Skip to content
Cloudflare Docs

Network segmentation

You can define policies in your Connector to either allow traffic to flow between your LANs without it leaving your local premises or to forward it via the Cloudflare network where you can add additional security features. The default behavior is to drop all LAN to LAN traffic. These policies can be created for specific subnets, and link two LANs.

flowchart LR
accTitle: In this example, there are LANs where traffic flows between each other, instead of going to Cloudflare first.
    a(Magic WAN Connector) <---> b(Internet) <---> c(Cloudflare)

    subgraph Customer site
    d[LAN 1] <---> a
    e[LAN 2] <---> a
    g[LAN 3] <---> a
    h[LAN 4] <---> a
    end
    classDef orange fill:#f48120,color: black
    class a,c orange

    linkStyle 0,1,2,3 stroke:#f48120,stroke-width:3px
    linkStyle 4,5 stroke:red,stroke-width:3px

In the above example, the red path shows traffic that stays in the customer’s premises (allowing direct communication between LAN 3 and LAN 4), and the orange path shows traffic that goes to Cloudflare before returning to the customer’s premises (processing traffic between LAN 1 and LAN 2 in Cloudflare).


Creating these policies to segment your network means LAN to LAN traffic can be allowed either locally or via Cloudflare’s network. As a best practice for security, we recommend sending all traffic through Cloudflare’s network for Zero Trust security filtering. Use these policies with care and only for scenarios where you have a hard requirement for LAN to LAN traffic flows.

The following guide assumes you have already created a site and configured your Connector. To learn how to create a site and configure your Connector, refer to Configure hardware Connector or Configure virtual connector, depending on the type of Magic WAN Connector you have on your premises.

Create a policy

Follow the steps below to create a new LAN policy to segment your network. Only the fields marked required are mandatory.

  1. Log in to the Cloudflare dashboard ↗, and select your account.
  2. Select Magic WAN > Sites.
  3. Select the site you want to configure > Edit.
  4. Go to Network, and scroll down to LAN configuration.
  5. Select LAN policies > Create Policy.
  6. In Policy name, enter a descriptive name for the policy you are creating.
  7. From the drop-down menu LAN 1, select your origin LAN.
  8. (Optional) Specify a subnet for your first LAN in Subnets.
  9. (Optional) In Ports specify the TCP/UDP ports you want to use. Add a comma to separate each of the ports.
  10. In LAN 2, select the destination LAN and repeat the above process to configure it.
  11. (Optional) Select the type of traffic. You can choose TCP, UDP, and ICMP. You can also select Any to choose all types of traffic.
  12. In Traffic path, select Forwarded via Cloudflare if you want traffic to be forwarded to Cloudflare to be processed. If you do not select this option, traffic will flow locally, in your premises without passing through Cloudflare.
  13. Select Create policy.

The new policy will ensure that traffic between the specified LANs flows locally, bypassing Cloudflare.

Edit a policy

  1. Log in to the Cloudflare dashboard ↗, and select your account.
  2. Select Magic WAN > Sites.
  3. Select the site you want to configure > Edit.
  4. Go to Network, and scroll down to LAN configuration.
  5. Select LAN policies.
  6. Select the policy you need to edit > Edit.
  7. Make your changes, and select Update policy.

Delete a policy

  1. Log in to the Cloudflare dashboard ↗, and select your account.
  2. Select Magic WAN > Sites.
  3. Select the site you want to configure > Edit.
  4. Go to Network, and scroll down to LAN configuration.
  5. Select LAN policies.
  6. Select the policy you need to edit > Edit.
  7. Select Delete.
  8. Select I understand that deleting a policy is permanent in the dialog box > Delete.
Cloudflare DashboardDiscordCommunityLearning CenterSupport Portal
Cookie Settings