Zero-Trust-Network-Access on mishraJi

Part 2: Cloudflare Zero Trust - TLS Inspection

Mon, 09 Mar 2026 00:00:00 +0000

In Part 1, we enabled TLS inspection to get HTTP policies working against HTTPS traffic — that’s how we blocked social media sites on port 443. We got it working, but I didn’t really explain what TLS inspection is actually doing under the hood. Let’s fix that.

TLS inspection is essentially a sanctioned man-in-the-middle. When your device initiates an HTTPS connection, Cloudflare Gateway intercepts it, terminates the TLS session, decrypts the traffic, inspects it, and re-encrypts before forwarding to the destination. Same thing in reverse on the way back. The Cloudflare root CA certificate we installed on the client device is what makes this work without your browser throwing certificate errors on every page.

Part 1: Cloudflare Zero Trust — Web Filtering

Thu, 05 Mar 2026 00:00:00 +0000

Introduction

This is Part 1 of the 4-part Cloudflare Zero Trust series. In Part 0 we set up the Cloudflare One Client and tested a successful ZTNA connectivity. If you have not read that yet, I would recommend starting there before following along here.

In this post we are looking at web filtering — what it is and how to configure it using Cloudflare Zero Trust.

What is Web Filtering and Why is it Required?

Web filtering controls what a user can or cannot access on the internet. The reasons for doing it depend on who you are.

Part 0: Cloudflare One Client (Warp Client) Initial Setup

Tue, 03 Mar 2026 00:00:00 +0000

Introduction

If you have been working in IT or security for a while, you have probably heard the term Zero Trust thrown around a lot. But what does it actually mean in practice?

Traditional network security worked on a simple assumption — if you are inside the network, you are trusted. VPNs were the go-to solution. You connect to the VPN, and suddenly you are “on the network” with access to everything. The problem? Once an attacker gets in — through a compromised credential, a phishing attack, or a misconfigured endpoint — they can move laterally across the entire network with very little resistance. Trust was implicit, and that was the fundamental flaw.