network session
8989
Gateway applies your policies in the following order:
9090

9191
1. DNS policies with selectors evaluated before resolution
92-
2. DNS policies with selectors evaluated after resolution
93-
3. HTTP policies
92+
2. Resolver policies (if applicable)
93+
3. DNS policies with selectors evaluated after resolution
9494
4. Network policies
95-
5. Resolver policies (if applicable)
96-
6. Egress policies (if applicable)
97-
98-
DNS policies are standalone. For example, if you block a site with a DNS policy but do not create a corresponding HTTP policy, users can still access the site if they know its IP address.
99-
100-
Next, Gateway evaluates HTTP policies in [a specific order](#http-policies). For example, if you block a specific source IP in an HTTP policy but allow the IP range in a network policy, the IP address will be blocked.
95+
5. Egress policies (if applicable)
96+
6. HTTP policies
10197

102-
Lastly, if traffic passes your HTTP policies, Gateway checks the traffic against your network policies. For example, even if you create a Do Not Inspect HTTP policy for a site, it can be blocked by a subsequent network policy.
98+
DNS and resolver policies are standalone. For example, if you block a site with a DNS policy but do not create a corresponding HTTP policy, users can still access the site if they know its IP address.
10399

104100
### HTTP/3 traffic
105101

0 commit comments

Comments
 (0)