← Cloudflare One / cloudflare-one / traffic-policies
Gateway policy expressions
Gateway policies use a wirefilter-based expression language to match traffic against selectors (criteria). This syntax is similar to, but distinct from, the Rules language used by WAF, Rules, and other Cloudflare products. Refer to Gateway versus Ruleset Engine for details on the differences.
Expression syntax
Gateway expressions follow this pattern:
<field> <operator> <value>For example:
dns.fqdn == "example.com"
http.request.host == "api.example.com"
identity.email == "[email protected]"Operators
Gateway supports the following operators:
| Operator | Name | Example |
|---|---|---|
== |
Equals | dns.fqdn == "example.com" |
!= |
Does not equal | http.request.host != "blocked.com" |
in |
Value is in set | net.dst.port in {80 443} |
matches |
Matches regular expression | http.request.host matches ".*\\.example\\.com" |
> |
Greater than | http.upload.file.size > 10 |
>= |
Greater than or equal to | http.download.file.size >= 100 |
< |
Less than | http.upload.file.size < 50 |
<= |
Less than or equal to | http.download.file.size <= 200 |
Logical operators
Combine multiple conditions using logical operators:
| Operator | Name | Example |
|---|---|---|
and |
Logical AND | dns.fqdn == "example.com" and identity.email == "[email protected]" |
or |
Logical OR | net.dst.port == 80 or net.dst.port == 443 |
not |
Logical NOT | not(identity.email == "[email protected]") |
Array handling
Some Gateway fields return arrays (multiple values). Use the any() function to match if any element in the array meets the condition:
any(http.request.uri.content_category[*] in {17 85 102})any(identity.groups[*].name in {"Engineering" "Security"})any(http.request.domains[*] == "example.com")The [*] notation indicates that the function should evaluate all elements in the array.
List handling
You can reference lists in your expressions using the list UUID:
http.request.host in $<LIST_UUID>any(http.request.domains[*] in $<LIST_UUID>)To find a list's UUID, go to My Team > Lists in Zero Trust and select the list. The UUID appears in the browser URL.
Common field patterns
Each Gateway policy type has its own set of available fields. The following table shows the field prefixes used by each policy type:
| Policy type | Field prefix | Example fields |
|---|---|---|
| DNS | dns. |
dns.fqdn, dns.content_category, dns.src_ip |
| HTTP | http. |
http.request.host, http.request.uri, http.request.domains |
| Network | net. |
net.dst.ip, net.dst.port, net.src.ip |
| Identity | identity. |
identity.email, identity.groups, identity.name |
| Device posture | device_posture. |
device_posture.checks.passed |
For a complete list of available fields for each policy type, refer to the selectors documentation linked at the top of this page.
Example expressions
Block a domain in a DNS policy
dns.fqdn == "example.com"Block multiple content categories in an HTTP policy
any(http.request.uri.content_category[*] in {17 85 102})Allow traffic from a specific user group
any(identity.groups[*].name in {"Engineering"})Block traffic to a destination IP range in a Network policy
net.dst.ip in {10.0.0.0/8}Combine identity and traffic conditions
http.request.host == "internal.example.com" and identity.email matches ".*@company.com"Gateway versus Ruleset Engine
The following table summarizes the key differences between the Rules language](/ruleset-engine/rules-language/) (supported by the Ruleset Engine) and Gateway policy expressions:
| Ruleset Engine | Gateway | |
|---|---|---|
| Products | WAF, Transform Rules, Cache Rules, Configuration Rules | DNS, HTTP, Network, Egress, Resolver policies |
| Field examples | http.request.uri.path, cf.bot_management.score, ip.src |
dns.fqdn, http.request.host, identity.email |
| Identity fields | Not available | Available (for example, identity.email, identity.groups) |
| DNS fields | Not available | Available (for example, dns.fqdn, dns.content_category) |
| Documentation | Rules language | Traffic policies |