You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Internet-bound traffic from a client is evaluated in the following way:
7
+
<Aside>
8
+
9
+
For instructions on how to set up policies in the Teams dash, visit our [Getting started section](../getting-started).
10
+
</Aside>
8
11
9
-
If the WARP client is configured to send DNS requests over DoH to Gateway, the DNS queries are evaluated against content and security policies configured for the organization. If the domain is allowed, the client receives the DNS resolution and initiates an HTTP connection.
12
+
Gateway policies allow you to grant or deny your users access to specific domains or domain categories. If the WARP client is configured to send DNS requests over DoH to Gateway, the DNS queries are evaluated against content and security policies configured for the organization. If the domain is allowed, the client receives the DNS resolution and initiates an HTTP connection.
10
13
11
14
Cloudflare Gateway currently filters HTTP traffic over port 80 and 443. If the HTTP connection is within a TLS connection, the TLS connection will be terminated at Cloudflare Gateway so the HTTP traffic can be inspected (unless an administrator configures a bypass rule). If the HTTP connection does not violate any policies configured by an administrator, the traffic is allowed through to the origin server.
12
15
13
-
## DNS
16
+
### DNS policies
17
+
18
+
When a user makes a DNS request to Gateway, Gateway matches the request against the content or security categories you have set up for your organization. If the domain does not belong to any blocked categories, or if it matches an override rule, the user's client receives the DNS resolution and initiates an HTTP connection.
19
+
20
+
DNS policies can be built by doing one or more of the following:
21
+
22
+
1. Selecting security threat categories you want to block.
23
+
1. Enabling SafeSearch.
24
+
1. Enabling YouTube Restricted Mode.
25
+
1. Selecting content categories you want to block.
26
+
1. Adding custom domains you want to block, allow, or override.
14
27
15
-
###What is a Policy?
28
+
#### Security threat categories
16
29
17
-
A policy is a set of rules you can set up for one specific location or for multiple locations. Through Cloudflare Gateway's policy engine, you can filter domains by categories, manually block domains by specifying them in a list, and override domains to allow them even if those domains are getting blocked by a category.
30
+
When creating a DNS policy, you can select as many security threat categories as you want to block with the policy. This allows you to block known and potential security threats on the public Internet.
31
+
32
+
#### Content categories
33
+
34
+
<Aside>
35
+
36
+
Sites that are classified as belonging to the **Child Abuse** category are blocked by default.
37
+
</Aside>
18
38
19
-
When setting up a policy, you can also enable features such as SafeSearch or YouTube Restricted Mode.
39
+
When creating a DNS policy, you can select as many content categories as you want to block with the policy.
20
40
21
-
### Blocking a subdomain
41
+
#### Destinations
42
+
43
+
Setting a **destination** for a policy allows you to have manual control on what action to take on requests for **specific domains**.
44
+
When setting a domain as a destination, you have the option to allow, block or override that domain.
45
+
***Allow**. This action forces resolving this destination and all its sub-destinations, and takes precedence over any blocked destinations.
46
+
***Block**. This action will block a destination and all its sub-destinations.
47
+
***Override**. This action will forward all requests to a given destination to another destination you can set.
48
+
49
+
##### Blocking a subdomain
22
50
23
51
When you manually block a domain, you automatically block all of its subdomains. For example, if you are blocking `example.com`, our policy engine will also block `a.example.com`, `a.b.example.com`.
24
52
25
53
If you only want to block a subdomain `a.example.com`, then instead of adding `example.com` to the list, you will add `a.example.com`. Note that once you add `a.example.com` to the block list, Cloudflare Gateway will also block all subdomains of `a.example.com`.
26
54
27
-
### Blocking a top-level domain
55
+
#####Blocking a top-level domain
28
56
29
-
Just like you can choose to block a domain and all subdomains, you can block an entire top-level domain (TLD) by specifying it in a custom list. For example, if you wish to block all domains and subdomains registered as a `.net`, you would input `.net` in a custom list with the *Block* action selected.
57
+
Just like you can choose to block a domain and all subdomains, you can block an entire top-level domain (TLD) by specifying it in a custom list. For example, if you wish to block all domains and subdomains registered as a `.net`, you would input `net` in a custom list with the *Block* action selected.
30
58
31
59
<Aside>
32
60
33
61
Blocking a popular TLD like `.com` will prevent users from connecting to significant portions of the internet.
34
62
</Aside>
35
63
36
-
### Order of operations when applying a policy
64
+
####Order of operations
37
65
38
-
When Gateway receives a DNS query and the query matches with a policy, the policy follows the order outlined below:
66
+
When a DNS query matches with a DNS policy, Gateway follows this order of operations:
| 1 | Domain is in CSAM category | Block domain, return REFUSED |Go to step 2 |
70
+
| 1 | Domain is in Child Abuse category | Block domain, return REFUSED |Go to step 2 |
43
71
| 2 | Domain in Allow list | Allow domain, return NOERROR with IP address of the domain|Go to step 3 |
44
72
| 3 | Domain in Block list | Block domain, return REFUSED |Go to step 4 |
45
73
| 4 | Domain in SafeSearch | Override domain, return NOERROR with safe CNAME |Go to step 5 |
46
74
| 5 | Domain blocked by category | Block domain, return REFUSED |Go to step 6 |
47
75
| 6 | N/A | Allow domain, return NOERROR with IP address of the domain| N/A |
48
-
In each step, Gateway checks if the domain matches with the rule stated in the `Check If` column. If it matches with the rule, Gateway triggers the action in the `If Matches` column. If it does not match the check moves to the next step outlined in the `Else` column.
