Skip to content

Commit 159d65f

Browse files
ranbelRebeccaTamachiro
ranbel
authored and
RebeccaTamachiro
committed
[ZT] IP calculator for Split Tunnels (#20900)
* aws and gcp * private network config
1 parent b9520ab commit 159d65f

File tree

3 files changed

+46
-5
lines changed

3 files changed

+46
-5
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ head:
99
---
1010

1111
import { Render } from "~/components";
12+
import SubtractIPCalculator from "~/components/SubtractIPCalculator.tsx";
1213

1314
This guide covers how to connect an Amazon Web Services (AWS) virtual machine to Cloudflare using our lightweight connector, `cloudflared`.
1415

@@ -98,7 +99,20 @@ EOF
9899
[Private network routes](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) allow users to connect to your virtual private cloud (VPC) using the WARP client. To add a private network route for your Cloudflare Tunnel:
99100

100101
1. In the **Private Network** tab, enter the **Private IPv4 address** of your AWS instance (for example, `172.31.19.0`). You can expand the IP range later if necessary.
101-
2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the private IP is routing through WARP. For example, if you are using Split Tunnels in Exclude mode, delete `172.16.0.0/12`. We recommend re-adding the IPs that are not explicitly used by your AWS instance -- you can use [this calculator](https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/) to determine which IP addresses to re-add.
102+
2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the private IP is routing through WARP. For example, if you are using Split Tunnels in Exclude mode, delete `172.16.0.0/12`. We recommend re-adding the IPs that are not explicitly used by your AWS instance.
103+
104+
To determine which IP addresses to re-add, subtract your AWS instance IPs from `172.16.0.0/12`:
105+
106+
<SubtractIPCalculator
107+
client:load
108+
defaults={{
109+
base: "172.16.0.0/12",
110+
exclude: ["172.31.19.0", "172.24.0.0/16"]
111+
}}
112+
/>
113+
114+
Add the results back to your Split Tunnel Exclude mode list.
115+
102116
3. To test on a user device:
103117

104118
1. [Log in to the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/).

‎src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ sidebar:
66
---
77

88
import { Render } from "~/components";
9+
import SubtractIPCalculator from "~/components/SubtractIPCalculator.tsx";
910

1011
This guide covers how to connect a Google Cloud Project (GCP) virtual machine to Cloudflare using our lightweight connector, `cloudflared`.
1112

@@ -77,7 +78,19 @@ To complete the following procedure, you will need to:
7778
To configure a private network route for your Cloudflare Tunnel:
7879
7980
1. In the **Private Network** tab, enter the **Internal IP** of your GCP VM instance (for example, `10.0.0.2`). You can expand the IP range later if necessary.
80-
2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the internal IP is routing through WARP. For example, if you are using Split Tunnels in Exclude mode, delete `10.0.0.0/8`. We recommend re-adding the IPs that are not explicitly used by your GCP VM -- you can use [this calculator](https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/) to determine which IP addresses to re-add.
81+
2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the internal IP is routing through WARP. For example, if you are using Split Tunnels in Exclude mode, delete `10.0.0.0/8`. We recommend re-adding the IPs that are not explicitly used by your GCP VM.
82+
83+
To determine which IP addresses to re-add, subtract your GCP instance IPs from `10.0.0.0/8`:
84+
85+
<SubtractIPCalculator
86+
client:load
87+
defaults={{
88+
base: "10.0.0.0/8",
89+
exclude: ["10.0.0.2", "10.0.16.0/24"]
90+
}}
91+
/>
92+
93+
Add the results back to your Split Tunnel Exclude mode list.
8194
3. To test on a user device:
8295
8396
1. [Log in to the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/).

‎src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-route-ips.mdx‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,28 @@ params:
33
- one
44
---
55

6-
import { Markdown } from "~/components"
6+
import { Markdown } from "~/components";
7+
import SubtractIPCalculator from "~/components/SubtractIPCalculator.tsx";
78

89
By default, WARP excludes traffic bound for [RFC 1918 space](https://datatracker.ietf.org/doc/html/rfc1918), which are IP addresses typically used in private networks and not reachable from the Internet. In order for WARP to send traffic to your <Markdown text={props.one}/>, you must configure [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) so that the IP/CIDR of your <Markdown text={props.one}/> routes through WARP.
910

1011
1. First, check whether your [Split Tunnels mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include** mode.
1112
2. If you are using **Include** mode, add your <Markdown text={props.one}/>'s IP/CIDR range to the list. Your list should also include the [domains necessary for Cloudflare Zero Trust functionality](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains).
1213
3. If you are using **Exclude** mode:
13-
1. Delete your <Markdown text={props.one}/>'s IP/CIDR range from the list. For example, if your network uses the default AWS range of `172.31.0.0/16`, delete `172.16.0.0/12`.
14-
2. Re-add IP/CIDR ranges that are not explicitly used by your <Markdown text={props.one}/>. For the AWS example above, you would add new entries for `172.16.0.0/13`, `172.24.0.0/14`, `172.28.0.0/15`, and `172.30.0.0/16`. This ensures that only traffic to `172.31.0.0/16` routes through WARP.
14+
15+
a. Delete your <Markdown text={props.one}/>'s IP/CIDR range from the list. For example, if your network uses the default AWS range of `172.31.0.0/16`, delete `172.16.0.0/12`.
16+
17+
b. Re-add IP/CIDR ranges that are not explicitly used by your <Markdown text={props.one}/>. For the AWS example above, you would add new entries for `172.16.0.0/13`, `172.24.0.0/14`, `172.28.0.0/15`, and `172.30.0.0/16`. This ensures that only traffic to `172.31.0.0/16` routes through WARP.
18+
19+
You can use the following calculator to determine which IP addresses to re-add:
20+
21+
<SubtractIPCalculator
22+
client:load
23+
defaults={{
24+
base: "172.16.0.0/12",
25+
exclude: ["172.31.0.0/16", `172.28.0.0/15`]
26+
}}
27+
/>
28+
In **Base CIDR**, enter the RFC 1918 range that you deleted from Split Tunnels. In **Excluded CIDRs**, enter the IP/CIDR range used by your <Markdown text={props.one}/>. Re-add the calculator results to your Split Tunnel Exclude mode list.
1529

1630
By tightening the private IP range included in WARP, you reduce the risk of breaking a user's [access to local resources](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-users-to-enable-local-network-exclusion).

0 commit comments

Comments
 (0)