Learning objectives
- Distinguish Cloudflare One component responsibilities
- Design inbound and outbound policy flows
- Measure operational security posture
The mental model
Cloudflare One groups capabilities for connecting and securing users, applications, and networks. Within that architecture, Access controls access to applications, Gateway applies policies to outbound traffic, and Tunnel provides a way to connect resources through outbound connections from a connector. These roles are related but not interchangeable. A tunnel can make an application reachable without deciding which human should use it. An access policy can authorize a user without replacing all outbound browsing controls. Security posture is the combined state of coverage, configuration, identity, patching, and operations. The design is only as useful as the team's ability to monitor it and maintain its assumptions.
How it works
Draw separate flows for inbound application access and outbound user traffic. For an internal web application, a Tunnel connector can establish outbound connectivity to Cloudflare so the origin need not accept a directly exposed inbound public connection for that path. Access can enforce the intended application policy. The application still needs authorization, and the connector needs appropriate local reachability and operational resilience. For employee browsing, Gateway can apply DNS, network, or HTTP policies depending on deployment and supported configuration. HTTP inspection introduces certificate, privacy, and application-compatibility considerations that must be explicitly designed.
Avoid inferring coverage from product names. Verify enrollment, routing, DNS behavior, policy order, exceptions, logging, and failure handling for each flow. Establish who owns connector updates, identity integration, policy changes, and incident response. Track security posture with concrete questions: are intended applications covered, are stale identities removed, are exceptions reviewed, and can operators investigate denied traffic? Roll out to a representative group before expanding. A technically correct policy that disrupts a critical client needs a controlled resolution, not an undocumented permanent bypass. Security success includes reduced exposure, legitimate access, and a sustainable operating model.
Applied example · hypothetical
Hypothetical example: a company publishes an internal dashboard through Tunnel and assumes it is restricted to employees. The connector solves connectivity, but the team must separately verify application access policy and test an unauthenticated request. Meanwhile, employee browsing controls require a different traffic path through Gateway. The review splits the two use cases, assigns owners, and tests allowed and denied cases. It also adds a second operational question: if the connector host fails, how will the team detect it and restore access without opening an unreviewed public port?
In a customer engagement
In a Cloudflare One engagement, use two diagrams rather than one crowded product map: users reaching private resources, and users reaching the Internet. Label Access, Gateway, and Tunnel by the decision each makes. Confirm exact supported deployment options from documentation. Include operational ownership and a pilot test matrix so the customer can judge both security coverage and usability.
Interview relevance
A product architecture interview may deliberately conflate Tunnel with access control. Correct the model politely: connectivity, authorization, and egress policy are separate responsibilities. Then show how they compose. Discuss failure and exception handling to demonstrate that you can design an operable system rather than merely name three products.
Common mistakes
- Assuming Tunnel alone authenticates users
- Conflating inbound Access with outbound Gateway
- Leaving security exceptions without an owner
Key terminology
Cloudflare Access — Cloudflare application access controls that evaluate policy for users and services.
Cloudflare Gateway — Cloudflare secure web gateway capabilities for applying policies to outbound DNS, network, and HTTP traffic.
Cloudflare Tunnel — A connector-based service that establishes outbound connections from resources to Cloudflare.
Security posture — The current condition of an organization’s security controls, coverage, configuration, and operational readiness.
Explain it without the page
- What tests prove an internal application is actually restricted?
- Who owns connector failure and policy rollback?
Further reading
Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.