Traffic Source selector in Gateway policies

Gateway HTTP and Network policies now include a Traffic Source selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint.

Available traffic source values

UI name · API value · Description

Device client · device_client · Traffic from the Cloudflare One Client (WARP)

Mesh · mesh · Traffic from a Cloudflare Mesh connector

Cloudflare WAN · cloudflare_wan · Traffic from Cloudflare WAN (Magic WAN)

Clientless RDP · clientless_rdp · Traffic from a clientless RDP session

Proxy endpoint · proxy_endpoint · Traffic from a proxy endpoint (PAC file)

Clientless Browser Isolation · agentless_biso · Traffic from clientless Browser Isolation

MCP portal · mcp_portal · Traffic from an MCP portal

The selector uses the net.onramp.type API field in both HTTP and Network policies.

UI name · API example

Traffic Source · net.onramp.type == "device_client"

Browser Isolation selector

A Browser Isolation selector is also available in Network and HTTP policies. This selector identifies whether the current session is running inside Remote Browser Isolation, allowing administrators to apply different policy behavior to isolated traffic.

UI name · API example

Browser Isolation · net.is_isolated == true

For more information, refer to HTTP policies and Network policies.