Traffic Destination selector in Gateway policies

Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.

Available traffic destination values

UI name · API value · Description

Internet · internet · Traffic to the public Internet

Cloudflare WAN · cloudflare_wan · Traffic through a Cloudflare WAN connection

Cloudflare Tunnel · cloudflare_tunnel · Traffic to a private origin through Cloudflare Tunnel

Cloudflare One Client · device_client · Traffic to another device running the Cloudflare One Client

Mesh · mesh · Traffic through a Cloudflare Mesh node

The selector uses the net.offramp.type API field in both HTTP and Network policies.

UI name · API example

Traffic Destination · net.offramp.type == "internet"

For more information, refer to HTTP policies and Network policies.