Traffic Destination selector in Gateway policies
Gateway HTTP and Network policies now support a Traffic Destination selector that identifies how traffic exits Cloudflare, enabling administrators to write policies targeting specific off-ramp methods like public Internet, Cloudflare Tunnel, WAN, or Mesh.
Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.
Available traffic destination values
| UI name | API value | Description |
|---|---|---|
| Internet | internet |
Traffic to the public Internet |
| Cloudflare WAN | cloudflare_wan |
Traffic through a Cloudflare WAN connection |
| Cloudflare Tunnel | cloudflare_tunnel |
Traffic to a private origin through Cloudflare Tunnel |
| Cloudflare One Client | device_client |
Traffic to another device running the Cloudflare One Client |
| Mesh | mesh |
Traffic through a Cloudflare Mesh node |
The selector uses the net.offramp.type API field in both HTTP and Network policies.
| UI name | API example |
|---|---|
| Traffic Destination | net.offramp.type == "internet" |
For more information, refer to HTTP policies and Network policies.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Improved HTTP/3 client cancellation reporting
Cloudflare now properly stops HTTP/3 requests when clients cancel them and reports these consistently as 499 status codes. This reduces unnecessary origin work and provides clearer visibility into client behavior across all plan types.
WAF failed detections field now available in Rules
A new cf.appsec.request.failed_detections field lets you control how rules handle requests when security detections fail. This array of detection IDs covers content scanning, WAF attack scoring, attack signatures, leaked credentials, and AI-based PII/prompt injection/custom topic detection failures, and works across custom rules, rate limiting rules, and request header transform rules.
Markdown for Agents: More efficient in-process streaming conversion
Markdown for Agents now uses an in-process streaming engine at the edge to convert HTML, reducing overhead and memory use. The conversion limit increased from 2 MiB to 6 MiB, and token count headers are no longer generated.