Personal study reference, not customer-facing. Covers Cloudflare Gateway's real architecture, the three product renames that make older decks/training look outdated (WARP client, Magic WAN, WARP Connector all renamed), the HTTP/3 silent-inspection-gap gotcha, the real Browser Isolation technology (it's not pixel streaming), and corrected plan/compliance claims. Every fact below is sourced from live Cloudflare docs (full list at the bottom).
Users browse from home, coffee shops, airports. They click things they shouldn't, paste sensitive data into the wrong forms, get phished. A traditional data-center firewall never sees any of it because the user never passed through the data center. Cloudflare's Secure Web Gateway (delivered through Cloudflare Gateway, part of Cloudflare One) puts the inspection layer at the edge instead — wherever the user is, the nearest Cloudflare data center is the inspection point.
Three product renames to purge from memory and old decks:
| Old name | Current name (what you should say) |
|---|---|
| WARP client | Cloudflare One Client (binaries/processes are still literally named warp-svc/warp-cli under the hood, and the free consumer 1.1.1.1 app still says "WARP" — but say "Cloudflare One Client" in any Zero Trust/Enterprise conversation) |
| Magic WAN | Cloudflare WAN |
| WARP Connector | Cloudflare Mesh |
Don't say "Cloudflare sees 20% of all internet traffic" — that's not Cloudflare's actual claim and a technical customer can push back on it. The real, current, citable stats: "1 in 5 websites on the Internet use Cloudflare" (20% of web properties, not traffic), network spans 348 cities in 100+ countries, 13,000+ network interconnections, sub-50ms to ~95% of the world's internet-connected population, 234B+ daily cyber threats blocked.
Five on-ramp methods get traffic into Gateway. Pick one or more depending on device type and ownership.
| On-ramp | Policies enforced | Best for |
|---|---|---|
| Cloudflare One Client | DNS, Network, HTTP | Roaming/remote users on managed devices — recommended default |
| DNS resolver config (DoH/DoT/port 53) | DNS only | Unmanaged devices, whole networks, fastest rollout |
| Proxy endpoint (PAC file) | HTTP only | Browsers/devices supporting explicit proxy, no agent |
| Network tunnel (IPsec/GRE via Cloudflare WAN) | DNS, Network, HTTP | Branch offices, data centers, site-to-site |
| Cloudflare Mesh | Network + HTTP, server-initiated | Site-to-site, servers/IoT, no per-device agent needed |
| Mode | DNS | Network | HTTP |
|---|---|---|---|
| Traffic and DNS (default — "full L7 inspection") | ✓ | ✓ | ✓ |
| DNS only | ✓ | — | — |
| Traffic only | — | ✓ | ✓ |
| Local proxy | — | — | ✓ |
| Posture only | — | — | — |
The older "Gateway with WARP" / "WARP" / "1.1.1.1 with WARP" mode names still show up in old training material — those map roughly to Traffic and DNS / Traffic only / DNS only respectively in current naming. Note mode alone doesn't enable TLS decryption — that's a separate toggle (Module 3).
Zero Trust → Traffic policies → Traffic settings → Proxy and inspection (not the old "Settings → Network" path — and this is itself mid-rename to Traffic Controls as Zero Trust and the main Cloudflare dashboard merge navigation). Three independent toggles live here:
The HTTP/3 / QUIC silent inspection gap — one of the most common real misconfigurations: Gateway's proxy only handles TCP unless the UDP proxy is explicitly turned on. Chrome will silently fall back to HTTP/2 (inspectable) if both UDP proxy and TLS decryption are on — but Safari cannot disable QUIC at all, so without the UDP proxy enabled, Safari's HTTP/3 traffic to any QUIC-serving site bypasses HTTP policy enforcement entirely. Network-level policies still apply; HTTP, DLP, and AV scanning do not. Always confirm UDP proxy is on when a customer's fleet includes Mac/Safari users.
Downloaded from Zero Trust → Traffic policies → Traffic settings → Certificates. Required in both the OS system trust store (Keychain on macOS, certlm.msc on Windows, update-ca-certificates on Linux, MDM push for iOS/Android) and separately in app-level trust stores that don't read from the OS: Firefox, Chrome 113+ on macOS/Windows and all Chrome on Linux/ChromeOS, Java (keytool/cacerts), Python (certifi), plus Ruby, Rust/Cargo, npm, Git, AWS/Azure/GCP CLIs, Docker images, and JVM-based IDEs.
