---
title: Magic Transit egress · Cloudflare One docs
description: The suggestions in the Minimal ruleset and Extended ruleset are
  recommendations for ingress traffic.
lastUpdated: 2025-10-30T17:13:08.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/cloudflare-one/traffic-policies/packet-filtering/best-practices/magic-transit-egress/
  md: https://developers.cloudflare.com/cloudflare-one/traffic-policies/packet-filtering/best-practices/magic-transit-egress/index.md
---

The suggestions in the [Minimal ruleset](https://developers.cloudflare.com/cloudflare-one/traffic-policies/packet-filtering/best-practices/minimal-ruleset) and [Extended ruleset](https://developers.cloudflare.com/cloudflare-one/traffic-policies/packet-filtering/best-practices/extended-ruleset) are recommendations for ingress traffic.

For Magic Transit egress traffic, consider the following information:

* The Magic Firewall rules will apply to both Magic Transit ingress and egress traffic passing via Cloudflare.
* Magic Firewall is not stateful for your Magic Transit egress traffic.
* Magic Firewall is not stateful in both directions after DDoS mitigations.
* If you have a Magic Firewall "default drop" catchall rule for ingress traffic, you will need to add an earlier rule to permit traffic sourced from your Magic Transit prefix with the destination as **any** to allow outbound egress traffic.
