# Cloudflare Gateway > DNS and web gateway filtering via Cloudflare's global edge network, with policy-based access control. Cloudflare Gateway is a secure web gateway and DNS filtering service from Cloudflare, combining threat protection, content filtering, and data loss prevention on a cloud-based platform integrated with Cloudflare One Zero Trust. Listing updated 6 September 2026. Checked by MSP Software 5 September 2026. - Page: https://mspsoftware.net/software/cloudflare-gateway - Vendor: Cloudflare, https://mspsoftware.net/vendors/cloudflare, website https://www.cloudflare.com/zero-trust/products/gateway/ - Categories: DNS and web filtering (primary) - Free version: no. - Deployment: cloud. Platforms: web, Windows, macOS, Linux, iOS and Android. HQ: United States. Founded: 2009. - Support: help desk and knowledge base. Training: documentation, videos and webinars. ## From the vendor Cloudflare Gateway is a secure web gateway and DNS filtering service from Cloudflare that inspects and controls traffic at the DNS, network, HTTP, and egress layers for organizations of any size. It combines multi-layer filtering with Cloudflare One's Zero Trust access framework, deploying on Cloudflare's global edge network rather than through centralized data centers, which keeps latency low regardless of user location or office geography. Founded in 2009 and headquartered in San Francisco, Cloudflare operates the largest distributed network in the world, making Gateway available in over 300 cities globally. The service offers DNS-layer domain blocking to prevent sites from resolving, content category filtering to control website access by category, HTTP inspection to scan the full content of web requests including headers and file transfers, and anti-malware scanning plus data loss prevention to prevent sensitive data leaving the network. Organizations can deploy Gateway through four methods: the Cloudflare One Client for managed devices with full policy enforcement, direct DNS resolver configuration for DNS-only policies, proxy endpoints for browser-level filtering without agents, or network tunnels to protect branch offices and data centers. Each method trades off agent complexity against enforcement depth, allowing organizations to choose the right balance for their security posture and infrastructure. Cloudflare Gateway integrates with Cloudflare's broader platform including Access for identity verification, Browser Isolation for high-risk sites, Email Security, and CASB capabilities, all accessible through a single multi-tenant dashboard. Support for Windows, macOS, Linux, iOS and Android via the client, plus cloud-only deployment via DNS or proxy, suits teams across different device types and office configurations. The service does not require separate appliances or on-premises hardware to maintain. MSPs should confirm which deployment method fits their customer's environment and device management approach, and verify that any required third-party integrations with RMM or ticketing systems are available through Cloudflare's API or webhooks rather than pre-built connectors. Pricing is quote-based rather than published, so organisations should contact Cloudflare sales to benchmark costs against feature requirements and user count. ## Our take Cloudflare Gateway is enterprise-focused and best for organizations wanting DNS and web filtering without separate appliances or on-premises infrastructure. Compare against Cisco Umbrella and Palo Alto Networks DNS Security if you need lower-cost or simpler DNS-only filtering. Gateway's main strength is integration with Cloudflare One's identity and access framework, but its multi-layer approach means evaluating all components together rather than Gateway in isolation. Before purchasing, pricing is quote-based and not published; contact Cloudflare sales directly to discuss your customer's specific requirements and obtain a tailored quote. ## Pricing Cloudflare Gateway does not publish a list price. ## Features | Feature | Supported | Note | | --- | --- | --- | | DNS-layer blocking | yes | DNS-layer domain blocking prevents sites from resolving | | Content category filtering | yes | Content category filtering controls website access by category | | Roaming agent for off-network devices | yes | Cloudflare One Client provides off-network device protection | | Secure web gateway | yes | HTTP inspection scans full web request content including headers and files | | Multi-tenant dashboard | yes | Single dashboard for managing multiple organizations or departments | | Per-site policy | yes | Policies can be configured per organization, network, or user group | | Threat intelligence feed | yes | Anti-malware scanning and threat detection in web traffic | | Reporting and audit log | yes | Logging and reporting