Skip to content

Commit 7d806ba

Browse files
maxvpmaxvp
authored
[Gateway] Auth proxy followup (#27101)
1 parent 30149ac commit 7d806ba

File tree

2 files changed

+95
-15
lines changed

2 files changed

+95
-15
lines changed

‎src/content/docs/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/index.mdx‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import {
1717
:::note
1818
PAC files are only available on Enterprise plans.
1919

20-
Authorization endpoints and PAC file hosting are available to all Enterprise plans during the closed beta period. For access, contact your account team.
20+
[Authorization endpoints](#authorization-endpoint) and [PAC file hosting](#create-a-hosted-pac-file) are in beta for Enterprise plans. To opt in, contact your account team.
2121
:::
2222

2323
Proxy endpoints allow you to apply Gateway policies without installing a client on your devices. By configuring a Proxy Auto-Configuration (PAC) file at the browser level, you can route traffic through Gateway for filtering and policy enforcement. Cloudflare supports configuring two types of proxy endpoints: identity-based [authorization endpoints](#authorization-endpoint) and [source IP proxy endpoints](#source-ip-endpoint).
@@ -228,7 +228,7 @@ A PAC file is a text file written in JavaScript that specifies which traffic sho
228228
For detailed instructions and examples for creating a PAC file, refer to [PAC file best practices](/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/best-practices/).
229229
:::
230230

231-
### Create a hosted PAC file
231+
### Create a hosted PAC file <Badge text="Beta" variant="caution" />
232232

233233
When you create a PAC file in Cloudflare One, Cloudflare will host it in a publicly accessible Worker. Hosted PAC files are automatically distributed through Cloudflare's global network.
234234

@@ -460,19 +460,22 @@ You can modify proxy endpoint settings after creation.
460460

461461
### Traffic limitations
462462

463-
Source IP proxy endpoints do not support [identity-based policies](/cloudflare-one/traffic-policies/identity-selectors/) or mTLS authentication.
463+
Each type of proxy endpoint supports the following features:
464464

465-
Source IP proxy endpoints support TCP traffic, but authorization proxy endpoints only support HTTP/HTTPS. Source IP endpoints support non-HTTP TCP traffic.
465+
| Feature | Source IP endpoint | Authorization endpoint |
466+
| ----------------------------------------------------------------------------------- | ------------------ | ---------------------- |
467+
| **HTTP/HTTPS traffic** | ✅[^1] | ✅[^1] |
468+
| **Non-HTTP TCP traffic** | ✅ | — |
469+
| **UDP traffic** | — | — |
470+
| **[HTTP3](/cloudflare-one/traffic-policies/http-policies/http3/)** | — | — |
471+
| **[Identity-based policies](/cloudflare-one/traffic-policies/identity-selectors/)** | — | ✅ |
472+
| **mTLS authentication** | — | — |
473+
| **[Happy Eyeballs](https://datatracker.ietf.org/doc/html/rfc6555)** | — | — |
474+
| **Browser HTTPS auto-upgrade** | —[^2] | —[^2] |
466475

467-
Authorization endpoints do not support anything that is not HTTP/HTTPS. That means no other TCP or UDP protocol is supported, including [HTTP3](/cloudflare-one/traffic-policies/http-policies/http3/).
476+
[^1]: To access plaintext HTTP (non-HTTPS) origins through proxy endpoints, configure them as [self-hosted Access applications](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/). This allows users to access HTTP resources while maintaining security through Access policies.
468477

469-
[Happy Eyeballs](https://datatracker.ietf.org/doc/html/rfc6555) is not supported with proxy endpoints.
470-
471-
Proxy endpoints do not support HTTPS when browsers automatically upgrade HTTP requests to HTTPS (such as Chrome's automatic HTTPS upgrades). If you encounter connection issues with sites that are being auto-upgraded, you may need to disable automatic HTTPS upgrades in your browser settings or configure the site as an exception.
472-
473-
:::note
474-
To access plaintext HTTP (non-HTTPS) origins through proxy endpoints, configure them as [self-hosted Access applications](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/). This allows users to access HTTP resources while maintaining security through Access policies.
475-
:::
478+
[^2]: Proxy endpoints do not support HTTPS when browsers automatically upgrade HTTP requests to HTTPS (such as Chrome's automatic HTTPS upgrades). If you encounter connection issues with sites that are being auto-upgraded, you may need to disable automatic HTTPS upgrades in your browser settings or configure the site as an exception.
476479

477480
### Session duration
478481

‎src/content/docs/cloudflare-one/traffic-policies/network-policies/common-policies.mdx‎

