Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods – for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.
| UI name | API value | Description |
|---|---|---|
| Internet | internet |
Traffic to the public Internet |
| Cloudflare WAN | cloudflare_wan |
Traffic through a Cloudflare WAN connection |
| Cloudflare Tunnel | cloudflare_tunnel |
Traffic to a private origin through Cloudflare Tunnel |
| Cloudflare One Client | device_client |
Traffic to another device running the Cloudflare One Client |
| Mesh | mesh |
Traffic through a Cloudflare Mesh node |
The selector uses the net.offramp.type API field in both HTTP and Network policies.
| UI name | API example |
|---|---|
| Traffic Destination | net.offramp.type == "internet" |
For more information, refer to HTTP policies and Network policies.
Source: Cloudflare
