AllTech
Every request your team makes,
inspected before it lands.
A secure web gateway sits between your users and the internet and checks what they're reaching — at the DNS layer, the network layer, and inside the encrypted web request itself. AllTech deploys and runs Cloudflare Gateway as that layer, so the filtering follows the laptop home instead of stopping at the office firewall.
Your web filter stops at the front door.
The content filter in most small-business networks lives inside the firewall at the office. It works well right up until the laptop leaves the building — then the user is on home Wi-Fi, an airport hotspot, or a cell hotspot, with no filtering at all and no record of where they went. The gaps we find most often when we take over a network:
Filtering only applies on-premises
Remote and hybrid staff are unfiltered for most of the week — home Wi-Fi, airport hotspots, cell tethering. No policy, and no record of where they went.
DNS filtering with nothing behind it
Blocking a domain at DNS is fast and cheap, but a user or a piece of malware that knows the IP address still connects. Cloudflare's own guidance is explicit: DNS policies need HTTP policies behind them to be a real control.
No visibility into encrypted traffic
Almost all web traffic is HTTPS. Without decryption a filter sees the hostname and nothing else — not the URL path, not the file being downloaded, not the data being uploaded.
Nobody reads the logs
The appliance is generating records that no one has looked at since the day it was installed.
The appliance is a capital purchase with an end-of-life date
It has to be sized for peak load, patched, and replaced on a cycle you pay for whether the threat landscape cooperates or not.
Cloudflare Gateway, run as a managed service.
Gateway is Cloudflare's secure web gateway, built into the Cloudflare One SASE platform. It inspects and filters traffic at three layers — DNS, network (Layer 4), and HTTP (Layer 7) — across Cloudflare's global network, at the edge location nearest the user rather than a single data center you have to backhaul to.
We deploy it, write the policy, tune it against real user complaints, and keep the configuration under version control alongside the rest of your Cloudflare tenant. Which of the layers below you can use depends on the Cloudflare plan you're on — we scope that up front rather than after the contract.
DNS policies
Every DNS query your users make gets checked before a connection is ever opened. Block malware, phishing, and command-and-control domains by security category, restrict content categories, and force SafeSearch on Google, Bing, YouTube, and DuckDuckGo. The fastest layer to deploy and the broadest in scope.
Network policies
Layer 4 filtering on TCP, UDP, and GRE traffic — by IP, port, protocol, and the server name (SNI) sent at the start of an encrypted connection. This is where non-web traffic gets controlled: SSH, RDP, and anything else trying to leave on an unusual port.
HTTP policies
The full request, decrypted and inspected: URL paths, headers, uploads, and downloads. Block a specific page rather than an entire domain. Scan downloads for malware. Quarantine a suspicious file for sandbox analysis before it reaches the endpoint. Allow your company Microsoft 365 tenant while blocking personal accounts on the same service.
Data loss prevention
Inspect what's leaving, not just what's coming in. DLP profiles detect sensitive data — account numbers, records, source code, custom patterns — in uploads and block the transfer before it completes.
Resolver policies & internal DNS
Send internal hostnames to your own DNS servers while everything else resolves through Gateway — so private resources still work for users on the client, without splitting DNS management in two.
A policy that knows who is asking, and what they're asking from.
Most legacy filters make decisions based on a source IP address. Gateway policies can factor in the user and the device as well, pulled from the identity provider you already run.
Identity signals
Email address, group membership, and authentication method from Microsoft Entra ID, Okta, Google Workspace, or another IdP.
Device posture signals
OS version, disk encryption status, firewall state, and whether the device serial number matches your managed device list.
Those combine. A policy can allow a sensitive SaaS application only when the user is in the right security group and the device is encrypted — and quietly block it on the personal laptop that isn't. That's the difference between a content filter and a control.
Four on-ramps. Most clients use two.
How you connect determines which policy layers can be enforced. We usually pair a device client for people with a network tunnel for locations.
Cloudflare One Client (WARP)
- DNS
- Yes
- Network
- Yes
- HTTP
- Yes
BEST FOR Roaming users on managed laptops and phones
DNS resolver configuration
- DNS
- Yes
- Network
- No
- HTTP
- No
BEST FOR Unmanaged devices, guest networks, first-week rollouts
Proxy endpoint (PAC file)
- DNS
- No
- Network
- No
- HTTP
- Browser only
BEST FOR HTTP filtering without installing an agent
Network tunnel (IPsec/GRE)
- DNS
- Yes
- Network
- Yes
- HTTP
- Yes
BEST FOR Branch offices, plant floors, data centers
Practical version: the client covers the people, the tunnel covers the building, and DNS resolver configuration is how we get filtering live on day one while the client rollout is still in progress. See Zero Trust Access (ZTNA) for the client and connector side of that.
Three ways to start.
Filtering & egress review
We look at what's filtering today, what isn't, and where your traffic actually leaves from. You get a written policy recommendation and a category baseline before anything changes. Often the right first step.
Staged rollout
DNS-layer filtering first for immediate coverage, then the device client, then HTTP inspection and the root certificate, then DLP. Staged deliberately — every layer we turn on is one more thing that can break a line-of-business app, and we'd rather find that with a pilot group than with your whole company.
Managed Gateway
Policy changes, category tuning, block-page exceptions, new-hire provisioning, and log review. Billed monthly per seat. When someone calls because a site they need is blocked, they call us, not you.
