Traffic Source selector in Gateway policies
Gateway HTTP and Network policies now include a Traffic Source selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint.
| UI name | API value | Description |
|---|---|---|
| Device client | device_client |
Traffic from the Cloudflare One Client (WARP) |
| Mesh | mesh |
Traffic from a Cloudflare Mesh connector |
| Cloudflare WAN | cloudflare_wan |
Traffic from Cloudflare WAN (Magic WAN) |
| Clientless RDP | clientless_rdp |
Traffic from a clientless RDP session |
| Proxy endpoint | proxy_endpoint |
Traffic from a proxy endpoint (PAC file) |
| Clientless Browser Isolation | agentless_biso |
Traffic from clientless Browser Isolation |
| MCP portal | mcp_portal |
Traffic from an MCP portal |
The selector uses the net.onramp.type API field in both HTTP and Network policies.
| UI name | API example |
|---|---|
| Traffic Source | net.onramp.type == "device_client" |
A Browser Isolation selector is also available in Network and HTTP policies. This selector identifies whether the current session is running inside Remote Browser Isolation, allowing administrators to apply different policy behavior to isolated traffic.
| UI name | API example |
|---|---|
| Browser Isolation | net.is_isolated == true |
For more information, refer to HTTP policies and Network policies.