Common policies
The following policies are commonly used to secure network traffic.
Refer to the network policies page for a comprehensive list of other selectors, operators, and actions.
To minimize the risk of shadow IT, some organizations choose to limit their users’ access to certain web-based tools and applications. For example, the following policy blocks AI assistants:
| Selector | Operator | Value | Action |
|---|---|---|---|
| Application | in | Microsoft Copilot, ChatGPT, Google Gemini | Block |
Configure access on a per user or group basis by adding identity-based conditions to your policies.
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Application | in | Salesforce | And | Block |
| User Group Names | in | Contractors |
Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the device posture section.
In the following example, you can use a list of device serial numbers to ensure users can only access an application if they connect with the WARP client from a company device:
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Passed Device Posture Checks | not in | Device serial numbers | And | Block |
| SNI Domain | is | internalapp.com |
Require users to re-authenticate after a certain amount of time has elapsed.
Restrict access to resources which you have connected through Cloudflare Tunnel.
The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic. Make sure that the Allow policy has higher priority (by positioning it towards the top of the list in the UI).
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Destination IP | in | 10.0.0.0/8 | And | Allow |
| User Email | matches regex | .*@example.com |
| Selector | Operator | Value | Action |
|---|---|---|---|
| Destination IP | in | 10.0.0.0/8 | Block |