Enable Magic Firewall

Magic Transit customers are automatically provided with the standard features of Magic Firewall, Cloudflare's firewall-as-a-service product.

Cloudflare recommends creating a ruleset customized to your environment and needs. Without any rules configured, Magic Firewall will pass on all traffic after mitigations are applied to your tunnels.

The Extended ruleset is the best practice for reducing your attack surface by adopting a positive security model. If possible, use your current Edge Firewall policies to help you decide what ports to permit/block.

If you cannot use the extended ruleset, then use the minimal ruleset guidance to create a customized ruleset to block known unwanted traffic and common vectors for attack.