🌐 Trang này chưa được dịch sang tiếng Việt — đang hiển thị nội dung tiếng Anh.

Module 5b — Egress Policies & IP Version Control

Goal: Control the source IP your users' traffic exits Cloudflare with (so SaaS providers can allowlist you), and control which IP version (IPv4/IPv6) Gateway uses — including a policy to disable IPv6.

This is an optional deep-dive that builds on Module 5. Egress policies only apply to traffic proxied by Gateway (devices in Gateway with WARP mode, or a network on-ramp).

What "egress" means here

When a user behind Cloudflare visits a site, the site sees a Cloudflare source IP, not the user's. By default that's a shared IP range used by all Zero Trust customers. An egress policy lets you change that per traffic type:

💡 The classic use case: a SaaS app (Microsoft 365, Salesforce, Workday) that you want to accept connections only from your organization. You route that traffic through a dedicated egress IP and add that IP to the SaaS provider's allowlist.

Part A — Get your dedicated egress IPs

1. 👉 Ask your Cloudflare account team to enable dedicated egress IPs (an Enterprise add-on), or configure BYOIP (bring your own IP).
2. 📋 Note the IPv4 address(es) and IPv6 range assigned to your account.

✅ Checkpoint: You have at least one dedicated IPv4 address and an IPv6 range written down.

⚠️ Watch out: If the Egress policies tab or the "Use dedicated egress IPs" option is greyed out, the add-on isn't active on your account yet — that's the #1 blocker here.

Part B — Create a dedicated egress policy (SaaS allowlisting example)

We'll send all traffic destined for a SaaS provider out through your dedicated IP.

1. 👉 In the dashboard, go to Zero Trust → Traffic policies → Egress policies.

2. 👉 Click Add a policy.

3. ⌨️ Policy name: Egress — Salesforce via dedicated IP.

4. 👉 Build the match rule (what traffic this applies to):

   Selector	Operator	Value
   Destination IP	in	the SaaS provider's published IP ranges

   💡 Or use the Application selector (Beta) to match the provider by name instead of IP ranges.

5. 👉 Under Select an egress IP, choose Use dedicated Cloudflare egress IPs.

6. 👉 Choose your primary IPv4 and IPv6 addresses from the dropdowns.

7. 👉 Set a secondary IPv4 address (required for resilience):

   • 0.0.0.0 → if your primary's data center is down, traffic exits from the location closest to the user, or
   • a specific Cloudflare location different from your primary.
   • 💡 A secondary IPv6 is not required — IPv6 can exit from any Cloudflare data center.

8. 👉 Click Create policy.

Then allowlist the IP at the provider

9. 👉 In the SaaS provider's admin console, add your dedicated egress IP(s) to its allowlist / trusted IPs, so it only accepts connections coming from your organization.

💡 Best practice: pair this with an HTTP policy (Module 5) — e.g. block uploads to personal tenants, enforce DLP, or require device posture — so access is both from your IP and inspected.

Part C — Add a catch-all policy (important)

Without a catch-all, any traffic that doesn't match a policy will try to use the closest dedicated egress location, which can cause unexpected source IPs. Pin remaining traffic to the default (fast, shared) egress.

1. 👉 Egress policies → Add a policy.

2. ⌨️ Policy name: Default egress policy.

3. 👉 Rule:

   Selector	Operator	Value
   Protocol	in	All options

4. 👉 Egress method: Use default Cloudflare egress method.

5. 👉 Click Create policy.

6. 👉 Drag this policy to the very bottom of the list.

⚠️ Watch out: Egress policies evaluate top → bottom, first match wins. Keep specific policies (Part B) above the catch-all, or everything will match the catch-all first.

✅ Checkpoint: Your egress list shows specific policies on top and Default egress policy at the bottom.

Part D — Disable IPv6 (force IPv4)

Some upstream services misbehave over IPv6, or you may simply want a single, predictable IP version. You "disable IPv6" by blocking AAAA (IPv6) DNS record resolution with a DNS policy — users then connect over IPv4 only.

1. 👉 First confirm you're filtering DNS traffic (Module 5, Part A) — this policy is a DNS policy.

2. 👉 Go to Zero Trust → Traffic policies → DNS → Add a policy.

3. ⌨️ Policy name: Disable IPv6 (Force IPv4).

4. 👉 Build the rule:

   Selector	Operator	Value	Action
   Query Record Type	is	AAAA	Block

5. 👉 Click Create policy.

6. ⚠️ Important: turn off Modify Gateway block behavior (in the policy's settings / Gateway settings) so blocked AAAA lookups cleanly fall back to IPv4 instead of returning a block page.

💡 Scope it if needed: add a Domain selector to force IPv4 only for specific sites rather than everywhere. 💡 The reverse (force IPv6): same policy but Query Record Type is A → Block.

Verify

1. 👉 On a connected device, run:

   nslookup -type=AAAA cloudflare.com     # should return no IPv6 address (blocked)
   nslookup -type=A cloudflare.com        # should still resolve normally
   

2. 👉 Or visit https://ipv6.google.com → it should fail to load while normal IPv4 sites work.
3. 👉 Check Logs → Gateway → DNS — you'll see the blocked AAAA queries.

✅ Checkpoint: AAAA lookups are blocked, A lookups work, and IPv6-only test sites don't load.

Part E — Verify your egress IP

1. 👉 On a device routed through the dedicated-egress policy, visit an IP-echo site: https://ifconfig.me or https://www.cloudflare.com/cdn-cgi/trace/.
2. 📺 The reported source IP should be your dedicated egress IP (for traffic that matches Part B), and the default range for everything else.

✅ Checkpoint: Matched traffic shows your dedicated IP; unmatched traffic shows the default egress; the SaaS app accepts your allowlisted connection.

✅ Module 5b complete!

You now have:

• ✅ A dedicated egress policy sending chosen traffic out a fixed IP
• ✅ The dedicated IP allowlisted at your SaaS provider
• ✅ A catch-all policy keeping everything else fast on the default egress
• ✅ A disable-IPv6 (force IPv4) DNS policy, verified

Quick troubleshooting

👉 Next: Module 6 — DLP

Detect and stop sensitive data from leaving your organization.