You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/policies/gateway/proxy.mdx
+7-9Lines changed: 7 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,17 +11,15 @@ You can forward [HTTP](/cloudflare-one/policies/gateway/initial-setup/http/) and
11
11
12
12
The Gateway proxy is required for filtering HTTP and network traffic via the WARP client in Gateway with WARP mode. To proxy HTTP traffic without deploying the WARP client, you can configure [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/) on your devices.
13
13
14
-
## Happy Eyeballs
14
+
## Proxy algorithm
15
15
16
-
When connections are proxied through Gateway they follow the below order.
16
+
Gatway uses the [Happy Eyeballs algorithm](https://datatracker.ietf.org/doc/html/rfc6555) to proxy traffic in the following order:
17
17
18
-
When Gateway proxies traffic, it uses the [Happy Eyeballs algorithm](https://datatracker.ietf.org/doc/html/rfc6555) in the following order:
19
-
20
-
1. Receive a TCP SYN from the client
21
-
2. Send a TCP SYN to the origin
22
-
3. If the origin sends SYN/ACK back, then we finish the TCP handshakes of both 1 and 2 above
23
-
4. If all of that is successful, both TCP connections are passed to Gateway that runs the firewall (possibly consuming data from connection 1)
24
-
5. If the firewall allows, then Gateway proxies the connection 1 to connection 2 bidirectionally
18
+
1. The user's WARP client initiates the TCP handshake by sending Gateway a TCP SYN segment.
19
+
2. Gateway sends a SYN segment to the origin server.
20
+
3. If the origin server sends a SYN-ACK segment back, Gateway establishes distinct TCP connections between the WARP client and Gateway and between Gateway and the origin server.
21
+
4. Gateway inspects and filters traffic received from the WARP client.
22
+
5. If the traffic passes inspection, Gateway proxies traffic bidirectionally between the client and the origin server.
0 commit comments