[CF1] WARP modes comparison table

Author: deadlypants1973

src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/index.mdx

@@ -63,6 +63,18 @@ This mode is best suited for organizations that only want to enforce [WARP clien
 | ------------- | ----------------- | -------------- | --------------------------------------------------------------------------- |
 | No            | No                | No             | Device posture rules in [Access policies](/cloudflare-one/policies/access/) |
 
+## WARP modes comparison
+
+Each WARP mode offers a different set of Zero Trust features.
+
+| WARP Mode                                    | DNS Filtering | Network Filtering | HTTP Filtering | Service mode (warp-cli setting) | Description                                                                                                                                                                                                        |
+| -------------------------------------------- | ------------- | ----------------- | -------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Gateway with WARP (default)**              | ✅            | ✅                | ✅             | `WarpWithDnsOverHttps`          | <details><summary>View</summary>All traffic is encrypted by Gateway. This mode is required if you want to enable HTTP rules, Browser Isolation, Anti-Virus scanning and DLP.</details>                             |
+| **Gateway with DoH**                         | ✅            | ❌                | ❌             | `DnsOverHttps`                  | <details><summary>View</summary>Only DNS traffic is encrypted by Gateway. This mode only allows for DNS policies to be enforced.</details>                                                                         |
+| **Secure Web Gateway without DNS filtering** | ❌            | ✅                | ✅             | `TunnelOnly`                    | <details><summary>View</summary>Provides only WARP Tunnel and posture functionality. Does not enforce DNS policies or DNS resolution.</details>                                                                    |
+| **Proxy mode**                               | ❌            | ❌                | ✅             | `WarpProxy on port 40000`       | <details><summary>View</summary>Gateway only encrypts traffic sent to the localhost proxy. Does not process DNS traffic.</details>                                                                                 |
+| **Device Information Only**                  | ❌            | ❌                | ❌             | _(none)_                        | <details><summary>View</summary>Allows enforcement of device posture rules for self-hosted Access applications using client certificates. No DNS, network, or HTTP traffic is sent through WARP tunnels.</details> |
+
 ## Related resources
 
 - [Connectivity status](/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare.