Traffic Source selector in Gateway policies

Gateway HTTP and Network policies now include a Traffic Source selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint.

Available traffic source values

UI name	API value	Description
Device client	device_client	Traffic from the Cloudflare One Client (WARP)
Mesh	mesh	Traffic from a Cloudflare Mesh connector
Cloudflare WAN	cloudflare_wan	Traffic from Cloudflare WAN (Magic WAN)
Clientless RDP	clientless_rdp	Traffic from a clientless RDP session
Proxy endpoint	proxy_endpoint	Traffic from a proxy endpoint (PAC file)
Clientless Browser Isolation	agentless_biso	Traffic from clientless Browser Isolation
MCP portal	mcp_portal	Traffic from an MCP portal

The selector uses the net.onramp.type API field in both HTTP and Network policies.

UI name	API example
Traffic Source	net.onramp.type == "device_client"

Browser Isolation selector

A Browser Isolation selector is also available in Network and HTTP policies. This selector identifies whether the current session is running inside Remote Browser Isolation, allowing administrators to apply different policy behavior to isolated traffic.

UI name	API example
Browser Isolation	net.is_isolated == true

For more information, refer to HTTP policies and Network policies.