Cloudflare Docs
Cloudflare Zero Trust
Visit Cloudflare Zero Trust on GitHub
Set theme to dark (⇧+D)

Common network policies

The following policies are commonly used to secure network traffic.

​​ Block applications

Block content categories which go against your organization’s acceptable use policy.

SelectorOperatorValueAction
ApplicationinNetflixBlock

​​ Check user identity

Configure access on a per user or group basis by adding identity-based conditions to your policies.

SelectorOperatorValueAction
ApplicationinSalesforceBlock
User Group NamesinContractors

​​ Enforce device posture

Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the device posture section.

In the following example, users can only access an application if they connect from a company device.

SelectorOperatorValueAction
Passed Device Posture Checksnot inDevice serial numbersBlock
SNI Domainisinternalapp.com

​​ Enforce session duration

Require users to re-authenticate after a certain amount of time has elapsed.

​​ Restrict access to private networks

Restrict access to resources which you have connected through Cloudflare Tunnel.

The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic. Make sure that the Allow policy has higher priority (by positioning it towards the top of the list in the UI).

​​ 1. Allow company employees

SelectorOperatorValueAction
Destination IPin10.0.0.0/8Allow
User EmailMatches regex.*@example.com

​​ 2. Block everyone else

SelectorOperatorValueAction
Destination IPin10.0.0.0/8Block

Refer to the network policies page for a comprehensive list of other selectors, operators, and actions.