Real incident worth knowing: the default Cloudflare-issued root certificate expired February 2, 2025; accounts created before October 17, 2024 had to manually regenerate/reactivate it. Recommend 5-year expiry on custom certs, max 3 generations/day, up to 10 available certs at once — plan rotation ahead rather than reactively.
| Policy type | What it does |
|---|---|
| Packet filtering (Cloudflare Network Firewall, Enterprise only) | Raw L3/4 packet drop by source IP/protocol — evaluated before everything else |
| DNS | Blocks domain resolution before any connection is made |
| Network | L4 stateful firewall — IP, port, protocol, SNI |
| HTTP | L7 forward proxy with TLS decryption — URL/header/file inspection, DLP, AV, Isolate |
| Egress | Assigns fixed/dedicated IPs so partners can allowlist your org's traffic |
| Integrate Workers (beta) | "Forward" action invokes a Cloudflare Worker on permitted traffic |
| Resolver | Routes DNS queries to custom/internal DNS servers instead of Cloudflare's resolver |
DLP is not its own policy tab — it's a profile selected inside an HTTP policy's DLP Profile filter condition. DLP profile/detection-entry management is its own top-level section (Zero Trust → Data loss prevention), but enforcement always happens through an HTTP policy.
Each policy type evaluates top-down, first match wins, and reordering takes up to 60 seconds to propagate globally. The overall cross-type evaluation order (as of a July 14, 2025 change): Packet filtering → DNS (pre-resolution) → Resolver → DNS (post-resolution) → Egress → Network → HTTP. That mid-2025 change means Network policies now evaluate before HTTP policies — which changes which block page a user sees when both a Network Block and an HTTP Block policy would have matched the same traffic.
TCP SYN leak gotcha: Gateway sends the initial TCP SYN to the destination before evaluating HTTP/Network Block policies (to check origin availability). If a customer needs a hard guarantee that zero packets ever reach a specific blocked IP, that requires Cloudflare Network Firewall (Enterprise packet filtering), which runs earlier in the pipeline than standard Network/HTTP policies.
Logging quirk: an HTTP Allow policy can show as the logged action even though a later DLP Block policy is what actually blocked the request — Gateway logs the first decision chronologically, not necessarily the final one. This trips people up reading logs during a demo or incident review.
A DLP profile with zero enabled detection entries matches nothing — always confirm at least one detector (e.g. US SSN) is toggled on before a demo. Confidence is driven by proximity keywords and optional AI context analysis, not a literal per-detector "require context" checkbox — e.g. the word "SSN" appearing near a 9-digit number raises confidence; some predefined entries are explicitly checked for surrounding characters to reduce false positives.
By default, Cloudflare logs the matched profile/category, not the value. Full-payload logging is opt-in per policy, and even then the payload is encrypted — Cloudflare does not store the decryption key.
Current path: Zero Trust → Traffic policies → Traffic settings → Policy settings → "Scan files for malware", with independent upload/download selection — a distinct feature from DLP and the base HTTP engine, though configured on the same Traffic settings page as TLS decryption.
| Plan | Max scannable file size |
|---|---|
| Free | 15 MB |
| Pay-as-you-go | 25 MB |
| Enterprise | 100 MB |
File-type detection chain: Content-Disposition header → byte signature → filename extension → origin Content-Type. Image, video, and audio files are never scanned. PGP-encrypted, password-protected, or deeply nested archives (over 3 recursion levels or 300+ files) also aren't scanned — admin chooses fail-open or fail-closed for those.
Don't say "safe pixel stream" — that's the opposite of Cloudflare's actual approach. Cloudflare's Remote Browser Isolation uses Network Vector Rendering (NVR): it sends drawing instructions to the user's local browser instead of streaming video/pixels of the remote page. This avoids the bandwidth limitations of video-stream-based competitors. As of April 2026, Canvas Remoting extends this further — Canvas-based apps now render via vector commands instead of bitmaps, cutting bandwidth by 10x.
