Cloudflare Docs
Magic WAN
Cloudflare Docs
Magic WAN
GitHub icon
Edit this page on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. Magic WAN
  3. ...
  4. ...
  5. Network options
  6. Network segmentation

Network segmentation

You can define policies in your Connector to allow traffic to flow between your LANs without it leaving your local premises. These policies can be created for specific subnets, and link two LANs.

Creating these policies to segment your network means traffic will flow locally and bypass Cloudflare. As a best practice for security, we recommend sending all traffic through Cloudflare’s network for Zero Trust security filtering. Use these policies with care and only for scenarios where you have a hard requirement for LAN to LAN traffic flows.

The following guide assumes you have already created a site and configured your Connector. To learn how to create a site and configure your Connector, refer to Configure hardware Connector or Configure virtual connector, depending on the type of Magic WAN Connector you have on your premises.

​​ Create a policy

Follow the steps below to create a new LAN policy to segment your network. Only the fields marked required are mandatory.

  1. Log in to the Cloudflare dashboard, and select your account.
  2. Select Magic WAN > Sites.
  3. Select the site you want to configure > Edit.
  4. Go to Network, and scroll down to LAN configuration.
  5. Select LAN policies > Create Policy.
  6. In Policy name, enter a descriptive name for the policy you are creating.
  7. From the drop-down menu LAN 1, select your origin LAN.
  8. (Optional) Specify a subnet for your first LAN in Subnets.
  9. (Optional) In Ports specify the TCP/UDP ports you want to use. Add a comma to separate each of the ports.
  10. In LAN 2, select the destination LAN and repeat the above process to configure it.
  11. (Optional) Select the type of traffic you want to keep local. You can choose TCP, UDP, and ICMP. You can also select Any to choose all types of traffic.
  12. Select Create policy.

Create a POST request using the API to create a network policy.

Example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/acls \

--header 'Content-Type: application/json' \

--header 'X-Auth-Email: <EMAIL>' \

--header 'X-Auth-Key: <API_KEY>' \

--data '{
  "acl": {
    "description": "<POLICY_DESCRIPTION>",
    "forward_locally": true,
    "lan_1": {
      "lan_id": "<LAN_ID>",
      "lan_name": "<LAN_NAME>",
      "ports": [
        1
      ],
      "subnets": [
        "192.0.2.1"
      ]
    },
    "lan_2": {
      "lan_id": "<LAN_ID>",
      "lan_name": "<LAN_NAME",
      "ports": [
        1
      ],
      "subnets": [
        "192.0.2.1"
      ]
    },
    "name": "<POLICY_NAME>",
    "protocols": [
      "tcp"
    ]
  }
}'

If successful, you will receive a response like the following:

{
  "errors": [],
  "messages": [],
  "result": {
    "acls": [
      {
        "description": "<POLICY_DESCRIPTION>",
        "forward_locally": true,
        "id": "023e105f4ecef8ad9ca31a8372d0c353",
        "lan_1": {
          "lan_id": "<LAN_ID>",
          "lan_name": "<LAN_NAME>",
          "ports": [
            1
          ],
          "subnets": [
            "192.0.2.1"
          ]
        },
        "lan_2": {
          "lan_id": "<LAN_ID>",
          "lan_name": "<LAN_NAME>",
          "ports": [
            1
          ],
          "subnets": [
            "192.0.2.1"
          ]
        },
        "name": "<POLICY_NAME>",
        "protocols": [
          "tcp"
        ]
      }
    ]
  },
  "success": true

}

Take note of the id parameter, as you will need it to edit or delete network policies.

The new policy will ensure that traffic between the specified LANs flows locally, bypassing Cloudflare.

​​ Edit a policy

  1. Log in to the Cloudflare dashboard, and select your account.
  2. Select Magic WAN > Sites.
  3. Select the site you want to configure > Edit.
  4. Go to Network, and scroll down to LAN configuration.
  5. Select LAN policies.
  6. Select the policy you need to edit > Edit.
  7. Make your changes, and select Update policy.

Create a PUT request using the API to edit a network policy.

Example:

curl --request PUT \

--url https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/acls/{acl_id} \

--header 'Content-Type: application/json' \

--header 'X-Auth-Email: <EMAIL>' \

--header 'X-Auth-Key: <API_KEY>' \

--data '{
  "acl": {
    "description": "<POLICY_DESCRIPTION>",
    "forward_locally": true,
    "lan_1": {
      "lan_id": "<LAN_ID>",
      "lan_name": "<LAN_NAME>",
      "ports": [
        1
      ],
      "subnets": [
        "192.0.2.1"
      ]
    },
    "lan_2": {
      "lan_id": "<LAN_ID>",
      "lan_name": "<LAN_NAME>",
      "ports": [
        1
      ],
      "subnets": [
        "192.0.2.1"
      ]
    },
    "name": "<POLICY_NAME>",
    "protocols": [
      "tcp"
    ]
  }
}'

​​ Delete a policy

  1. Log in to the Cloudflare dashboard, and select your account.
  2. Select Magic WAN > Sites.
  3. Select the site you want to configure > Edit.
  4. Go to Network, and scroll down to LAN configuration.
  5. Select LAN policies.
  6. Select the policy you need to edit > Edit.
  7. Select Delete.
  8. Select I understand that deleting a policy is permanent in the dialog box > Delete.

Create a DELETE request using the API to delete a network policy.

Example:

curl --request DELETE \

--url https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/acls/{acl_identifier} \

--header 'Content-Type: application/json' \

--header 'X-Auth-Email: <EMAIL>' \

--header 'X-Auth-Key: <API_KEY>' \