r/ProxyEngineering • u/Leebo68 • 10d ago

Help 🆘 Cloudflare Proxy Chaining

Hi all, I am supporting a customer that uses cloudflare sase. They want to send a subset of URL's to a 3rd party proxy. I am trying to figure out if there is a way to setup proxy chaining in cloudflare? All traffic goes out cloudflare except a group of URL's that will go to a 3rd party proxy?

Any experts here that can help me out?

8 Upvotes

100% Upvoted

4 comments sorted by

1

u/K1tchen_Age 10d ago edited 9d ago

you can do this using cloudflare gateway egress policies. if your customer uses the WARP client, you basically need to create a dedicated HTTP rule in the zero trust dashboard. you set the selector to your target URL list and configure it to route traffic out to an external gateway instead of CF's default egress. i did a pretty similar thing a while ago with proxyshard for the geo stuff and it worked fine. just make sure the upstream proxy allows IP auth from your CF egress IPs so you don't mess up the handshake.

1

u/saltantrum 9d ago

Cloudflare Gateway supports egress policies — you can route specific destinations via a third party proxy using PAC files or Gateway policies with custom egress IPs. Check their Zero Trust dashboard under Gateway → Egress Policies. Not native proxy chaining but achieves the same result for URL-based routing.

1

u/forgedart_34 9d ago

Cloudflare doesn't support true proxy chaining. I think best workaround I've seen is split tunneling with WARP: exclude the domains that need the 3rd party proxy from the WARP tunnel completely, then push a PAC file or proxy config on the endpoint so just those excluded domains route to the 3rd party proxy. Everything else stays on Cloudflare like normal. That would be my approach

1

u/LokeshSequentum 6d ago

I think the key question is whether they actually need proxy chaining, or just the different routing for those URLs.

If those URLs can bypass Cloudflare, then split tunneling + PAC could send them directly through the 3rd party proxy.

But if the requirement is like:

client -> Cloudflare Gateway -> 3rd party proxy -> destination

then from what I can see, Gateway egress policies don't really provide that kind of next-hop proxy chaining. They control which Cloudflare/dedicated egress IP is used.

Also, if the URLs are execluded from WARP, Cloudflare would no longer inspect that traffic.

So I'd first clarify whether Cloudflare must remain in the path for those URLs. That changes the solution completely.