Cloudflare Gateway is a secure web gateway and DNS filtering service from Cloudflare, combining threat protection, content filtering, and data loss prevention on a cloud-based platform integrated with Cloudflare One Zero Trust.
Listing updated . Checked by MSP Software .
Cloudflare Gateway is a secure web gateway and DNS filtering service from Cloudflare that inspects and controls traffic at the DNS, network, HTTP, and egress layers for organizations of any size. It combines multi-layer filtering with Cloudflare One's Zero Trust access framework, deploying on Cloudflare's global edge network rather than through centralized data centers, which keeps latency low regardless of user location or office geography. Founded in 2009 and headquartered in San Francisco, Cloudflare operates the largest distributed network in the world, making Gateway available in over 300 cities globally.
The service offers DNS-layer domain blocking to prevent sites from resolving, content category filtering to control website access by category, HTTP inspection to scan the full content of web requests including headers and file transfers, and anti-malware scanning plus data loss prevention to prevent sensitive data leaving the network. Organizations can deploy Gateway through four methods: the Cloudflare One Client for managed devices with full policy enforcement, direct DNS resolver configuration for DNS-only policies, proxy endpoints for browser-level filtering without agents, or network tunnels to protect branch offices and data centers. Each method trades off agent complexity against enforcement depth, allowing organizations to choose the right balance for their security posture and infrastructure.
Cloudflare Gateway integrates with Cloudflare's broader platform including Access for identity verification, Browser Isolation for high-risk sites, Email Security, and CASB capabilities, all accessible through a single multi-tenant dashboard. Support for Windows, macOS, Linux, iOS and Android via the client, plus cloud-only deployment via DNS or proxy, suits teams across different device types and office configurations. The service does not require separate appliances or on-premises hardware to maintain. MSPs should confirm which deployment method fits their customer's environment and device management approach, and verify that any required third-party integrations with RMM or ticketing systems are available through Cloudflare's API or webhooks rather than pre-built connectors. Pricing is quote-based rather than published, so organisations should contact Cloudflare sales to benchmark costs against feature requirements and user count.
Cloudflare Gateway is enterprise-focused and best for organizations wanting DNS and web filtering without separate appliances or on-premises infrastructure. Compare against Cisco Umbrella and Palo Alto Networks DNS Security if you need lower-cost or simpler DNS-only filtering. Gateway's main strength is integration with Cloudflare One's identity and access framework, but its multi-layer approach means evaluating all components together rather than Gateway in isolation. Before purchasing, pricing is quote-based and not published; contact Cloudflare sales directly to discuss your customer's specific requirements and obtain a tailored quote.
Cisco Umbrella Cloud DNS filtering and secure web gateway for multi-site networks and roaming users. No reviews yet 
Infoblox Threat Defense Cloud-native DNS security with predictive threat intelligence and agentless deployment. No reviews yet 
NordLayer Cloud VPN and ZTNA with DNS filtering, from $8 per user per month. No reviews yet · from US$8.00
Zscaler Internet Access Enterprise zero trust security with DNS filtering, web gateway, and threat protection. No reviews yet All alternatives to Cloudflare Gateway| Feature | Supported | Note |
|---|---|---|
| DNS-layer blocking | yes | DNS-layer domain blocking prevents sites from resolving |
| Content category filtering | yes | Content category filtering controls website access by category |
| Roaming agent for off-network devices | yes | Cloudflare One Client provides off-network device protection |
| Secure web gateway | yes | HTTP inspection scans full web request content including headers and files |
| Multi-tenant dashboard | yes | Single dashboard for managing multiple organizations or departments |
| Per-site policy | yes | Policies can be configured per organization, network, or user group |
| RMM integration | unknown | Not documented in official sources; confirm via API or contact Cloudflare |
| Threat intelligence feed | yes | Anti-malware scanning and threat detection in web traffic |
| SafeSearch enforcement | unknown | Not explicitly documented; check with Cloudflare support |
| Reporting and audit log | yes | Logging and reporting of DNS, HTTP, and policy enforcement events |
| Custom block and allow lists | unknown | Custom allow and block lists not explicitly confirmed; verify with sales |
| Network-wide router deployment | yes | Network tunnel deployment protects entire branch offices and data centers |
Cloudflare Gateway offers two complementary filtering layers. DNS-layer blocking prevents users from reaching a domain at all by blocking the DNS query before the site loads, and is the fastest and least resource-intensive option. The secure web gateway inspects the full content of HTTP requests including URLs, headers, and file transfers, allowing detection of malware or policy violations at the application level. Organizations typically deploy DNS filtering for basic categories and compliance, and add secure web gateway for higher-risk users or sensitive data protection.
Cloudflare Gateway supports four deployment methods for different scenarios. The Cloudflare One Client agent runs on managed devices (Windows, macOS, Linux, iOS, Android) and enforces all policy types including DNS, HTTP, and DLP filtering for roaming users. For simpler deployments, organizations can configure DNS resolver settings directly on devices or networks to enforce DNS policies only without an agent. Proxy endpoints enable browser-level filtering, and network tunnels protect entire branch offices. Most MSPs use the One Client for managed devices and direct DNS configuration for network-wide protection.
Cloudflare Gateway does not have documented pre-built integrations with major RMM or PSA platforms. However, the platform provides REST APIs and webhook support for custom integration, and sits alongside Cloudflare's broader Zero Trust platform that includes ticketing and audit logging. MSPs interested in Cloudflare Gateway should confirm integration capabilities with their RMM or documentation tool vendor, or evaluate whether API-based integration is feasible for policy deployment and reporting.
Cloudflare Gateway pricing is not published publicly and requires a quote from Cloudflare sales. Pricing is typically based on per-user licensing within an organization's Zero Trust plan, though exact pricing depends on features selected, organization size, and contract terms. Organizations should contact Cloudflare sales to evaluate the service and obtain pricing tailored to their user count and geographic distribution.
Cloudflare Gateway is sold as part of Cloudflare One Zero Trust, not as a standalone product. However, organizations can start with Gateway alone and add other Cloudflare One features such as Access, Browser Isolation, or Email Security later as their security requirements grow. The platform is designed to work as a cohesive zero-trust solution, so comparison should include the full Cloudflare One offering rather than Gateway in isolation.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
