HTTP filtering
Secure Web Gateway allows you to inspect HTTP traffic and control which websites users can visit.
To filter HTTP requests from a device:
- Install the Cloudflare root certificate on your device.
- Install the WARP client on your device.
- In the WARP client Settings, log in to your organization's Zero Trust instance.
- Enable the Gateway proxy for TCP. Optionally, you can enable the UDP proxy to inspect all port 443 UDP traffic.
- To inspect HTTPS traffic, enable TLS decryption.
- (Optional) To scan file uploads and downloads for malware, enable anti-virus scanning.
To verify your device is connected to Zero Trust:
- In Zero Trust ↗, go to Settings > Network.
- Under Gateway logging, enable activity logging for all HTTP logs.
- On your device, open a browser and go to any website.
- In Zero Trust, go to Logs > Gateway > HTTP.
- Make sure HTTP requests from your device appear.
To create a new HTTP policy:
-
In Zero Trust ↗, go to Gateway > Firewall policies.
-
In the HTTP tab, select Add a policy.
-
Name the policy.
-
Under Traffic, build a logical expression that defines the traffic you want to allow or block.
-
Choose an Action to take when traffic matches the logical expression. For example, if you have configured TLS decryption, some applications that use embedded certificates may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications:
Selector Operator Value Action Application in Do Not Inspect Do Not Inspect Cloudflare also recommends adding a policy to block known threats such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence:
Selector Operator Value Action Security Categories in All security risks Block -
Select Create policy.
-
Create an API token with the following permissions:
Type Item Permission Account Zero Trust Edit -
(Optional) Configure your API environment variables to include your account ID and API token.
-
Send a
POSTrequest to the Create a Zero Trust Gateway rule endpoint. For example, if you have configured TLS decryption, some applications that use embedded certificates may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications:curl API HTTP policy example curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \--header "Content-Type: application/json" \--header "Authorization: Bearer <API_TOKEN>" \--data '{"name": "Do not inspect applications","description": "Bypass TLS decryption for unsupported applications","precedence": 0,"enabled": true,"action": "off","filters": ["http"],"traffic": "any(app.type.ids[*] in {16})","identity": "","device_posture": ""}'{"success": true,"errors": [],"messages": []}The API will respond with a summary of the policy and the result of your request.
Cloudflare also recommends adding a policy to block known threats such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence:
Block known risks HTTP policy curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \--header "Content-Type: application/json" \--header "Authorization: Bearer <API_TOKEN>" \--data '{"name": "Block known risks","description": "Block all default Cloudflare HTTP security categories","precedence": 0,"enabled": true,"action": "block","filters": ["http"],"traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})","identity": "","device_posture": ""}'
For more information, refer to HTTP policies.
Refer to our list of common HTTP policies for other policies you may want to create.