Skip to content

Commit eab11ae

Browse files
maxvpdaisyfaithauma
maxvp
authored and
daisyfaithauma
committed
[Gateway] Egress host/domain selectors (#21762)
1 parent b372052 commit eab11ae

File tree

8 files changed

+64
-11
lines changed

8 files changed

+64
-11
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ Gateway matches DNS queries against the following selectors, or criteria:
284284

285285
### Application
286286

287-
<Render file="gateway/selectors/application" params={{ one: "DNS" }} />
287+
<Render file="gateway/selectors/application" params={{ policyType: "DNS" }} />
288288

289289
### Authoritative Nameserver IP
290290

‎src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 5
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, Badge } from "~/components";
99

1010
:::note
1111
Only available on Enterprise plans.
@@ -55,6 +55,24 @@ Choose one of the following options for your egress policy:
5555

5656
Gateway matches egress traffic against the following selectors, or criteria:
5757

58+
### Application <Badge text="Beta" variant="caution"/>
59+
60+
<Render
61+
file="gateway/selectors/application"
62+
params={{ policyType: "egress" }}
63+
/>
64+
65+
<Render file="gateway/selectors/egress-selector-limitation" />
66+
67+
### Content Categories <Badge text="Beta" variant="caution"/>
68+
69+
<Render
70+
file="gateway/selectors/net-http-content-categories"
71+
params={{ APIendpoint: "net.fqdn.category" }}
72+
/>
73+
74+
<Render file="gateway/selectors/egress-selector-limitation" />
75+
5876
### Destination Continent
5977

6078
<Render
@@ -81,6 +99,18 @@ Gateway matches egress traffic against the following selectors, or criteria:
8199

82100
<Render file="gateway/selectors/device-posture" />
83101

102+
### Domain <Badge text="Beta" variant="caution"/>
103+
104+
<Render file="gateway/selectors/domain" />
105+
106+
<Render file="gateway/selectors/egress-selector-limitation" />
107+
108+
### Host <Badge text="Beta" variant="caution"/>
109+
110+
<Render file="gateway/selectors/host" />
111+
112+
<Render file="gateway/selectors/egress-selector-limitation" />
113+
84114
### Protocol
85115

86116
<Render file="gateway/selectors/protocol" />
@@ -139,3 +169,22 @@ Gateway uses Rust to evaluate regular expressions. The Rust implementation is sl
139169
file="gateway/logical-operators"
140170
params={{ one: "**Identity** or **Device Posture**" }}
141171
/>
172+
173+
## Limitations
174+
175+
The [Application](#application), [Content Categories](#content-categories), [Domain](#domain), and [Host](#host) selectors are only available for traffic onboarded to Gateway with [WARP](/cloudflare-one/connections/connect-devices/warp/), [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/), or [Browser Isolation](/cloudflare-one/policies/browser-isolation/). To use these selectors to filter traffic onboarded with WARP, you need to:
176+
177+
1. In your WARP Connector device profile, ensure Split Tunnel is set to [**Exclude IPs and domains**](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode).
178+
2. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel list.
179+
3. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses:
180+
- `100.64.0.0/12`
181+
- `100.81.0.0/16`
182+
- `100.82.0.0/15`
183+
- `100.84.0.0/14`
184+
- `100.88.0.0/13`
185+
- `100.96.0.0/11`
186+
4. Add and deploy the following key-value pair to your devices' [WARP configuration file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) (`mdm.xml` on Windows and Linux or `com.cloudflare.warp.plist` on macOS):
187+
```xml
188+
<key>doh_in_tunnel</key>
189+
<true/>
190+
```

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -395,7 +395,7 @@ Gateway matches HTTP traffic against the following selectors, or criteria:
395395

396396
### Application
397397

398-
<Render file="gateway/selectors/application" params={{ one: "HTTP" }} />
398+
<Render file="gateway/selectors/application" params={{ policyType: "HTTP" }} />
399399

400400
:::caution[Multiple API selectors required for Terraform]
401401
When using Terraform to create a policy with the [Do Not Inspect](#do-not-inspect) action, you must use the `app.hosts_ids` and `app.supports_ids` selectors. For example, to create a Do Not Inspect policy for Google Cloud Platform traffic, create a policy with both `any(app.hosts_ids[*] in {1245})` and `any(app.supports_ids[*] in {1245})`.

‎src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,10 @@ Gateway matches network traffic against the following selectors, or criteria.
248248

249249
### Application
250250

251-
<Render file="gateway/selectors/application" params={{ one: "network" }} />
251+
<Render
252+
file="gateway/selectors/application"
253+
params={{ policyType: "network" }}
254+
/>
252255

253256
### Content Categories
254257

‎src/content/partials/cloudflare-one/gateway/selectors/application.mdx‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
---
2-
inputParameters: param1
3-
2+
params:
3+
- policyType
44
---
55

6-
import { Markdown } from "~/components"
7-
8-
You can apply {props.one} policies to a growing list of popular web applications. Refer to [Application and app types](/cloudflare-one/policies/gateway/application-app-types/) for more information.
6+
You can apply {props.policyType} policies to a growing list of popular web applications. Refer to [Application and app types](/cloudflare-one/policies/gateway/application-app-types/) for more information.
97

108
| UI name | API example | Evaluation phase |
119
| ----------- | -------------------------- | --------------------- |

‎src/content/partials/cloudflare-one/gateway/selectors/domain.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
---
22
{}
3-
43
---
54

65
Use this selector to match against a domain and all subdomains. For example, you can match `example.com` and its subdomains, such as `www.example.com`.

‎src/content/partials/cloudflare-one/gateway/selectors/egress-selector-limitation.mdx‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
{}
3+
---
4+
5+
This selector is only available for traffic onboarded to Gateway with WARP, PAC files, or Browser Isolation. For more information, refer to [Limitations](#limitations).

‎src/content/partials/cloudflare-one/gateway/selectors/host.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
---
22
{}
3-
43
---
54

65
Use this selector to match against only the hostname specified. For example, you can match `test.example.com` but not `example.com` or `www.test.example.com`.

0 commit comments

Comments
 (0)