sellSecurity

filter_alt

Gateway

A safety filter for everything your devices try to reach — blocks malware, phishing, and unwanted sites.

3 layersDNS · Network · HTTP

< 60sPolicy deploys globally

50 usersFree Zero Trust seats

lightbulb

What is Gateway?

Cloudflare Gateway is a Secure Web Gateway (SWG): it inspects the traffic leaving your devices and decides what's allowed out. It blocks dangerous or unwanted destinations before a connection is ever made.

While a WAF protects traffic coming into your website, Gateway protects traffic going out from your people and devices — like a filter for your whole team's or family's internet use.

filter_alt

Think of it like…

A water filter on your tap. Every drop (request) passes through it; clean water flows, but contaminants (malware, phishing, blocked categories) get caught before reaching the glass.

layers

Three filtering layers

Gateway can filter at three depths. You can start with just DNS (the easiest) and add the deeper layers later.

dns

DNS filtering

The fastest layer. When a device asks 'what's the IP of this domain?', Gateway can refuse to answer for bad domains — blocking them before they load. Sees domain names, not full URLs.

lan

Network filtering

Inspects raw packets by IP, port, and protocol. Useful for non-web services like SSH or RDP.

http

HTTP filtering

The deepest layer. Inspects full URLs, uploads, and downloads — even inside HTTPS — to scan for malware or data leaks. Needs a certificate installed on devices.

help

Why use it?

coronavirus

Block malware & phishing

Stops devices from reaching known-malicious or scam sites organization-wide.

family_restroom

Content control

Block whole categories — adult content, gambling — for schools, families, or offices.

no_accounts

Stop data leaks

Prevent uploading confidential files to personal cloud storage.

travel_explore

Works anywhere

With the WARP client, protection follows remote and travelling employees.

rocket_launch

How to set it up

First you decide how traffic reaches Gateway, then you write policies. Here's the quickest path: block malware via a DNS policy.

Choose how to connect
Two options. WARP client: install Cloudflare's app on devices — enables all three layers plus identity. DNS location: point your network's DNS to Cloudflare — simplest, DNS filtering only.
Open Gateway policies
In the Zero Trust dashboard go to Gateway → Firewall policies → DNS, then Add a policy.
Block security threats
Set a condition matching the Security threats categories, choose action Block, and save. It deploys worldwide in under a minute.
text
```
Selector:  Security Categories
Operator:  in
Value:     Malware, Phishing, Command & Control
Action:    Block
```
Add a content policy (optional)
Add another DNS policy matching Content Categories (e.g. Adult Themes) with action Block to filter unwanted content.
Review the logs
Open Logs → Gateway to see which domains were queried and blocked, then tune policies that are too strict.

school

Key concepts

shield_moon

Secure Web Gateway

A security checkpoint all outbound traffic passes through to be filtered.

policy

Policy

An if-this-then-that rule. Conditions match traffic; actions allow, block, or override.

Tips & billing

start

Start with DNS-only

DNS filtering needs no software install and blocks the vast majority of malware and phishing for quick wins. Add the WARP client later when you want network and HTTP filtering.

Gateway is part of Cloudflare Zero Trust; the free plan covers up to 50 users.
Policies are evaluated in order: DNS first, then network, then HTTP.
Changes deploy globally in under a minute.
HTTP filtering (inspecting inside HTTPS) requires installing Cloudflare's certificate on devices.