---
title: Enable Magic Firewall · Cloudflare Learning Paths
description: Magic Transit customers are automatically provided with the
  standard features of Magic Firewall, Cloudflare's firewall-as-a-service
  product.
lastUpdated: 2025-05-09T16:24:56.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/learning-paths/data-center-protection/enable-magic-firewall/
  md: https://developers.cloudflare.com/learning-paths/data-center-protection/enable-magic-firewall/index.md
---

Magic Transit customers are automatically provided with the [standard features](https://developers.cloudflare.com/magic-firewall/plans/#standard-features) of Magic Firewall, Cloudflare's firewall-as-a-service product.

Cloudflare recommends creating a ruleset customized to your environment and needs. Without any rules configured, Magic Firewall will pass on all traffic after mitigations are applied to your tunnels.

The [Extended ruleset](https://developers.cloudflare.com/magic-firewall/best-practices/extended-ruleset/) is the best practice for reducing your attack surface by adopting a positive security model. If possible, use your current Edge Firewall policies to help you decide what ports to permit/block.

If you cannot use the extended ruleset, then use the [minimal ruleset guidance](https://developers.cloudflare.com/magic-firewall/best-practices/minimal-ruleset/) to create a customized ruleset to block known unwanted traffic and common vectors for attack.
