What is the challenge?
How do you manage firewall policy consistently across data centers, branches, and clouds?
Most enterprises run a dozen different firewalls: physical appliances in each data center, virtual ones in each cloud VPC, branch firewalls in every office. Each has its own UI, its own rule syntax, its own audit log. Keeping policy consistent — same geo-blocks, same allowed ports, same vendor blocks — is operational pain that scales with the number of sites. A single misconfiguration on the wrong firewall is a breach waiting to happen.
Architecture
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
Cloudflare's Solution
How Cloudflare solves it
- One firewall in front of everything. Magic Firewall sits at Cloudflare's edge in front of all traffic to your network (when paired with Magic Transit or Magic WAN). Write one policy; it applies everywhere your prefixes are advertised.
- Stateful L3/L4 inspection. Filter by source/destination IP, port, protocol, TCP flags, packet length, country, ASN, or arbitrary IPv4/IPv6 header fields. Stateful — track connections rather than just stateless packet matches.
- Wireshark-style expressions. Familiar rule language: <code>ip.geoip.country eq "RU" and tcp.dstport eq 22</code>. No proprietary CLI to learn.
- Programmable via API and Terraform. Manage rules as code. Pipeline changes through your normal review/approval workflow. No more 'who edited rule 47 at 3am Saturday.'
- Integrated DDoS and threat intelligence. Magic Firewall sits on the same network that mitigates DDoS automatically. Layer your stateful rules on top of always-on volumetric protection — and reference Cloudflare's threat-intel IP lists in your rules.
FAQ
Common questions
Does Magic Firewall replace my edge firewall appliances?
For most outbound and inbound L3/L4 policy, yes — that work moves to Magic Firewall. Some customers keep on-prem firewalls for east-west traffic within data centers (which Cloudflare doesn't see). The dramatic reduction in north-south appliance complexity is usually the operational win.
What's the difference between Magic Firewall and the WAF?
Magic Firewall is L3/L4 — IPs, ports, protocols. WAF is L7 — HTTP requests, headers, bodies. They run at different layers of the stack and are complementary. Magic Firewall protects your whole network including non-HTTP services; WAF protects your web apps specifically.
Can I write rules that reference Cloudflare's threat lists?
Yes. Cloudflare maintains continuously-updated IP lists for known malicious sources, Tor exits, anonymizing VPNs, etc. Reference them in rules:
not ip.src in $cf_anonymizer. Lists update automatically — no manual feed management.How is this licensed — per Gbps, per rule, per site?
Typically as part of the Magic Transit / Magic WAN bundle, sized by your protected bandwidth. Rules and sites are unmetered within the bundle.
Let's Test!
Try it live
Demo coming soon
An interactive demo for Magic Firewall is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.
Dive Deeper