Cloudflare Docs
Learning Paths
Secure your Internet traffic and SaaS apps (Learning Path)
Edit this page on GitHub
Set theme to dark (⇧+D)

Recommended network policies

  3 min read

We recommend you add the following network policies to build an Internet and SaaS app security strategy for your organization.

For more information on building network policies, refer to Network policies.


Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected.

Destination IPnot in listQuarantined-Users-IPAllowlistOrBlock
SNInot in listQuarantined-Users-HostAllowlistOr
Domain SNInot in listQuarantined-Users-DomainAllowlistAnd
User Group NamesinQuarantined Users

Restrict access for devices where baseline posture checks have not passed. If posture checks are integrated with service providers such as Crowdstrike or Intune via the API, this policy dynamically blocks access for devices that do not meet predetermined security requirements.

Destination IPnot in listPosture-Fail-IPAllowlistOrBlock
SNInot in listPosture-Fail-HostAllowlistOr
Domain SNInot in listPosture-Fail-DomainAllowlistAnd
Passed Device Posture Checksnot inWindows 10 or higher (OS version)

You can add a number of WARP client device posture checks as needed, such as Disk encryption and Domain joined. For more information on device posture checks, refer to Enforce device posture.

FinanceUsers-NET-HTTPS-FinanceServers (example)

Allow HTTPS access for user groups. For example, the following policy gives finance users access to any known financial applications:

Destination IPin listFinance ServersAndAllow
User Group NamesinFinance Users

Block traffic to destination IPs, SNIs, and domain SNIs that are malicious or pose a threat to your organization.

You can implement this policy by either creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs). Ideally, your CERTs can update the blocklist with an API automation to provide real-time threat protection.

Destination IPin listIP BlocklistOrBlock
SNIin listHost BlocklistOr
Domain SNIin listDomain Blocklist

Allow SSH traffic to specific endpoints on the Internet for specific users. You can create a similar policy for other non-web endpoints that required access.

Optionally, you can include a selector to filter by source IP or IdP group.

Destination IPin listSSHAllowListOrAllow
SNIin listSSHAllowlistFQDNAnd
Detected ProtocolisSSHAnd
User Group NamesinSSH-Allowed-Users

Block all non-web traffic towards the Internet. By using the Detected Protocol selector, you will ensure alternative ports for HTTP and HTTPS are allowed.

Destination IPnot in listInternalNetworkAndBlock
Detected Protocolis not inHTTP, HTTPS

Implicitly deny all of your internal IP ranges included in a list. We recommend you place this policy at the bottom of your policy list to ensure you explicitly approve traffic defined in the above policies.

Destination IPin listInternal Network IPsBlock