Gateway, Cloudflare One - Traffic Destination selector in Gateway policies

<p>Gateway <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/">HTTP</a> and <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/">Network</a> policies now include a <strong>Traffic Destination</strong> selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="available-traffic-destination-values">Available traffic destination values</h4><a class="anchor-link" href="#available-traffic-destination-values"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>UI name</th> <th>API value</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Internet</td> <td><code>internet</code></td> <td>Traffic to the public Internet</td> </tr> <tr> <td>Cloudflare WAN</td> <td><code>cloudflare_wan</code></td> <td>Traffic through a <a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/">Cloudflare WAN</a> connection</td> </tr> <tr> <td>Cloudflare Tunnel</td> <td><code>cloudflare_tunnel</code></td> <td>Traffic to a private origin through <a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/">Cloudflare Tunnel</a></td> </tr> <tr> <td>Cloudflare One Client</td> <td><code>device_client</code></td> <td>Traffic to another device running the <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/">Cloudflare One Client</a></td> </tr> <tr> <td>Mesh</td> <td><code>mesh</code></td> <td>Traffic through a <a href="https://developers.cloudflare.com/mesh/">Cloudflare Mesh</a> node</td> </tr> </tbody> </table></div> <p>The selector uses the <code>net.offramp.type</code> API field in both HTTP and Network policies.</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>UI name</th> <th>API example</th> </tr> </thead> <tbody> <tr> <td>Traffic Destination</td> <td><code>net.offramp.type == "internet"</code></td> </tr> </tbody> </table></div> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/">HTTP policies</a> and <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/">Network policies</a>.</p>