A protected gateway needs more than a second login screen

Cloudflare’s NetScaler guide places an independent access check before a gateway’s own authentication page, then restricts direct connections to the gateway so attackers cannot bypass that check. It separates browser authentication from the native remote-desktop connection, which needs its own routing and access policies. These additional boundaries reduce exposure; they do not replace patching or remove an attacker already inside the network.

Cloudflare · Oct 19, 2026

Why it matters

A security boundary only works if every route to the protected service actually passes through it.

More context

The reference design combines identity policies, web-request inspection and origin restrictions. Try it first on one restricted service, testing unauthorized accounts, alternate hostnames, direct origin addresses and normal desktop reconnection. Cloudflare presents public-origin and Tunnel deployments as alternative paths, not mandatory consecutive steps.

Keep in mind

This is a vendor reference architecture, not a measured customer result. Features require suitable configuration and entitlements; public consumer logins can need a different design.

Original read