of DNS, HTTP, and policy enforcement events | | Network-wide router deployment | yes | Network tunnel deployment protects entire branch offices and data centers | ## Integrations - Cloudflare Access, https://www.cloudflare.com/zero-trust/products/access/ - Cloudflare Tunnel, https://www.cloudflare.com/zero-trust/products/tunnel/ - Cloudflare Browser Isolation, https://www.cloudflare.com/zero-trust/products/browser-isolation/ - Cloudflare Email Security, https://www.cloudflare.com/zero-trust/products/email-security/ ## Alternatives - Cisco Umbrella: Cloud DNS filtering and secure web gateway for multi-site networks and roaming users. https://mspsoftware.net/software/cisco-umbrella - Infoblox Threat Defense: Cloud-native DNS security with predictive threat intelligence and agentless deployment. https://mspsoftware.net/software/infoblox-threat-defense - NordLayer: Cloud VPN and ZTNA with DNS filtering, from $8 per user per month. https://mspsoftware.net/software/nordlayer. Compare: https://mspsoftware.net/compare/cloudflare-gateway-vs-nordlayer - Zscaler Internet Access: Enterprise zero trust security with DNS filtering, web gateway, and threat protection. https://mspsoftware.net/software/zscaler-internet-access ## FAQ ### How much does Cloudflare Gateway cost? Cloudflare Gateway does not publish a list price. No MSP price reports have been approved yet. ### Does Cloudflare Gateway offer a free trial? There is no free version. ### What does Cloudflare Gateway integrate with? Cloudflare Gateway lists integrations with Cloudflare Access, Cloudflare Tunnel, Cloudflare Browser Isolation and Cloudflare Email Security. ### Is Cloudflare Gateway cloud or on-premises? Cloudflare Gateway is cloud-hosted; there is no on-premises version. ### Who is Cloudflare Gateway for? MSPs report using Cloudflare Gateway at sizes of 6-15, 16-50, 51-200 and 200+ technicians. ### What is the difference between Cloudflare Gateway's DNS filtering and secure web gateway? Cloudflare Gateway offers two complementary filtering layers. DNS-layer blocking prevents users from reaching a domain at all by blocking the DNS query before the site loads, and is the fastest and least resource-intensive option. The secure web gateway inspects the full content of HTTP requests including URLs, headers, and file transfers, allowing detection of malware or policy violations at the application level. Organizations typically deploy DNS filtering for basic categories and compliance, and add secure web gateway for higher-risk users or sensitive data protection. ### How do you deploy Cloudflare Gateway for roaming or remote users? Cloudflare Gateway supports four deployment methods for different scenarios. The Cloudflare One Client agent runs on managed devices (Windows, macOS, Linux, iOS, Android) and enforces all policy types including DNS, HTTP, and DLP filtering for roaming users. For simpler deployments, organizations can configure DNS resolver settings directly on devices or networks to enforce DNS policies only without an agent. Proxy endpoints enable browser-level filtering, and network tunnels protect entire branch offices. Most MSPs use the One Client for managed devices and direct DNS configuration for network-wide protection. ### Does Cloudflare Gateway integrate with RMM and PSA platforms? Cloudflare Gateway does not have documented pre-built integrations with major RMM or PSA platforms. However, the platform provides REST APIs and webhook support for custom integration, and sits alongside Cloudflare's broader Zero Trust platform that includes ticketing and audit logging. MSPs interested in Cloudflare Gateway should confirm integration capabilities with their RMM or documentation tool vendor, or evaluate whether API-based integration is feasible for policy deployment and reporting. ### Is pricing published for Cloudflare Gateway? Cloudflare Gateway pricing is not published publicly and requires a quote from Cloudflare sales. Pricing is typically based on per-user licensing within an organization's Zero Trust plan, though exact pricing depends on features selected, organization size, and contract terms. Organizations should contact Cloudflare sales to evaluate the service and obtain pricing tailored to their user count and geographic distribution. ### Can you use Cloudflare Gateway without committing to the full Cloudflare One platform? Cloudflare Gateway is sold as part of Cloudflare One Zero Trust, not as a standalone product. However, organizations can start with Gateway alone and add other Cloudflare One features such as Access, Browser Isolation, or Email Security later as their security requirements grow. The platform is designed to work as a cohesive zero-trust solution, so comparison should include the full Cloudflare One offering rather than Gateway in isolation.