Cloudflare Magic Firewall

Name: Cloudflare Magic Firewall
Author: Cloudflare Magic Firewall

Paid APIWeb

Visit Cloudflare Magic Firewall Alternatives Pricing

What Cloudflare Magic Firewall is

Cloudflare Magic Firewall, listed as Cloudflare Network Firewall (formerly Magic Firewall), is a firewall-as-a-service that filters unwanted traffic before it reaches office networks and cloud infrastructure. It inspects Layer 3 and Layer 4 traffic across headquarters, branch offices and virtual private clouds, running on Cloudflare’s global network without customer-managed firewall hardware. Rules can match protocol, port, IP addresses, packet length and bit fields, and changes propagate in less than a minute. Traffic is allowed by default until a rule blocks it; rules run in order after Cloudflare DDoS mitigations. Configuration can be managed from one dashboard or through an API compatible with Terraform. Per-rule analytics are available in the dashboard and GraphQL API. Standard features include Cloudflare WAN integration, and Magic Transit includes DDoS protection. Advanced options available for purchase include threat-intelligence IP lists, geoblocking, ASN filtering, packet captures, protocol validation, Secure Web Gateway filtering and IDS. The product is Enterprise-only and available with Magic Transit or Cloudflare WAN; pricing is on request.

Who it suits

This product is for Enterprise customers seeking to filter traffic for office networks, branch offices or virtual private clouds. It is available with a purchase of Magic Transit or Cloudflare WAN.

What it does well

Inspects Layer 3 and Layer 4 traffic.
Rules support several matching fields, including protocol and port.
Configuration is available through a Terraform-compatible API.
Per-rule analytics are available through the dashboard and GraphQL API.

What to know first

Enterprise-only; requires Magic Transit or Cloudflare WAN.
Pricing is available on request.
IP lists currently support IPv4, not IPv6.
Advanced features are available for purchase.

Limits

The service is Enterprise-only and available with Magic Transit or Cloudflare WAN. Network Firewall IP lists currently handle IPv4 addresses rather than IPv6, and advanced capabilities are purchased separately.

Plans

Plan	Billed and limits	Price
Cloudflare Network Firewall (formerly Magic Firewall)	Enterprise-only · available with Magic Transit or Cloudflare WAN · advanced features available for purchase	On request

As cloudflare.com lists them, read 11 Oct 2026. The maker's own page has the final word.

Getting started

Open the Cloudflare Network Firewall website
Purchase Magic Transit or Cloudflare WAN
Use the web dashboard or programmable API to configure policies
Connect Terraform-compatible automation if required
Review per-rule analytics in the dashboard or GraphQL API

Verdict

Cloudflare Magic Firewall provides cloud-based traffic filtering with dashboard and API management, rule analytics and optional advanced features. Its Enterprise-only availability and IPv4-only IP lists are important constraints to weigh.

Questions

Is Cloudflare Magic Firewall free?

No. It is a paid service with pricing available on request and no free plan.

Which platforms are supported?

The listed platforms are web and API.

Does it require firewall hardware?

No. It runs on Cloudflare’s global network without requiring customers to manage firewall hardware appliances.

What does it integrate with?

Standard features integrate with Cloudflare WAN, and Magic Transit includes DDoS protection. The API is compatible with Terraform.

Does it provide intrusion detection?

Intrusion detection is an advanced feature available for purchase. It monitors known signatures including ransomware, data exfiltration, and network scanning.

Facts from Cloudflare Magic Firewall's own pages

Advanced features: Advanced features available for purchase include customizable and managed threat intelligence IP lists, geoblocking, ASN filtering, on-demand packet captures, protocol validation, Secure Web Gateway filtering, and IDS. · developers.cloudflare.com, 11 Oct 2026
Analytics: Traffic analytics are available per rule in the dashboard and through the GraphQL API. · developers.cloudflare.com, 11 Oct 2026
Audience and availability: The product is marked Enterprise-only and is available with a purchase of Magic Transit or Cloudflare WAN. · developers.cloudflare.com, 11 Oct 2026
Company security and trust: Cloudflare provides a Trust Hub with trust and compliance information. · cloudflare.com, 11 Oct 2026
Deployment: It runs on Cloudflare’s global network without requiring customers to manage firewall hardware appliances. · cloudflare.com, 11 Oct 2026
Founded: 2009 · cloudflare.com, 4 Oct 2026
Free plan: No · cloudflare.com, 19 Sept 2026
Headquarters: San Francisco, California, United States · cloudflare.com, 4 Oct 2026
Integrations: The standard features include integration with Cloudflare WAN, and Magic Transit includes DDoS protection. · developers.cloudflare.com, 11 Oct 2026
Management and automation: Firewall and network configuration can be managed from one dashboard or through a programmable API compatible with Terraform. · developers.cloudflare.com, 11 Oct 2026
Notable limit: Network Firewall IP lists currently support IPv4 addresses, not IPv6 addresses. · developers.cloudflare.com, 11 Oct 2026
Purpose: It is a firewall-as-a-service that filters unwanted traffic before it reaches office networks and cloud infrastructure. · developers.cloudflare.com, 11 Oct 2026
Rule behavior: Traffic is permitted by default until a rule blocks it, rules are evaluated in order, and Network Firewall rules run after Cloudflare DDoS mitigations. · developers.cloudflare.com, 11 Oct 2026
Rule matching: Rules can match protocol, port, IP addresses, packet length, and bit fields, and changes propagate in less than a minute. · developers.cloudflare.com, 11 Oct 2026
Threat detection: The IDS monitors for known threat signatures, including ransomware, data exfiltration, and network scanning. · developers.cloudflare.com, 11 Oct 2026
Traffic coverage: It inspects and filters Layer 3 and Layer 4 traffic across headquarters, branch offices, and virtual private clouds. · cloudflare.com, 11 Oct 2026