|
| 1 | +--- |
| 2 | +{} |
| 3 | + |
| 4 | +--- |
| 5 | + |
| 6 | +import { Render, Tabs, TabItem } from "~/components" |
| 7 | + |
| 8 | +To add a domain to the Local Domain Fallback list: |
| 9 | + |
| 10 | +<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard"> |
| 11 | + |
| 12 | +<Render file="warp/view-local-domains" product="cloudflare-one" /> |
| 13 | + |
| 14 | +4. In **Domain**, enter the apex domain (`example.com`) that you want to resolve using your private DNS server. All prefixes under the apex domain are subject to Local Domain Fallback (in other words, `example.com` is interpreted as `*.example.com`). |
| 15 | + |
| 16 | +5. In **DNS Servers**, enter the IP address of the DNS servers that should resolve that domain name. |
| 17 | + |
| 18 | +6. Enter an optional description and select **Save domain**. |
| 19 | + |
| 20 | +</TabItem> <TabItem label="Terraform (v5)"> |
| 21 | + |
| 22 | +A Local Domain Fallback list is scoped to a specific [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/). If a device profile does not have a corresponding Local Domain Fallback resource, those devices will use the default local domains shown in Step 2. |
| 23 | + |
| 24 | +1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token): |
| 25 | + - `Zero Trust Write` |
| 26 | + |
| 27 | +2. (Optional) Create a list of domains that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles: |
| 28 | + |
| 29 | + ```tf title="local-domains.local.tf" |
| 30 | + locals { |
| 31 | + default_local_domains = [ |
| 32 | + # Default Local Domain Fallback entries recommended by Cloudflare |
| 33 | + { |
| 34 | + suffix = "corp" |
| 35 | + }, |
| 36 | + { |
| 37 | + suffix = "domain" |
| 38 | + }, |
| 39 | + { |
| 40 | + suffix = "home" |
| 41 | + }, |
| 42 | + { |
| 43 | + suffix = "home.arpa" |
| 44 | + }, |
| 45 | + { |
| 46 | + suffix = "host" |
| 47 | + }, |
| 48 | + { |
| 49 | + suffix = "internal" |
| 50 | + }, |
| 51 | + { |
| 52 | + suffix = "intranet" |
| 53 | + }, |
| 54 | + { |
| 55 | + suffix = "invalid" |
| 56 | + }, |
| 57 | + { |
| 58 | + suffix = "lan" |
| 59 | + }, |
| 60 | + { |
| 61 | + suffix = "local" |
| 62 | + }, |
| 63 | + { |
| 64 | + suffix = "localdomain" |
| 65 | + }, |
| 66 | + { |
| 67 | + suffix = "localhost" |
| 68 | + }, |
| 69 | + { |
| 70 | + suffix = "private" |
| 71 | + }, |
| 72 | + { |
| 73 | + suffix = "test" |
| 74 | + } |
| 75 | + ] |
| 76 | + } |
| 77 | + ``` |
| 78 | +4. To configure Local Domain Fallback for the default device profile, use the [`cloudflare_zero_trust_device_default_profile_local_domain_fallback`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_default_profile_local_domain_fallback) resource. To configure Local Domain Fallback for a custom device profile, use[`cloudflare_zero_trust_device_custom_profile_local_domain_fallback`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_custom_profile_local_domain_fallback). For example: |
| 79 | + |
| 80 | + ```tf title="device-profiles.tf" |
| 81 | + resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example" { |
| 82 | + account_id = var.cloudflare_account_id |
| 83 | + policy_id = cloudflare_zero_trust_device_custom_profile.example.id |
| 84 | + domains = concat( |
| 85 | + # Global entries |
| 86 | + local.default_local_domains, |
| 87 | +
|
| 88 | + # Profile-specific entries |
| 89 | + [ |
| 90 | + { |
| 91 | + suffix = "example.com" |
| 92 | + description = "Domain for local development" |
| 93 | + dns_server = ["1.1.1.1", "192.168.0.1"] |
| 94 | + } |
| 95 | + ] |
| 96 | + ) |
| 97 | + } |
| 98 | + ``` |
| 99 | + |
| 100 | +For `suffix`, specify the apex domain (`example.com`) that you want to resolve using your private DNS server. All prefixes under the apex domain are subject to Local Domain Fallback (in other words, `example.com` is interpreted as `*.example.com`). For `dns_server`, enter the IP address of the DNS servers that should resolve that domain name. |
| 101 | + |
| 102 | +</TabItem> |
| 103 | +</Tabs> |
| 104 | + |
| 105 | +WARP tries all servers and always uses the fastest response, even if that response is `no records found`. We recommend specifying at least one DNS server for each domain. If a value is not specified, the WARP client will try to identify the DNS server (or servers) used on the device before it started, and use that server for each domain in the Local Domain Fallback list. |
| 106 | + |
| 107 | +### Route traffic to fallback server |
| 108 | + |
| 109 | +The WARP client routes DNS traffic to your [Local Domain Fallback server](#add-a-domain) according to your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). To ensure that queries can reach your private DNS server: |
| 110 | + |
| 111 | +- If your DNS server is only reachable inside of the WARP tunnel (for example, via `cloudflared` or Magic WAN): |
| 112 | + |
| 113 | + 1. Go to **Networks** > **Routes** and verify that the DNS server is connected to Cloudflare. To connect a DNS server, refer to [Private networks](/cloudflare-one/connections/connect-networks/private-net/). |
| 114 | + |
| 115 | + 2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/), verify that the DNS server IP routes through the WARP tunnel. |
| 116 | + |
| 117 | +- If your DNS server is only reachable outside of the WARP tunnel (for example, via a third-party VPN), verify that the DNS server IP is [excluded from the WARP tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). |
| 118 | + |
| 119 | +For more information, refer to [How the WARP client handles DNS requests](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/#how-the-warp-client-handles-dns-requests). |
0 commit comments