Three phases, because turning it all on at once is how you break payroll day.
DNS filtering
Point DNS at Gateway, block the security-risk categories, and watch the logs. This alone stops a large share of malware and phishing domains and requires no software on any device. Nothing to install, nothing to decrypt, easy to reverse.
Device client & network policies
Deploy the Cloudflare One Client through Datto RMM or Intune. Filtering now follows the device off-network, and Layer 4 policies can control SSH, RDP, and unusual outbound ports. Split-tunnel and posture rules get set per role here.
HTTP inspection & DLP
Install the Cloudflare root certificate so HTTPS can be decrypted and inspected, then enable download scanning, file sandboxing, and DLP profiles. This is the phase that finds the pinned-certificate app nobody remembered was installed — which is exactly why it goes last and starts with a pilot group.
Policy changes propagate across Cloudflare's network in under a minute, so tuning during rollout is fast — the constraint is our testing discipline, not the platform.
Where it makes the most difference.
Multi-site organizations
One policy set, enforced identically in Logan, Boise, and the office you open next quarter — without shipping an appliance to each one.
Hybrid and remote teams
The point where "we have a firewall" stops being an answer, because half the workforce isn't behind it.
Manufacturers
Plant-floor networks and office networks with genuinely different filtering needs, plus vendors who need narrow, logged access rather than open outbound.
Clinics and professional services
Organizations that need to answer "where did that data go" with a record instead of a guess, and that have DLP obligations attached to specific record types.
Businesses with an aging filtering appliance
If the renewal quote just landed and the box is out of support, this is the conversation to have before you re-up for another three years.
What a secure web gateway will not do for you.
We'd rather say this here than after you've signed something.
DNS filtering alone is not sufficient. If you only deploy DNS policies, a user or a piece of malware that knows the destination IP address can still connect. DNS is the fast, broad first layer. HTTP policies are what make it a control.
HTTP inspection requires a certificate on every device. Decrypting HTTPS means installing the Cloudflare root certificate on managed endpoints. On unmanaged or BYOD devices that is a real constraint — those users get DNS-layer protection, not full inspection.
Some applications will break, and we'll have to exempt them. Certificate-pinned applications, some banking and healthcare portals, and certain updaters do not tolerate inspection. The fix is a Do Not Inspect policy for that destination, which means that destination isn't inspected. That's a trade, and we'll document each one.
It doesn't replace endpoint security or email security. Gateway filters what is in transit. It does not stop a threat already resident on a device, and it is not a mail filter.
Logs are only useful if someone reads them. Gateway produces DNS, HTTP, and network session analytics. We review them as part of managed service; if you're self-managing, budget the time or pair it with Managed SOC.
Not every capability is on every plan. Packet filtering, for example, is an Enterprise-tier feature. We'll tell you which tier your requirements actually need before you buy one.
For the two gaps Gateway leaves open, see Endpoint Security and Email Security. For log review, Managed SOC.
Common questions
Is this the same thing as DNS filtering?
DNS filtering is one layer of it. A secure web gateway also inspects Layer 4 network traffic and decrypted HTTP requests, which is what catches the threats that live inside otherwise-allowed traffic.
Do our employees know they're being filtered?
Yes. Blocked requests return a block page, and the client can display a notification. We'd recommend telling staff before rollout — every deployment we've run goes smoother when the announcement precedes the block page.
Can we filter by person or group instead of by network?
Yes. Policies can key off user identity and group membership from Entra ID, Okta, or Google Workspace, plus device posture signals like disk encryption.
Will this slow down the internet?
Traffic is processed at the Cloudflare edge location nearest the user, not backhauled to a central appliance. For most users on most requests the effect is not perceptible. Full HTTPS inspection does add processing, which is one reason we scope which traffic gets inspected rather than inspecting everything.
We already have a firewall. Why do we need this?
Your firewall protects the office. This protects the user. Gateway's layers map to familiar firewall functions — DNS filtering, a Layer 4 stateful firewall, and a Layer 7 forward proxy — except they're enforced wherever the user is instead of only at one perimeter.
Can we keep our internal DNS?
Yes. Resolver policies send queries for your internal domains to your own DNS servers while everything else resolves through Gateway.
How long does deployment take?
DNS-layer filtering can be live in days. A full rollout including the device client, HTTP inspection, and DLP typically runs four to eight weeks depending on headcount and how many applications need testing.
The rest of the stack it plugs into
Zero Trust Access (ZTNA)
The client and connector that carry traffic to Gateway, and the per-app authorization layer for internal resources.
Learn moreEndpoint Security
EDR on the device itself — the threat Gateway cannot see because it is already resident.
Learn moreEmail Security
The other half of the phishing problem, filtered before the message reaches the inbox.
Learn moreManaged SOC
Humans reviewing what the tooling flags, including Gateway DNS and HTTP analytics.
Learn moreCloudflare Zero Trust
The full Cloudflare One platform this sits inside — Access, Tunnel, DNS, and DDoS protection.
Learn moreNetwork & Infrastructure
The edge device, segmentation, and multi-WAN failover Gateway rides on top of rather than replaces.
Learn moreFind out what your network is actually reaching.
Send us a short note about your environment. We'll book a 30-minute scoping call, tell you which policy layers you actually need, and be honest if DNS filtering alone is enough for where you are right now.