Per-isolation-policy controls confirmed: restrict copy/paste (including "clipboard allowed only within the isolated browser," blocking remote→local paste), file download, file upload, keyboard input, and printing. There's no separate "Browser Isolation admin" RBAC role — the same Zero Trust HTTP Policies Admin role covers both standard HTTP policies and Isolate policies; resource-scoped roles can still be narrowed to a single isolation policy (added Sep 2026).
Enterprise-only add-on (BYOIP also supported). At least two dedicated egress IPs are provisioned in two different cities. Each supports 40,000 concurrent connections per destination IP/port pair.
Genuinely surprising, real selling point: IPv4 egress traffic physically detours to the data center where the dedicated IP actually lives — a potential latency hit for non-Cloudflare-proxied ("gray cloud") destinations. IPv6 egresses locally from the user's nearest data center while still correctly reporting the dedicated IP's geolocation in logs — near-zero latency cost. IPv6 effectively gets global geolocation flexibility that IPv4 can't. IP geolocation database updates take 6+ weeks, so provision well ahead of a go-live date. Doesn't work with Cloudflare Tunnel or Cloudflare WAN-connected private networks, ICMP, or the China Network.
Route specific domains (e.g. your internal corp.example.com) to your own internal DNS servers instead of Cloudflare's resolver — reachable via a tunnel. Resolver, Cloudflare WAN, and Cloudflare Mesh traffic all funnel through the same Gateway DNS resolver IPs (172.64.36.1 / 172.64.36.2) — one consistent DNS architecture across branch, cloud, and roaming users.
cloudflared proxy-dns deprecated (Feb 2026) in favor of Cloudflare One Client / Cloudflare Mesh.Cloudflare One is available on all plans — Zero Trust Free genuinely includes Gateway DNS/HTTP/Network policies, just with lower limits and without premium add-ons.
| Feature | Plan |
|---|---|
| Core Gateway (DNS/Network/HTTP policies) | All plans, including Free |
| Browser Isolation | Add-on — Pay-as-you-go and Enterprise (not Free) |
| Dedicated Egress IPs | Enterprise-only add-on |
| AV scanning file size limit | 15 MB Free / 25 MB Pay-as-you-go / 100 MB Enterprise |
| Cloudflare Network Firewall (packet filtering) | Enterprise |
| FIPS mode | Enterprise |
SOC 2 (Type II), ISO 27001, FedRAMP Moderate (plus a FedRAMP International variant for non-US Data Localization regions), PCI DSS Level 1 Service Provider (highest tier, certified since 2014, audited annually — and Gateway, Browser Isolation, CASB, DLP, Cloudflare Tunnel, Cloudflare One Client, and Cloudflare One itself are explicitly in-scope for this attestation), and C5 (Germany's BSI cloud standard). IRAP (Australia) is also referenced as an available compliance region. Full attestation documents require NDA + Super Admin access via the dashboard's compliance docs section, not public pages.
| Scenario | Use |
|---|---|
| Unmanaged devices, fastest rollout | DNS resolver on-ramp (DoH/DoT) — DNS-only filtering, no agent |
| Roaming managed laptops, full coverage | Cloudflare One Client, Traffic and DNS mode |
| Branch office / data center | Cloudflare WAN tunnel (IPsec/GRE) |
| Servers/IoT, no per-device agent | Cloudflare Mesh |
| Safari/Mac fleet, worried about silent HTTP/3 bypass | Confirm UDP proxy is enabled alongside TLS decryption |
| Partner needs to allowlist your IP | Dedicated Egress IPs (Enterprise) — mind the IPv4 latency detour vs IPv6 |
| Legal/compliance team must browse external sites safely | Browser Isolation with copy/paste and upload restrictions |
| Need a hard guarantee zero packets reach a blocked IP | Cloudflare Network Firewall (Enterprise packet filtering) — not standard Network/HTTP Block |
~20–25 min, Mac with Cloudflare One Client, browser-driven, five live blocks. Pulled from the companion demo script and configuration how-to.
curl -sI https://example.com | grep cf-ray should return a cf-ray headerRequired policies deployed before the demo: DNS block on Security Threats (Malware/Phishing/C2/Cryptomining), HTTP block on Gambling category, HTTP isolate on Newly Seen Domains, HTTP block on PII uploads (DLP profile attached, at least one detection entry enabled).
