Cloudflare Docs
Learning Paths
Secure your Internet traffic and SaaS apps (Learning Path)
Edit this page
Give us feedback
Set theme to dark (⇧+D)

Recommended network policies

  3 min read

We recommend you add the following network policies to build an Internet and SaaS app security strategy for your organization.

For more information on building network policies, refer to Network policies.

Quarantined-Users-NET-Restricted-Access

Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected.

SelectorOperatorValueLogicAction
Destination IPnot in listQuarantined-Users-IPAllowlistOrBlock
SNInot in listQuarantined-Users-HostAllowlistOr
Domain SNInot in listQuarantined-Users-DomainAllowlistAnd
User Group NamesinQuarantined Users
Posture-Fail-NET-Restricted-Access

Restrict access for devices where baseline posture checks have not passed. If posture checks are integrated with service providers such as Crowdstrike or Intune via the API, this policy dynamically blocks access for devices that do not meet predetermined security requirements.

SelectorOperatorValueLogicAction
Destination IPnot in listPosture-Fail-IPAllowlistOrBlock
SNInot in listPosture-Fail-HostAllowlistOr
Domain SNInot in listPosture-Fail-DomainAllowlistAnd
Passed Device Posture Checksnot inWindows 10 or higher (OS version)

You can add a number of WARP client device posture checks as needed, such as Disk encryption and Domain joined. For more information on device posture checks, refer to Enforce device posture.

FinanceUsers-NET-HTTPS-FinanceServers (example)

Allow HTTPS access for user groups. For example, the following policy gives finance users access to any known financial applications:

SelectorOperatorValueLogicAction
Destination IPin listFinance ServersAndAllow
User Group NamesinFinance Users
All-NET-Internet-Blocklist

Block traffic to destination IPs, SNIs, and domain SNIs that are malicious or pose a threat to your organization.

You can implement this policy by either creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs). Ideally, your CERTs can update the blocklist with an API automation to provide real-time threat protection.

SelectorOperatorValueLogicAction
Destination IPin listIP BlocklistOrBlock
SNIin listHost BlocklistOr
Domain SNIin listDomain Blocklist
All-NET-SSH-Internet-Allowlist

Allow SSH traffic to specific endpoints on the Internet for specific users. You can create a similar policy for other non-web endpoints that required access.

Optionally, you can include a selector to filter by source IP or IdP group.

SelectorOperatorValueLogicAction
Destination IPin listSSHAllowListOrAllow
SNIin listSSHAllowlistFQDNAnd
Detected ProtocolisSSHAnd
User Group NamesinSSH-Allowed-Users
All-NET-NO-HTTP-HTTPS-Internet-Deny

Block all non-web traffic towards the Internet. By using the Detected Protocol selector, you will ensure alternative ports for HTTP and HTTPS are allowed.

SelectorOperatorValueLogicAction
Destination IPnot in listInternalNetworkAndBlock
Detected Protocolis not inHTTP, HTTPS
All-NET-InternalNetwork-ImplicitDeny

Implicitly deny all of your internal IP ranges included in a list. We recommend you place this policy at the bottom of your policy list to ensure you explicitly approve traffic defined in the above policies.

SelectorOperatorValueAction
Destination IPin listInternal Network IPsBlock