Traffic Destination selector in Gateway policies

Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN.

Available traffic destination values

UI name	API value	Description
Internet	internet	Traffic to the public Internet
Cloudflare WAN	cloudflare_wan	Traffic through a Cloudflare WAN connection
Cloudflare Tunnel	cloudflare_tunnel	Traffic to a private origin through Cloudflare Tunnel
Cloudflare One Client	device_client	Traffic to another device running the Cloudflare One Client
Mesh	mesh	Traffic through a Cloudflare Mesh node

The selector uses the net.offramp.type API field in both HTTP and Network policies.

UI name	API example
Traffic Destination	net.offramp.type == "internet"

For more information, refer to HTTP policies and Network policies.