Require Gateway connections
🗺️ This tutorial covers how to:
- Add Cloudflare Gateway to your Cloudflare for Teams account
- Enroll devices in Cloudflare Gateway
- View enrolled devices
- Build a rule in Access to require Cloudflare Gateway
⏲️Time to complete:
Add Cloudflare Gateway
Cloudflare Gateway operates in two modes:
- DNS filtering
- Proxy (HTTP filtering)
To filter all Internet-bound traffic in the proxy mode, devices must install and enroll the Cloudflare for Teams WARP client. The WARP client will send all Internet traffic to a Cloudflare data center near the user where it can be filtered and logged before reaching the rest of the Internet.
Building a rule in Access to enforce Gateway connections requires the use of the WARP client and its configuration to proxy Internet traffic to Cloudflare.
Determine which devices can enroll
To proxy traffic through Gateway, devices must run the Cloudflare WARP client and . When devices enroll, users will be prompted to authenticate with your identity provider or a consumer identity service. You can also deploy the client and its configurations like JAMF or InTune.
First, determine which devices can enroll based on user identity. If you have already integrated your identity provider when setting up Cloudflare Access you can reuse that integration. If you have not set up an identity provider, follow to add Access and integrate a free identity option or a specific provider.
Next, build a rule to decide which devices can enroll into your Gateway account. Navigate to the
Devices page in the
My Teams section of the sidebar.
Device Settings to build the enrollment rule. In the policy, define who should be allowed to enroll a device and click
Enroll a device
Once installed, click the gear icon.
Account tab, click
Login with Cloudflare for Teams.
Input your Cloudflare for Teams org name. You will have created this during the Cloudflare Access setup flow. You can find it under the
Authentication tab in the
Access section of the sidebar.
The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to
Teams mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to
Gateway with WARP. These settings can be configured globally for an organization through a device management platform.
Configure the Cloudflare certificate
Download the Cloudflare certificate provided in the . You can also find the certificate in the Cloudflare for Teams dashboard. Navigate to the
Account page in the
Settings section of the sidebar and scroll to the bottom.
Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to the
Policies page in the Gateway section. Scroll to the bottom and toggle
Proxy Settings to enabled.
View enrolled devices
You can view enrolled devices and their associated users in the Cloudflare for Teams dashboard. To do so, navigate to the
My Teams section and open the
Build a Gateway rule in Access
You can now build rules in Cloudflare Access applications that require users connecting to those applications do so through Cloudflare Gateway. This can help protect your applications by only allowing devices which are blocked from reaching malware on the Internet. Additionally, you can ensure that you do not miss logs of SaaS application activity by requiring users who login to those SaaS applications only do so through Cloudflare Gateway.
To add a
Require Gateway rule, navigate to the
Authentication page of the
Access section of the Cloudflare for Teams dashboard. Click the Device Posture tab. Click + Add.
Gateway from the options listed.
Click Save on the next screen.
You can now build rules with your organization's Cloudflare Gateway configuration.
To do build rules, open the
Applications page of the
Access section of the dashboard. Edit an existing application or add a new one.
Edit an existing rule or add a new one.
In the rule builder view, click + Add require and select
Gateway from both drop-down menus.
Save the rule and the application.
Requests and logins to the application will now require Gateway be used to connect.
You can avoid adding the
Require Gateway rule to each application manually by creating an
Access Group which includes the
Require rule, similar to . Add that
Access Group to applications and the Gateway requirement will be enforced.