Common policies

The following policies are commonly used to secure network traffic.

Refer to the network policies page for a comprehensive list of other selectors, operators, and actions.

Block unauthorized applications

To minimize the risk of shadow IT, some organizations choose to limit their users' access to certain web-based tools and applications. For example, the following policy blocks AI assistants:

Selector	Operator	Value	Action
Application	in	Microsoft Copilot, ChatGPT, Google Gemini	Block

Note

After seven days, view your shadow IT analytics and block additional applications based on what your users are accessing.

Check user identity

Configure access on a per user or group basis by adding identity-based conditions to your policies.

Selector	Operator	Value	Logic	Action
Application	in	Salesforce	And	Block
User Group Names	in	Contractors

Enforce device posture

Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the device posture section.

For example, you can use a list of device serial numbers to ensure users can only access an application if they connect with the WARP client from a company device:

Selector	Operator	Value	Logic	Action
SNI Domain	is	internalapp.com	And	Block
Passed Device Posture Checks	not in	Device serial numbers

Enforce session duration

To require users to re-authenticate after a certain amount of time has elapsed, configure WARP sessions.

Allow only approved traffic

Restrict user access to only the specific sites or applications configured in your HTTP policies.

1. Allow HTTP and HTTPS traffic

Selector	Operator	Value	Logic	Action
Detected Protocol	is	TLS	And	Allow
Destination Port	in	80, 443

2. Block all other traffic

Selector	Operator	Value	Action
Protocol	in	UDP, TCP	Block

Restrict access to private networks

Restrict access to resources which you have connected through Cloudflare Tunnel.

The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic. Make sure that the Allow policy has higher priority (by positioning it towards the top of the list in the UI).

1. Allow company employees

Selector	Operator	Value	Logic	Action
Destination IP	in	10.0.0.0/8	And	Allow
User Email	matches regex	.*@example.com

2. Block everyone else

Selector	Operator	Value	Action
Destination IP	in	10.0.0.0/8	Block

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!