Gateway, Cloudflare One - Traffic Destination selector in Gateway policies

Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.

Available traffic destination values

UI name API value Description Internet internet Traffic to the public Internet Cloudflare WAN cloudflare_wan Traffic through a Cloudflare WAN connection Cloudflare Tunnel cloudflare_tunnel Traffic to a private origin through Cloudflare Tunnel Cloudflare One Client device_client Traffic to another device running the Cloudflare One Client Mesh mesh Traffic through a Cloudflare Mesh node

The selector uses the net.offramp.type API field in both HTTP and Network policies.

UI name API example Traffic Destination net.offramp.type == "internet"

For more information, refer to HTTP policies and Network policies.