Require Gateway

With Require Gateway, you can allow access to your applications only to devices enrolled in your Zero Trust organization. Unlike Require WARP, which will check for any WARP instance (including the consumer version), Require Gateway will only allow requests coming from devices whose traffic is filtered by your organization's Cloudflare Gateway configuration. This policy is best used when you want to protect company-owned assets by only allowing access to employees.

Check result per client mode

The check result depends on the client mode configured on the device.

Client mode	Result	Reason
Traffic and DNS mode	✅ Pass	Device traffic is routed through and filtered by Gateway
Traffic only mode	✅ Pass	Device traffic is routed through Gateway except the DNS queries
DNS only mode	❌ Fail	Only DNS queries are forwarded; network traffic does not flow through Gateway
Local proxy mode	⚠️ Partial	The check passes only for traffic explicitly configured to use the local SOCKS/HTTP proxy on port `40000`, as this traffic is tunneled through Gateway. Traffic not routed through the proxy bypasses Gateway and fails the check.
Posture only mode	❌ Fail	The client is enrolled and collects posture data, but does not route traffic through Gateway

Prerequisites

Cloudflare One Client is deployed on the device. For a list of supported modes and operating systems, refer to Cloudflare One Client Checks.

1. Enable the Gateway check

In the Cloudflare dashboard ↗︎, go to Zero Trust > Reusable components > Posture checks.
Go to Cloudflare One Client checks and select Add a check.
Select Gateway, then select Save.

2. Add the check to an Access application

In the Cloudflare dashboard ↗︎, go to Zero Trust > Access controls > Applications.
Locate the application for which you want to require Gateway. Select Configure.
In the Policies tab, create a new Access policy or edit an existing policy.
In the policy builder, add an Include or Require rule which uses the Gateway selector. Save the policy.
Save the Access application.

Before granting access to the application, the policy will check that the device is running the Cloudflare One Client and enrolled in your Zero Trust organization.