// Browser: navigate to http://malware.testcategory.com
// Expect: Cloudflare block page, "matches Malware category"
// DNS query never resolved to the real IP; TCP connection never opened.Pivot to Logs → Gateway → DNS, filter by domain — show user, device, action, category, timestamp.
// Browser: navigate to a known gambling URL
// Expect: HTTP-layer block page, "blocked by your security team"Mention: exceptions by IdP group, log-only mode, custom block page with helpdesk contact — all one-click changes.
// Policy: HTTP · Application = · Method = POST · Action = Block
// Browser: navigate to the file-sharing site, try to upload a file
// Expect: upload blocked, but the rest of the site still loads normally The point: we didn't block the whole site, only the POST carrying the file. Before TLS decryption, this whole exchange looks like opaque encrypted bytes to a traditional firewall.
// Policy: HTTP · Categories = Newly Seen, Uncategorized · Action = Isolate
// Browser: visit a newly-registered or obscure domain
// Expect: site loads normally for the user, but DevTools -> Network shows
// everything routing through the isolation serviceCorrect framing: Network Vector Rendering sends drawing instructions, not a pixel/video stream (Module 5). No JavaScript executes locally.
// Policy: HTTP · DLP profile = US PII (SSN/Credit Card/Driver's License) · Action = Block
// Browser: submit a form containing a format-valid fake SSN (e.g. 512-74-8391)
// Expect: submission blockedPivot to Logs → Gateway → HTTP, filter by DLP — show the event with profile-name attribution, no value logged (Module 5).
Logs are empty in the dashboard
Confirm Cloudflare One Client shows Connected with the correct team. Confirm mode is Traffic and DNS, not DNS-only or Posture-only. Run curl -sI https://example.com | grep cf-ray — a cf-ray header confirms Gateway is in the path.
HTTPS sites show cert errors
Root cert isn't trusted. Re-download from Traffic settings → Certificates, re-add to Keychain/certlm.msc/update-ca-certificates → set to Always Trust. Remember app-level stores (Firefox, Java, Python) need separate installation.
A specific app breaks under TLS decryption (Zoom, Teams, banking)
Certificate pinning or mTLS — Gateway terminates the client connection and can't forward the original client cert, so pinned/mTLS apps categorically break under inspection. The fix is always a Do Not Inspect HTTP policy for that app/domain, never a workaround.
Some HTTP/3 traffic is bypassing policy entirely
UDP proxy is off. Enable it alongside TLS decryption (Module 3) — otherwise Safari's unavoidable QUIC traffic skips HTTP/DLP/AV inspection completely.
DLP isn't catching what's expected
Most common cause: the profile has zero detection entries enabled. Also check: TLS decryption must be ON, the DLP profile must actually be attached to an HTTP policy, image/binary content types aren't scanned by default, and a bare placeholder value may not trigger confidence thresholds — use a realistic format-valid example instead.
A policy doesn't seem to be taking effect
Allow up to 60 seconds for propagation after reordering. Check precedence — first match wins within each policy type, and as of July 2025 Network policies evaluate before HTTP policies overall.
"How does this compare to Zscaler / Netskope / Palo Alto Prisma Access?"
Same edge as everything else Cloudflare does — no separate inline component or identity store. One client (Cloudflare One Client) does SWG + ZTNA + DNS filtering where competitors often need 2-3 agents. One policy language combines SWG rules with WAF, bots, identity, and access. Network claim to use accurately: "1 in 5 websites on the Internet use Cloudflare" (not "20% of traffic").
"Do we have to install certs on every device?"
Yes, for TLS decryption — same as any inline SWG. MDM push handles it (Intune, Jamf, Kandji, Workspace ONE). Without the cert, DNS filtering and basic categorization still work; body inspection and DLP don't.
"Will this slow down browsing?"
Usually faster — Cloudflare's edge (348 cities) is typically closer to users than their data center. Inspection adds single-digit milliseconds.
"What about users not on the client?"
