Skip to content

[Gateway] Update new egress policy selectors #22045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Apr 30, 2025
Merged

[Gateway] Update new egress policy selectors #22045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
21bbd3a
Update content categories partial
maxvp Apr 28, 2025
db579b1
Update domain selector partial
maxvp Apr 28, 2025
56cac93
Update host selector partial
maxvp Apr 28, 2025
be2b3dc
Add WARP version
maxvp Apr 28, 2025
2c99cef
Merge branch 'production' into max/gw/update-egress-selectors
maxvp Apr 29, 2025
0c6f060
Add WARP beta
maxvp Apr 29, 2025
77937b5
Fix other API examples
maxvp Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,11 +347,14 @@ Use this selector to filter DNS responses by their `TXT` records.

### Domain

<Render file="gateway/selectors/domain" />
<Render
file="gateway/selectors/domain"
params={{ APIendpoint: "dns.domains" }}
/>

### Host

<Render file="gateway/selectors/host" />
<Render file="gateway/selectors/host" params={{ APIendpoint: "dns.fqdn" }} />

### Indicator Feeds

Expand Down
24 changes: 13 additions & 11 deletions src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ Gateway matches egress traffic against the following selectors, or criteria:

<Render
file="gateway/selectors/net-http-content-categories"
params={{ APIendpoint: "net.fqdn.category" }}
params={{ APIendpoint: "net.fqdn.content_category" }}
/>

<Render file="gateway/selectors/egress-selector-limitation" />
Expand Down Expand Up @@ -101,13 +101,19 @@ Gateway matches egress traffic against the following selectors, or criteria:

### Domain <Badge text="Beta" variant="caution"/>

<Render file="gateway/selectors/domain" />
<Render
file="gateway/selectors/domain"
params={{ APIendpoint: "net.fqdn.domains" }}
/>

<Render file="gateway/selectors/egress-selector-limitation" />

### Host <Badge text="Beta" variant="caution"/>

<Render file="gateway/selectors/host" />
<Render
file="gateway/selectors/host"
params={{ APIendpoint: "net.fqdn.host" }}
/>

<Render file="gateway/selectors/egress-selector-limitation" />

Expand Down Expand Up @@ -174,17 +180,13 @@ Gateway uses Rust to evaluate regular expressions. The Rust implementation is sl

The [Application](#application), [Content Categories](#content-categories), [Domain](#domain), and [Host](#host) selectors are only available for traffic onboarded to Gateway with [WARP](/cloudflare-one/connections/connect-devices/warp/), [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/), or [Browser Isolation](/cloudflare-one/policies/browser-isolation/). To use these selectors to filter traffic onboarded with WARP, you need to:

1. In your WARP [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), ensure Split Tunnel is set to [**Exclude IPs and domains**](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode).
2. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel list.
3. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses:
1. Ensure you have deployed [WARP beta version 2025.4.589.1](/cloudflare-one/connections/connect-devices/warp/download-warp/beta-releases/) or later on your users' devices.
2. In your WARP [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), ensure Split Tunnel is set to [**Exclude IPs and domains**](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode).
3. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel list.
4. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses:
- `100.64.0.0/12`
- `100.81.0.0/16`
- `100.82.0.0/15`
- `100.84.0.0/14`
- `100.88.0.0/13`
- `100.96.0.0/11`
4. Add and deploy the following key-value pair to your devices' [WARP configuration file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) (`mdm.xml` on Windows and Linux or `com.cloudflare.warp.plist` on macOS):
```xml
<key>doh_in_tunnel</key>
<true/>
```
7 changes: 5 additions & 2 deletions src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,11 +105,14 @@ For more information on creating a DNS policy, refer to [DNS policies](/cloudfla

### Domain

<Render file="gateway/selectors/domain" />
<Render
file="gateway/selectors/domain"
params={{ APIendpoint: "dns.domains" }}
/>

### Host

<Render file="gateway/selectors/host" />
<Render file="gateway/selectors/host" params={{ APIendpoint: "dns.fqdn" }} />

### Location

Expand Down
6 changes: 3 additions & 3 deletions src/content/partials/cloudflare-one/gateway/selectors/destination-ip.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@

The IP address of the request's target.

| UI name | API example |
| -------------- | ---------------------------- |
| Destination IP | `net.dst.ip == "10.0.0.0/8"` |
| UI name | API example |
| -------------- | ------------------------- |
| Destination IP | `net.dst.ip == 192.0.2.0` |
6 changes: 3 additions & 3 deletions src/content/partials/cloudflare-one/gateway/selectors/destination-port.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@

The port number of the request's target.

| UI name | API example |
| ---------------- | ------------------------ |
| Destination Port | `net.dst.port == "2222"` |
| UI name | API example |
| ---------------- | ---------------------- |
| Destination Port | `net.dst.port == 2222` |
9 changes: 5 additions & 4 deletions src/content/partials/cloudflare-one/gateway/selectors/domain.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
---
{}
params:
- APIendpoint
---

Use this selector to match against a domain and all subdomains. For example, you can match `example.com` and its subdomains, such as `www.example.com`.

| UI name | API example | Evaluation phase |
| ------- | -------------------------------------- | --------------------- |
| Domain | `any(dns.domains[*] == "example.com")` | Before DNS resolution |
| UI name | API example | Evaluation phase |
| ------- | ------------------------------------------------- | --------------------- |
| Domain | <code>any({props.APIendpoint}[*] in \{1\})</code> | Before DNS resolution |
9 changes: 5 additions & 4 deletions src/content/partials/cloudflare-one/gateway/selectors/host.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
---
{}
params:
- APIendpoint
---

Use this selector to match against only the hostname specified. For example, you can match `test.example.com` but not `example.com` or `www.test.example.com`.

| UI name | API example | Evaluation phase |
| ------- | -------------------------------- | --------------------- |
| Host | `dns.fqdn == "test.example.com"` | Before DNS resolution |
| UI name | API example | Evaluation phase |
| ------- | --------------------------------------------------- | --------------------- |
| Host | <code>{props.APIendpoint} == \"example.com\"</code> | Before DNS resolution |
8 changes: 3 additions & 5 deletions ...ntent/partials/cloudflare-one/gateway/selectors/net-http-content-categories.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,8 @@ params:
- APIendpoint
---

import { Markdown } from "~/components";

| UI name | API example |
| ------------------ | ------------------------------------------------------ |
| Content Categories | <code>not(any({props.APIendpoint}[*] in \{1\}))</code> |
| UI name | API example |
| ------------------ | ------------------------------------------------- |
| Content Categories | <code>any({props.APIendpoint}[*] in \{1\})</code> |

For more information, refer to the list of [content categories](/cloudflare-one/policies/gateway/domain-categories/#content-categories).