Cloud firewall-as-a-service that filters and inspects network-layer traffic across Cloudflare's network for sites connected via Magic Transit or Cloudflare WAN. Formerly Magic Firewall; Enterprise only.
FluffyStack toolsJurisdictional exposure
Sub-services (4)
Firewall policies
Stateless packet filtering on IP, port, protocol and packet length
Intrusion detection system
Signature-based detection of threats in network traffic
Managed rulesets
Cloudflare-maintained rules for known malicious traffic patterns
IP lists
Reusable lists of addresses referenced in firewall rules
Compliance & Certifications
This service is attested for the following frameworks. Always verify with the provider before relying on a specific compliance posture.
Where this runs
Commercial regions (29)
Europe (10)
- Paris
- Frankfurt
- Dublin
- Milan
- Amsterdam
- Warsaw
- Madrid
- Stockholm
- Zurich
- London
North America (4)
- Toronto
- Ashburn
- Chicago
- San Jose
South America (2)
- Buenos Aires
- São Paulo
Asia (6)
- Hong Kong
- Mumbai
- Tokyo
- Singapore
- Seoul
- Taipei
Oceania (2)
- Sydney
- Auckland
Middle East (2)
- Tel Aviv
- Dubai
Africa (3)
- Lagos
- Cape Town
- Johannesburg
Tags
Equivalent services on other platforms
Managed stateful firewall, IDS/IPS, and TLS inspection service deployed as VPC endpoints with Suricata-compatible rule syntax, AWS Managed Threat Signatures rule groups, and centralised deployment via AWS Firewall Manager across Organizations
Cloud-native, stateful firewall-as-a-service with built-in high availability, unrestricted scale, threat intelligence-based filtering, and centralised policy
Fully managed next-generation firewall in an active/passive HA cluster, in a Stormshield edition (ANSSI-qualified) or Fortinet edition, operated 24/7 by Cloud Temple with changes via change management; billed monthly per HA cluster
Managed next-generation firewall for VPC networks with L7 inspection, IDPS threat signatures (Palo Alto-powered), TLS interception, hostname-based egress rules, and unified policy management across networks and organisations
Stateful network firewalls applied to cloud servers via labels, with reusable rule sets across server fleets
Centrally managed firewall rule sets for a virtual data centre, applied to VMs and NICs that are members of the group to filter ingress and egress traffic
Managed next-generation firewall service powered by Palo Alto Networks VM-Series, with application awareness, TLS inspection, URL filtering, intrusion prevention (IPS), DNS security, and deployment flexibility across VCN or Transit Hub topologies