🌐 Trang này chưa được dịch sang tiếng Việt — đang hiển thị nội dung tiếng Anh.

Module 5 — Gateway (Web Filtering / Secure Web Gateway)

Goal: Filter your users' internet traffic — block malware, phishing, and risky categories at the DNS layer, then inspect web (HTTPS) traffic to enforce acceptable use. This is also the engine that DLP (Module 6) and AI controls (Module 7) plug into.

🧱 Build it in layers, in this order: DNS (easiest, safest) → Network → HTTP/HTTPS (most powerful, needs the certificate). Do DNS first and you get value in 5 minutes.

Part A — DNS filtering (start here)

DNS filtering blocks bad domains before a connection is even made. It works even without deep inspection, so it's the safest first step.

Step A1 — Block security threats

1. 👉 Zero Trust → Gateway → Firewall Policies → DNS tab.
2. 👉 Click Add a policy.
3. ⌨️ Policy name: Block security threats.
4. 👉 Build the rule:

   Field	Value
   Selector	Security Categories
   Operator	in
   Value	tick Malware, Phishing, Command & Control, Cryptomining, DNS Tunneling, DGA Domains, New Domains

5. 👉 Action: Block.
6. 👉 Click Create policy.

✅ Checkpoint: The policy appears at the top of your DNS list, enabled.

Step A2 — Test the block (safe test)

1. 👉 On your pilot device, browse to a Cloudflare test threat page (e.g. https://malware.testcategory.com).
2. 📺 What you'll see: A Cloudflare block page instead of the site. 🎉

✅ Checkpoint: The block page appears. (If the real site loads, see troubleshooting.)

Step A3 — Enforce acceptable use (optional content categories)

1. 👉 Add another DNS policy named Block content categories.
2. 👉 Selector Content Categories → in → tick categories per your policy (e.g. Adult Themes, Gambling).
3. 👉 Action Block → Create policy.

Step A4 — Protect offices without the client (DNS Locations)

For a whole office/network where you can't install the app on every device:

1. 👉 Gateway → DNS Locations → Add a location.
2. ⌨️ Name it (e.g. HQ-London).
3. 📺 Cloudflare shows you DNS endpoints (an IPv4/IPv6 address, a DoH URL, and a DoT hostname).
4. 👉 Point that office's router/DNS forwarder at those endpoints.

✅ Checkpoint: DNS queries from that office now show up under Gateway → Logs → DNS and obey your policies.

Part B — Network filtering (optional, L4)

Control traffic by port/protocol — for example, stop clients sending email directly.

1. 👉 Gateway → Firewall Policies → Network → Add a policy.
2. ⌨️ Name: Block direct SMTP.
3. 👉 Rule: Selector Destination Port → in → 25. Action Block.
4. 👉 Create policy.

💡 Network policies require devices in Gateway with WARP mode (or a Cloudflare WAN site). They do nothing for DNS-only setups.

Part C — Inspect HTTPS traffic (TLS decryption)

To filter inside encrypted web traffic (and to enable DLP and AI scanning), Cloudflare needs to decrypt and re-encrypt HTTPS using the certificate you installed in Module 3.

⚠️ Watch out — do this in the right order or you'll break websites:

1. ✅ Confirm the Cloudflare certificate is installed on your pilot devices (Module 3, Part D).
2. ✅ Set up your "Do Not Inspect" exceptions FIRST (Step C1 below).
3. ✅ Only then turn decryption on (Step C2), and only for your pilot group.

Step C1 — Add Do Not Inspect exceptions (before enabling)

Some apps refuse to work when inspected (they "pin" their certificate). Exempt them first.

1. 👉 Gateway → Firewall Policies → HTTP → Add a policy.
2. ⌨️ Name: Do Not Inspect - incompatible apps.
3. 👉 Rule: Selector Application → in → choose the built-in "Do Not Inspect" application type (Cloudflare keeps this list updated for known incompatible apps).
4. 👉 Action: Do Not Inspect → Create policy.
5. 💡 If you use Microsoft 365, also turn on the one-click Microsoft 365 traffic exception in Settings → Network (or add it as an application here).

Step C2 — Turn on TLS decryption

1. 👉 Zero Trust → Settings → Network.
2. 👉 Find TLS decryption (Firewall) → toggle it On.

✅ Checkpoint: On a pilot device, browse a few normal HTTPS sites (your email, a news site). They should load without certificate warnings. If you get warnings, the certificate isn't trusted — revisit Module 3 Part D.

Step C3 — Verify inspection is working

1. 👉 Gateway → Logs → HTTP.
2. 📺 You now see entries with full URLs/paths (not just domains), proving HTTPS is being inspected.

Part D — HTTP policies (enforce web rules)

Now you can write powerful rules on web traffic.

Example 1 — Block a file type to risky sites

1. 👉 Gateway → Firewall Policies → HTTP → Add a policy.
2. ⌨️ Name: Block executable downloads from uncategorized sites.
3. 👉 Rules:
   • Selector Download File Types → in → Executable
   • And Selector Content Categories → in → Unreachable/Uncategorized
4. 👉 Action Block → Create policy.

Example 2 — Isolate risky browsing (remote browser)

1. 👉 New HTTP policy named Isolate uncategorized.
2. 👉 Rule: Selector Content Categories → in → Newly Seen Domains.
3. 👉 Action: Isolate → Create policy.

📺 Users can still open these sites, but they run in a safe remote browser — nothing risky touches the device.

Example 3 — Allow an app but limit actions (granular control)

1. 👉 New HTTP policy. Selector Application → in → e.g. a file-sharing app.
2. 👉 Expand Application granular controls → block the Upload action only.
3. 👉 Action Allow (with the granular block) → Create policy.

💡 This "allow but restrict" pattern is exactly what you'll reuse for AI tools in Module 7.

Part E — Expand from pilot to everyone

1. ✅ Confirm with your pilot group for a few days: websites work, threats are blocked, no major complaints.
2. 👉 Push the Cloudflare certificate to all devices via MDM (Module 3, Part F).
3. 👉 Your DNS/HTTP policies already apply to every enrolled device — widen device enrollment to all staff.
4. 👉 Watch Gateway → Logs and Analytics for false positives; add exceptions as needed.

✅ Module 5 complete!

You now have:

• ✅ DNS filtering blocking malware/phishing (with a verified block page)
• ✅ (Optional) network + content-category rules
• ✅ HTTPS inspection running safely on your pilot group
• ✅ HTTP policies enforcing acceptable use
• ✅ A rollout path to the whole fleet

Quick troubleshooting

💡 Need a fixed source IP (so a SaaS app can allowlist your org), or want to disable IPv6? Those are egress policies — see the companion page: Module 5b — Egress Policies & IP Version Control.

🛡️ Want to run risky sites in a safe remote browser (and disable copy/paste, downloads, printing)? That's Remote Browser Isolation — see Module 5c — Remote Browser Isolation (RBI).

🔎 Want to see every SaaS & AI app your people use and approve/block them automatically? That's Shadow IT Discovery — see Module 5d — Shadow IT & AI Security Adoption.

👉 Next: Module 6 — DLP (Data Protection)

You'll detect and stop sensitive data from leaving. (Requires Enterprise.)