Lines changed: 80 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -191,9 +191,13 @@ If your organization blocks traffic by default with a Network policy and you wan
191191

192192
## Restrict private network access to proxy endpoint users
193193

194-
When using [source IP proxy endpoints](/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#source-ip-endpoint), by default all devices added to the proxy endpoint can access your internal applications and services connected through [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/). To restrict access to only users connecting through the proxy endpoint from specific source IPs, create the following policies.
194+
When using proxy endpoints, by default all devices added to the proxy endpoint can access your internal applications and services connected through [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/). To restrict access and add an additional layer of security, create the following policies.
195195

196-
### 1. Allow proxy endpoint traffic from specific source IPs
196+
### Source IP proxy endpoints
197+
198+
When using [source IP proxy endpoints](/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#source-ip-endpoint), restrict access to only users connecting through the proxy endpoint from specific source IPs.
199+
200+
#### 1. Allow proxy endpoint traffic from specific source IPs
197201

198202
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
199203

@@ -228,7 +232,7 @@ Replace `<PROXY_ENDPOINT_ID>` with your proxy endpoint ID.
228232

229233
</TabItem> </Tabs>
230234

231-
### 2. Block all other proxy endpoint traffic to private network
235+
#### 2. Block all other proxy endpoint traffic to private network
232236

233237
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
234238

@@ -262,6 +266,79 @@ Replace `<PROXY_ENDPOINT_ID>` with your proxy endpoint ID.
262266

263267
</TabItem> </Tabs>
264268

269+
### Authorization proxy endpoints
270+
271+
When using [authorization proxy endpoints](/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#authorization-endpoint), add an additional layer of security by restricting access to only users connecting from specific source IPs. This prevents unauthorized access even if user credentials are compromised.
272+
273+
#### 1. Allow proxy endpoint traffic from specific source IPs
274+
275+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
276+
277+
| Selector | Operator | Value | Logic | Action |
278+
| -------------- | -------- | ---------------- | ----- | ------ |
279+
| Proxy Endpoint | in | _Proxy Endpoint_ | And | Allow |
280+
| Source IP | in | `203.0.113.0/24` | And | |
281+
| Destination IP | in | `10.0.0.0/8` | | |
282+
283+
</TabItem>
284+
285+
<TabItem label="API">
286+
287+
<APIRequest
288+
path="/accounts/{account_id}/gateway/rules"
289+
method="POST"
290+
json={{
291+
name: "Allow authorized proxy endpoint traffic from specific source IPs",
292+
description:
293+
"Allow traffic from authorization proxy endpoint users with specific source IPs to reach private network",
294+
enabled: true,
295+
action: "allow",
296+
filters: ["l4"],
297+
traffic:
298+
'net.proxy_endpoint.ids[*] in {"<PROXY_ENDPOINT_ID>"} and net.src.ip in {203.0.113.0/24} and net.dst.ip in {10.0.0.0/8}',
299+
identity: "",
300+
device_posture: "",
301+
}}
302+
/>
303+
304+
Replace `<PROXY_ENDPOINT_ID>` with your proxy endpoint ID.
305+
306+
</TabItem> </Tabs>
307+
308+
#### 2. Block all other proxy endpoint traffic to private network
309+
310+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
311+
312+
| Selector | Operator | Value | Logic | Action |
313+
| -------------- | -------- | ---------------- | ----- | ------ |
314+
| Proxy Endpoint | in | _Proxy Endpoint_ | And | Block |
315+
| Destination IP | in | `10.0.0.0/8` | | |
316+
317+
</TabItem>
318+
319+
<TabItem label="API">
320+
321+
<APIRequest
322+
path="/accounts/{account_id}/gateway/rules"
323+
method="POST"
324+
json={{
325+
name: "Block all other authorized proxy endpoint traffic",
326+
description:
327+
"Block any other authorization proxy endpoint traffic from accessing the private network",
328+
enabled: true,
329+
action: "block",
330+
filters: ["l4"],
331+
traffic:
332+
'net.proxy_endpoint.ids[*] in {"<PROXY_ENDPOINT_ID>"} and net.dst.ip in {10.0.0.0/8}',
333+
identity: "",
334+
device_posture: "",
335+
}}
336+
/>
337+
338+
Replace `<PROXY_ENDPOINT_ID>` with your proxy endpoint ID.
339+
340+
</TabItem> </Tabs>
341+
265342
## Restrict access to private networks
266343

267344
Restrict access to resources which you have connected through [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/).

0 commit comments

Comments
 (0)