Restrict and verify Cloudflare access

Everything connects now. This lesson is about making sure not everything is allowed — and proving it.

Enable the Gateway proxy for the protocols your lab needs. Network policies only apply to traffic the proxy handles, so switch on TCP at minimum, plus UDP and ICMP if you want your ping tests governed by policy too.

Create an allow policy for the test identity, destination, and port. Then add a lower-priority catch-all block for the private range. This prevents every enrolled device from receiving broad network access:

priority  action  who               destination     port
1         allow   [email protected]   10.0.1.100/32   22, 80
2         block   everyone          10.0.0.0/8      any

Now prove the allowed path. From the remote device, open the private HTTP service or run ssh 10.0.1.100:

ssh [email protected]
curl -I http://10.0.1.100
# HTTP/1.1 200 OK

Then test a destination or port that should be denied. Port 2222 on the same host falls outside your allow rule, so the catch-all should swallow it:

ssh -o ConnectTimeout=5 -p 2222 [email protected]
# ssh: connect to host 10.0.1.100 port 2222: Connection timed out

The denied test matters as much as the allowed one. A policy that permits correctly but fails to block is broken in the dangerous direction, and nothing on the happy path will ever tell you.

Read the Gateway network logs after both tests. Each connection shows which policy matched it — your allow rule for the first pair, your block rule for the third. If results confuse you, check the device connection, Tunnel health, routes, policy logs, and destination service, in that order.

Save evidence for both the allowed and blocked tests: log excerpts or screenshots. When someone later asks “who can reach this system?”, you answer with evidence instead of belief.

The classic misconfiguration is inverted priority — the block rule sitting above the allows. Everything gets denied, and the logs show the block rule matching your own test connection. The logs make the fix obvious, which is one more reason to read them now, while nothing is on fire.