Gateway, Cloudflare One - Traffic Source selector in Gateway policies

<p>Gateway <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/">HTTP</a> and <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/">Network</a> policies now include a <strong>Traffic Source</strong> selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="available-traffic-source-values">Available traffic source values</h4><a class="anchor-link" href="#available-traffic-source-values"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>UI name</th> <th>API value</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Device client</td> <td><code>device_client</code></td> <td>Traffic from the <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/">Cloudflare One Client (WARP)</a></td> </tr> <tr> <td>Mesh</td> <td><code>mesh</code></td> <td>Traffic from a <a href="https://developers.cloudflare.com/mesh/">Cloudflare Mesh</a> connector</td> </tr> <tr> <td>Cloudflare WAN</td> <td><code>cloudflare_wan</code></td> <td>Traffic from <a href="https://developers.cloudflare.com/cloudflare-wan/zero-trust/cloudflare-gateway/">Cloudflare WAN</a> (Magic WAN)</td> </tr> <tr> <td>Clientless RDP</td> <td><code>clientless_rdp</code></td> <td>Traffic from a clientless RDP session</td> </tr> <tr> <td>Proxy endpoint</td> <td><code>proxy_endpoint</code></td> <td>Traffic from a <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/">proxy endpoint</a> (PAC file)</td> </tr> <tr> <td>Clientless Browser Isolation</td> <td><code>agentless_biso</code></td> <td>Traffic from <a href="https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/">clientless Browser Isolation</a></td> </tr> <tr> <td>MCP portal</td> <td><code>mcp_portal</code></td> <td>Traffic from an <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/">MCP portal</a></td> </tr> </tbody> </table></div> <p>The selector uses the <code>net.onramp.type</code> API field in both HTTP and Network policies.</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>UI name</th> <th>API example</th> </tr> </thead> <tbody> <tr> <td>Traffic Source</td> <td><code>net.onramp.type == "device_client"</code></td> </tr> </tbody> </table></div> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="browser-isolation-selector">Browser Isolation selector</h4><a class="anchor-link" href="#browser-isolation-selector"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>A <strong>Browser Isolation</strong> selector is also available in Network and HTTP policies. This selector identifies whether the current session is running inside <a href="https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/">Remote Browser Isolation</a>, allowing administrators to apply different policy behavior to isolated traffic.</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>UI name</th> <th>API example</th> </tr> </thead> <tbody> <tr> <td>Browser Isolation</td> <td><code>net.is_isolated == true</code></td> </tr> </tbody> </table></div> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/">HTTP policies</a> and <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/">Network policies</a>.</p>