Skip to content

Commit 1dfbc5d

Browse files
ranbelranbel
committed
add split tunnel route
1 parent b8e8a3f commit 1dfbc5d

File tree

2 files changed

+105
-2
lines changed

2 files changed

+105
-2
lines changed

‎src/content/partials/cloudflare-one/warp/add-split-tunnels-route.mdx‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
import { GlossaryTooltip, TabItem, Tabs, Render } from "~/components";
66

7+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
8+
79
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**.
810
2. Under **Device settings**, locate the [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) you would like to modify and select **Configure**.
911
3. Under **Split Tunnels**, check whether your [Split Tunnels mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include**.
@@ -33,6 +35,107 @@ import { GlossaryTooltip, TabItem, Tabs, Render } from "~/components";
3335

3436
</TabItem> </Tabs>
3537

38+
</TabItem> <TabItem label="Terraform (v5)">
39+
40+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
41+
- `Zero Trust Write`
42+
43+
2. Choose a [`cloudflare_zero_trust_device_default_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_default_profile) or [`cloudflare_zero_trust_device_custom_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_custom_profile) resource to modify, or [create a new device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#create-a-new-profile).
44+
45+
3. (Optional) Create a list of split tunnel routes that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles:
46+
47+
```tf title="split-tunnels.local.tf"
48+
locals {
49+
global_exclude_list = [
50+
# Default Split Tunnel entries recommended by Cloudflare
51+
{
52+
address = "ff05::/16"
53+
},
54+
{
55+
address = "ff04::/16"
56+
},
57+
{
58+
address = "ff03::/16"
59+
},
60+
{
61+
address = "ff02::/16"
62+
},
63+
{
64+
address = "ff01::/16"
65+
},
66+
{
67+
address = "fe80::/10"
68+
description = "IPv6 Link Local"
69+
},
70+
{
71+
address = "fd00::/8"
72+
},
73+
{
74+
address = "255.255.255.255/32"
75+
description = "DHCP Broadcast"
76+
},
77+
{
78+
address = "240.0.0.0/4"
79+
},
80+
{
81+
address = "224.0.0.0/24"
82+
},
83+
{
84+
address = "192.168.0.0/16"
85+
},
86+
{
87+
address = "192.0.0.0/24"
88+
},
89+
{
90+
address = "172.16.0.0/12"
91+
},
92+
{
93+
address = "169.254.0.0/16"
94+
description = "DHCP Unspecified"
95+
},
96+
{
97+
address = "100.64.0.0/10"
98+
},
99+
{
100+
address = "10.0.0.0/8"
101+
}
102+
]
103+
}
104+
```
105+
4. In the device profile, exclude or include routes based on either their IP address or domain:
106+
107+
```tf title="device-profiles.tf"
108+
resource "cloudflare_zero_trust_device_custom_profile" "example" {
109+
account_id = var.cloudflare_account_id
110+
name = "Example custom profile with split tunnels"
111+
enabled = true
112+
precedence = 101
113+
service_mode_v2 = {mode = "warp"}
114+
match = "identity.email == \"[email protected]\""
115+
116+
exclude = concat(
117+
# Global entries
118+
local.global_exclude_list,
119+
120+
# Profile-specific entries
121+
[
122+
{
123+
address = "192.0.2.0/24"
124+
description = "Example IP to exclude from WARP"
125+
},
126+
{
127+
host = "example.com"
128+
description = "Example domain to exclude from WARP"
129+
}
130+
]
131+
)
132+
}
133+
```
134+
When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to [Domain-based Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels).
135+
136+
</TabItem>
137+
</Tabs>
138+
36139
<Render file="warp/client-notification-lag" product="cloudflare-one" />
37140

38141
We recommend keeping the Split Tunnels list short, as each entry takes time for the client to parse. In particular, domains are slower to action than IP addresses because they require on-the-fly IP lookups and routing table / local firewall changes. A shorter list will also make it easier to understand and debug your configuration. For information on device profile limits, refer to [Account limits](/cloudflare-one/account-limits/#warp).

‎src/content/partials/cloudflare-one/warp/change-split-tunnels-mode.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ import { Tabs, TabItem } from '~/components';
2828
```tf
2929
resource "cloudflare_zero_trust_device_custom_profile" "exclude_example" {
3030
account_id = var.cloudflare_account_id
31-
name = "Device profile in Split Tunnels Exclude mode"
31+
name = "Custom profile in Split Tunnels Exclude mode"
3232
enabled = true
3333
precedence = 101
3434
service_mode_v2 = {mode = "warp"}
@@ -48,7 +48,7 @@ import { Tabs, TabItem } from '~/components';
4848
```tf
4949
resource "cloudflare_zero_trust_device_custom_profile" "include_example" {
5050
account_id = var.cloudflare_account_id
51-
name = "Device profile in Split Tunnels Include mode"
51+
name = "Custom profile in Split Tunnels Include mode"
5252
enabled = true
5353
precedence = 101
5454
service_mode_v2 = {mode = "warp"}

0 commit comments

Comments
 (0)