Skip to content

Commit c84a172

Browse files
maxvpmaxvp
authored
[Gateway] Update new egress policy selectors (#22045)
1 parent 6c67bfc commit c84a172

File tree

8 files changed

+42
-34
lines changed

8 files changed

+42
-34
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx

+5-2
Original file line numberDiff line numberDiff line change
@@ -347,11 +347,14 @@ Use this selector to filter DNS responses by their `TXT` records.
347347

348348
### Domain
349349

350-
<Render file="gateway/selectors/domain" />
350+
<Render
351+
file="gateway/selectors/domain"
352+
params={{ APIendpoint: "dns.domains" }}
353+
/>
351354

352355
### Host
353356

354-
<Render file="gateway/selectors/host" />
357+
<Render file="gateway/selectors/host" params={{ APIendpoint: "dns.fqdn" }} />
355358

356359
### Indicator Feeds
357360

‎src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx

+13-11
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ Gateway matches egress traffic against the following selectors, or criteria:
6868

6969
<Render
7070
file="gateway/selectors/net-http-content-categories"
71-
params={{ APIendpoint: "net.fqdn.category" }}
71+
params={{ APIendpoint: "net.fqdn.content_category" }}
7272
/>
7373

7474
<Render file="gateway/selectors/egress-selector-limitation" />
@@ -101,13 +101,19 @@ Gateway matches egress traffic against the following selectors, or criteria:
101101

102102
### Domain <Badge text="Beta" variant="caution"/>
103103

104-
<Render file="gateway/selectors/domain" />
104+
<Render
105+
file="gateway/selectors/domain"
106+
params={{ APIendpoint: "net.fqdn.domains" }}
107+
/>
105108

106109
<Render file="gateway/selectors/egress-selector-limitation" />
107110

108111
### Host <Badge text="Beta" variant="caution"/>
109112

110-
<Render file="gateway/selectors/host" />
113+
<Render
114+
file="gateway/selectors/host"
115+
params={{ APIendpoint: "net.fqdn.host" }}
116+
/>
111117

112118
<Render file="gateway/selectors/egress-selector-limitation" />
113119

@@ -174,17 +180,13 @@ Gateway uses Rust to evaluate regular expressions. The Rust implementation is sl
174180

175181
The [Application](#application), [Content Categories](#content-categories), [Domain](#domain), and [Host](#host) selectors are only available for traffic onboarded to Gateway with [WARP](/cloudflare-one/connections/connect-devices/warp/), [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/), or [Browser Isolation](/cloudflare-one/policies/browser-isolation/). To use these selectors to filter traffic onboarded with WARP, you need to:
176182

177-
1. In your WARP [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), ensure Split Tunnel is set to [**Exclude IPs and domains**](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode).
178-
2. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel list.
179-
3. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses:
183+
1. Ensure you have deployed [WARP beta version 2025.4.589.1](/cloudflare-one/connections/connect-devices/warp/download-warp/beta-releases/) or later on your users' devices.
184+
2. In your WARP [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), ensure Split Tunnel is set to [**Exclude IPs and domains**](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode).
185+
3. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel list.
186+
4. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses:
180187
- `100.64.0.0/12`
181188
- `100.81.0.0/16`
182189
- `100.82.0.0/15`
183190
- `100.84.0.0/14`
184191
- `100.88.0.0/13`
185192
- `100.96.0.0/11`
186-
4. Add and deploy the following key-value pair to your devices' [WARP configuration file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) (`mdm.xml` on Windows and Linux or `com.cloudflare.warp.plist` on macOS):
187-
```xml
188-
<key>doh_in_tunnel</key>
189-
<true/>
190-
```

‎src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx

+5-2
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,14 @@ For more information on creating a DNS policy, refer to [DNS policies](/cloudfla
105105

106106
### Domain
107107

108-
<Render file="gateway/selectors/domain" />
108+
<Render
109+
file="gateway/selectors/domain"
110+
params={{ APIendpoint: "dns.domains" }}
111+
/>
109112

110113
### Host
111114

112-
<Render file="gateway/selectors/host" />
115+
<Render file="gateway/selectors/host" params={{ APIendpoint: "dns.fqdn" }} />
113116

114117
### Location
115118

‎src/content/partials/cloudflare-one/gateway/selectors/destination-ip.mdx

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44

55
The IP address of the request's target.
66

7-
| UI name | API example |
8-
| -------------- | ---------------------------- |
9-
| Destination IP | `net.dst.ip == "10.0.0.0/8"` |
7+
| UI name | API example |
8+
| -------------- | ------------------------- |
9+
| Destination IP | `net.dst.ip == 192.0.2.0` |

‎src/content/partials/cloudflare-one/gateway/selectors/destination-port.mdx

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44

55
The port number of the request's target.
66

7-
| UI name | API example |
8-
| ---------------- | ------------------------ |
9-
| Destination Port | `net.dst.port == "2222"` |
7+
| UI name | API example |
8+
| ---------------- | ---------------------- |
9+
| Destination Port | `net.dst.port == 2222` |

‎src/content/partials/cloudflare-one/gateway/selectors/domain.mdx

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
---
2-
{}
2+
params:
3+
- APIendpoint
34
---
45

56
Use this selector to match against a domain and all subdomains. For example, you can match `example.com` and its subdomains, such as `www.example.com`.
67

7-
| UI name | API example | Evaluation phase |
8-
| ------- | -------------------------------------- | --------------------- |
9-
| Domain | `any(dns.domains[*] == "example.com")` | Before DNS resolution |
8+
| UI name | API example | Evaluation phase |
9+
| ------- | ------------------------------------------------- | --------------------- |
10+
| Domain | <code>any({props.APIendpoint}[*] in \{1\})</code> | Before DNS resolution |

‎src/content/partials/cloudflare-one/gateway/selectors/host.mdx

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
---
2-
{}
2+
params:
3+
- APIendpoint
34
---
45

56
Use this selector to match against only the hostname specified. For example, you can match `test.example.com` but not `example.com` or `www.test.example.com`.
67

7-
| UI name | API example | Evaluation phase |
8-
| ------- | -------------------------------- | --------------------- |
9-
| Host | `dns.fqdn == "test.example.com"` | Before DNS resolution |
8+
| UI name | API example | Evaluation phase |
9+
| ------- | --------------------------------------------------- | --------------------- |
10+
| Host | <code>{props.APIendpoint} == \"example.com\"</code> | Before DNS resolution |

‎src/content/partials/cloudflare-one/gateway/selectors/net-http-content-categories.mdx

+3-5
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,8 @@ params:
33
- APIendpoint
44
---
55

6-
import { Markdown } from "~/components";
7-
8-
| UI name | API example |
9-
| ------------------ | ------------------------------------------------------ |
10-
| Content Categories | <code>not(any({props.APIendpoint}[*] in \{1\}))</code> |
6+
| UI name | API example |
7+
| ------------------ | ------------------------------------------------- |
8+
| Content Categories | <code>any({props.APIendpoint}[*] in \{1\})</code> |
119

1210
For more information, refer to the list of [content categories](/cloudflare-one/policies/gateway/domain-categories/#content-categories).

0 commit comments

Comments
 (0)