DNS resolver on-ramp (DoH/DoT), proxy endpoint (PAC file), or a Cloudflare WAN tunnel from office networks. Cloudflare One Client gives the deepest enforcement and best UX but isn't the only on-ramp.
"What data does Cloudflare store from DLP matches?"
By default, the matched category/profile, not the value. Full-payload logging is opt-in per policy, and even then the payload is encrypted with no stored decryption key.
"How quickly can we deploy a pilot?"
With an existing IdP and MDM: 1-2 days for a small pilot group — enrollment policy, push client + cert via MDM, a few starter policies, start watching logs. Full org rollout is weeks, not months.
Click a question to reveal the answer. No peeking before you commit to one.
Cloudflare One Client, Cloudflare WAN, and Cloudflare Mesh respectively. The underlying binaries still say warp-svc/warp-cli, and the free consumer app still says "WARP" — but use the new names in any Zero Trust/Enterprise conversation.
Traffic and DNS mode (the default). Note the mode alone doesn't enable TLS decryption — that's a separate toggle.
The UDP proxy isn't enabled. Safari cannot disable QUIC/HTTP-3, so without the UDP proxy turned on alongside TLS decryption, that traffic skips HTTP/DLP/AV inspection entirely — Network policies still apply, HTTP-layer ones don't.
False. Several applications maintain their own trust stores independent of the OS — Firefox, Chrome 113+ on macOS/Windows (and all Chrome on Linux/ChromeOS), Java, Python (certifi), and others. The cert needs to be installed in both places.
Seven: Packet filtering (Enterprise), DNS, Network, HTTP, Egress, Integrate Workers (beta), and Resolver. DLP is not a separate tab — it's a profile selected inside an HTTP policy's filter condition.
Network policies now evaluate before HTTP policies in the overall cross-type order — which changes which block page a user sees when both a Network Block and an HTTP Block policy would match the same traffic.
No — Gateway sends the initial TCP SYN to the destination before evaluating HTTP/Network Block policies (to check origin availability). A true zero-packet guarantee requires Cloudflare Network Firewall (Enterprise packet filtering), which runs earlier in the pipeline.
The profile has zero detection entries enabled — a profile with nothing toggled on matches nothing. Also check: TLS decryption is on, the profile is actually attached to an HTTP policy, and the test value isn't a format that fails confidence/proximity checks.
No — by default it logs the matched category/profile, not the value. Full-payload logging is opt-in per policy, and even then the payload is encrypted with no stored decryption key.
NVR sends drawing instructions to the user's local browser instead of streaming video/pixels of the remote page — this is Cloudflare's actual bandwidth-efficient approach, the opposite of a pixel-streaming architecture. Canvas Remoting (Apr 2026) extended this to Canvas-based apps, cutting bandwidth 10x.
15 MB on Free, 100 MB on Enterprise (25 MB on Pay-as-you-go). Image, video, and audio files are never scanned regardless of plan.
IPv4 traffic physically detours to the data center where the dedicated IP lives (potential latency cost). IPv6 egresses locally from the nearest data center while still correctly reporting the dedicated IP's geolocation — near-zero latency cost. IPv6 effectively gets geolocation flexibility IPv4 can't match.
False — the accurate, citable claim is "1 in 5 websites on the Internet use Cloudflare" (20% of web properties, not traffic). A technical customer can push back on the traffic-volume framing.
Any two of: PCI DSS Level 1 Service Provider (Gateway, Browser Isolation, CASB, DLP, Tunnel, and Cloudflare One Client are explicitly in-scope), C5 (Germany's BSI standard), FedRAMP International (non-US Data Localization regions), or IRAP (Australia).
A Do Not Inspect HTTP policy matching that app/domain. Gateway terminates the client connection and can't forward the original client cert, so pinned/mTLS apps categorically fail under inspection — there's no workaround other than excluding them.
No — it's an add-on available on Pay-as-you-go and Enterprise plans. Core Gateway (DNS/Network/HTTP policies) is on Free; Browser Isolation, Dedicated Egress IPs, and Cloudflare Network Firewall are not.
Gateway logs the first decision chronologically, not necessarily the final enforcement outcome — an earlier Allow can be the logged action even though a later DLP Block policy is what actually stopped the request. Worth knowing before reading logs during a demo or incident review.