49
-
50
-
## L7 Firewall
51
76
52
-
### What criteria can be matched against in a rule for HTTP traffic filtering?
77
+
### HTTP policies
53
78
54
-
Cloudflare Gateway allows users to match against the following HTTP traffic criteria:
55
-
* Host
56
-
* URL
57
-
* URL Query
58
-
* URL Path
59
-
* URL Path and Query
60
-
* HTTP Method
61
-
* HTTP Response
62
-
* Uploaded and Downloaded File Extension
63
-
* Uploaded and Downloaded Mime Type
79
+
<Aside>
64
80
65
-
Like with DNS filtering, Cloudflare also maintains URLs associated with content categories and security threats. Organizations can choose to match against some or all of these categories to complement filtering at the DNS layer.
81
+
This feature is only available for Gateway and Teams paid plans. For more information, see the Cloudflare for Teams [pricing page](https://www.cloudflare.com/teams-pricing/).
66
82
67
-
### How can a match be configured?
83
+
</Aside>
68
84
69
-
Depending on the criteria selected, administrators can choose to match in a variety of ways:
85
+
You can decide to add a policy to filter HTTP traffic on the L7 firewall. Gateway will intercept all HTTP and HTTPS traffic and apply the rules you have configured in your policy to either block, allow, or override specific elements such as websites, IP addresses, and file types.
86
+
87
+
You can build an HTTP policy by configuring the following elements:
88
+
89
+
***Actions**
90
+
***Expressions**
91
+
***Selectors**
92
+
***Operators**
93
+
94
+
#### Actions
95
+
96
+
Just like actions on destinations in DNS policies, actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.
97
+
98
+
These are the action types you can choose from:
99
+
100
+
***Allow**
101
+
***Block**
102
+
***Bypass**
103
+
104
+
*Bypass* lets administrators bypass certain elements from inspection. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occuring on both encrypted and plaintext traffic. The bypass action is only available when matching against the host criteria.
105
+
106
+
#### Selectors
107
+
Gateway matches HTTP traffic against the following selectors, or criteria:
108
+
***Host**
109
+
***URL**
110
+
***URL Query**
111
+
***URL Path**
112
+
***URL Path and Query**
113
+
***HTTP Method**
114
+
***HTTP Response**
115
+
***Uploaded and Downloaded File Extension**
116
+
***Uploaded and Downloaded Mime Type**
117
+
***Content categories**
118
+
119
+
List of file extensions Gateway can match against:
120
+
121
+
<TableWrap>
122
+
123
+
| Image | Executable | Audio | Documents | Data | Compressed | System | Video |
@@ -77,135 +157,24 @@ Depending on the criteria selected, administrators can choose to match in a vari
77
157
| matches regex | regex evaluates to true |
78
158
| does not match regex | all except when regex evals to true |
79
159
80
-
### What actions can be taken when a match is made?
160
+
#### Expressions
161
+
Expressions are sets of conditions with which you can combine [selectors](#selectors) and [operators](#operators). By configuring one or more expressions, you can define the scope of your HTTP policy.
81
162
82
-
All rules support **allow** and **block** actions. However, administrators may wish to bypass certain sites from inspection. Cloudflare Gateway uses the hostname in the HTTP CONNECT header to identify the destination of the request. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. The **bypass** action is only available when matching against the **host** criteria.
163
+
#### Example scenarios
83
164
84
-
### How can I bypass the L7 firewall for a website?
165
+
| Action | Selector | Operator |
166
+
| ------ | ---- | -------- |
167
+
| Block | Content categories | in: `Gaming`|
85
168
86
-
Cloudflare Gateway uses the hostname in the HTTP CONNECT header to identify the destination of the request. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. The **bypass** action is only available when matching against the **host** criteria.
169
+
**Result**: this configuration blocks any traffic to domains categorized as `Gaming`.
170
+
171
+
#### FAQ
172
+
173
+
***How can I bypass the L7 firewall for a website?**
87
174
175
+
Cloudflare Gateway uses the hostname in the HTTP CONNECT header to identify the destination of the request. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. The **bypass** action is only available when matching against the **host** criteria.
88
176
Bypassing the L7 firewall results in no HTTP traffic inspection and logging is disabled for that HTTP session.
89
177
90
-
### In what order are rules evaluated?
178
+
***In what order are rules evaluated?**
91
179
92
180
The L7 firewall evaluates rules starting with the rule containing the lowest precedence (e.g., rule number one). Rules with a higher value precedence are evaluated after those with a lower value.
93
-
94
-
### What file extensions can I match against?
95
-
96
-
Cloudflare Gateway currently supports the following file extensions to match against to control files from passing through Gateway:
0 commit comments