What FirewallDNS offers
FirewallDNS is a network-level DNS firewall. You register your network's public IP address in the dashboard and point your router, firewall or DHCP server at the FirewallDNS resolver. Every device on that network is then filtered according to your settings. The protections described on our feature pages are malware protection, phishing protection, newly registered domain blocking, content categories (adult content, gambling and social media), custom allowlists and blocklists, and near real-time query logs. Pricing is $2.90 per device per month, with Starter, Business and MSP plans.
Overview of Cloudflare Gateway
[VERIFY: Cloudflare Gateway positioning within Cloudflare Zero Trust / SASE.] [VERIFY: Gateway components — DNS filtering, HTTP filtering, network filtering — and which require the device client.] [VERIFY: target customer size.]
Scope: DNS filter or security platform
FirewallDNS is deliberately focused on DNS. It does not inspect web traffic or replace a secure web gateway, which keeps setup simple: change the DNS server on your router or firewall and register your IP.
[VERIFY: whether Cloudflare Gateway DNS filtering can be used on its own without the WARP client, and what additional setup HTTP inspection requires.]
Filtering and security categories
FirewallDNS blocks malware, phishing and newly registered domains and offers adult, gambling and social media categories plus custom lists.
[VERIFY: Cloudflare Gateway security and content categories, including new-domain categories.]
Logs and data handling
FirewallDNS shows near real-time query logs per registered network, retained for a set period. Each customer sees only their own data.
[VERIFY: Cloudflare Gateway log retention, log export options and data locality controls.]
Pricing and MSP use
FirewallDNS costs $2.90 per device per month and includes an MSP model with per-customer invoicing.
[VERIFY: Cloudflare Zero Trust pricing — free tier limits, per-user pricing and MSP/partner programme.]
Switching from Cloudflare Gateway to FirewallDNS
If you currently use Cloudflare Gateway and want to try FirewallDNS, you do not need to switch everything at once. Create a FirewallDNS account, register the public IP address of one network or site, and change the DNS servers on that network's router, firewall or DHCP server. Keep your existing service running elsewhere while you compare. [VERIFY: any Cloudflare Gateway agents, apps or profiles that should be removed from devices to avoid conflicts]
Export or note your existing allowlist and blocklist entries before you start, and add them to FirewallDNS so users are not surprised by different decisions. After a week, compare the query logs from both services and decide based on what you see on your own network.
Questions to ask before choosing
Whichever service you choose, ask the same questions of each provider and check the answers in writing.
- Which threats are blocked, and how often are threat lists updated?
- Is newly registered domain blocking available, and is the threshold configurable?
- What is logged, where is it stored, for how long, and who can see it?
- How are devices or users counted for billing?
- Is there a data processing agreement and a published list of sub-processors?
- How does Cloudflare Gateway handle these points? [VERIFY: answers from Cloudflare Gateway documentation]
Who each option may suit
FirewallDNS may suit organisations that want a focused DNS firewall rather than a broader zero trust platform. It is priced per device, deployed at the network edge and managed from one dashboard, with each customer seeing only their own settings, logs and cost.
[VERIFY: the types of customers Cloudflare Gateway targets, based on its own website and documentation.] Because the two services may be built for different audiences, the right choice depends less on a feature checklist and more on how you run your network, who manages it and how you want to pay. Shortlist both, test both on a real network for at least a week, and involve the people who will handle support tickets in the decision.
How to choose
Rather than relying on any comparison page, including this one, test both services against your own requirements. Write down what matters most: the threats you want to block, the devices you need to cover, whether devices leave the network, who needs access to logs, which regions your data may be stored in, and your budget per device. Then trial each option on a small part of your network and compare the query logs side by side.
Look at how each service handles false positives, how quickly you can allow a blocked domain, and how clearly the dashboard explains why a request was blocked. These day-to-day details often matter more than feature lists. Finally, check each provider's privacy policy and data processing terms yourself, since logging and retention practices vary between services. For Cloudflare Gateway, rely on its official documentation and current price list.