Skip to content

Commit 21ab9c9

Browse files
maxvpthomasgauvin
maxvp
authored and
thomasgauvin
committed
Create flowchart partial (#23442)
1 parent b135e10 commit 21ab9c9

File tree

3 files changed

+61
-69
lines changed

3 files changed

+61
-69
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/proxy.mdx‎

Lines changed: 36 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 12
66
---
77

8-
import { Badge, Tabs, TabItem } from "~/components";
8+
import { Badge, Tabs, TabItem, Render } from "~/components";
99

1010
You can forward [HTTP](/cloudflare-one/policies/gateway/initial-setup/http/) and [network](/cloudflare-one/policies/gateway/initial-setup/network/) traffic to Gateway for logging and filtering. Gateway can proxy both outbound traffic and traffic directed to resources connected via a Cloudflare Tunnel, GRE tunnel, or IPsec tunnel. When a user connects to the Gateway proxy, Gateway will accept the connection and establish a new, separate connection to the origin server.
1111

@@ -21,26 +21,7 @@ Gateway uses the [Happy Eyeballs algorithm](https://datatracker.ietf.org/doc/htm
2121
4. Gateway inspects and filters traffic received from the user.
2222
5. If the traffic passes inspection, Gateway proxies traffic bidirectionally between the user and the origin server.
2323

24-
```mermaid
25-
flowchart TD
26-
%% Accessibility
27-
accTitle: How Gateway proxy works
28-
accDescr: Flowchart describing how the Gateway proxy uses the Happy Eyeballs algorithm to establish TCP connections and proxy user traffic.
29-
30-
%% Flowchart
31-
A[User's device sends TCP SYN to Gateway] --> B[Gateway sends TCP SYN to origin server]
32-
B --> C{{Origin server responds with TCP SYN-ACK?}}
33-
C -->|Yes| E[TCP handshakes completed]
34-
C -->|No| D[Connection fails]
35-
E --> F{{Connection allowed?}}
36-
F -->|Yes| G[Gateway proxies traffic bidirectionally]
37-
F -->|No| H[Connection blocked by firewall policies]
38-
39-
%% Styling
40-
style D stroke:#D50000
41-
style G stroke:#00C853
42-
style H stroke:#D50000
43-
```
24+
<Render file="gateway/tcp-flowchart" product="cloudflare-one" />
4425

4526
## Supported protocols
4627

@@ -72,55 +53,55 @@ To use the ICMP proxy with Cloudflare Tunnel, you may need to configure the `clo
7253

7354
<Tabs> <TabItem label="Linux" icon="linux">
7455

75-
1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`:
56+
1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`:
7657

77-
a. Find the user that owns the `cloudflared` process:
58+
a. Find the user that owns the `cloudflared` process:
7859

79-
```sh
80-
ps -aux | grep cloudflared
81-
```
60+
```sh
61+
ps -aux | grep cloudflared
62+
```
8263

83-
```sh output
84-
johndoe 407 0.8 1.7 1259904 35296 ? Ssl 21:02 0:00 /usr/bin/cloudflared --no-autoupdate tunnel run --token eyJhI...
85-
```
64+
```sh output
65+
johndoe 407 0.8 1.7 1259904 35296 ? Ssl 21:02 0:00 /usr/bin/cloudflared --no-autoupdate tunnel run --token eyJhI...
66+
```
8667

87-
b. Get the Group ID of the `cloudflared` user:
68+
b. Get the Group ID of the `cloudflared` user:
8869

89-
```sh
90-
id -g johndoe
91-
```
70+
```sh
71+
id -g johndoe
72+
```
9273

93-
```sh output
94-
10001
95-
```
74+
```sh output
75+
10001
76+
```
9677

97-
c. Determine the Group IDs that are allowed to use ICMP:
78+
c. Determine the Group IDs that are allowed to use ICMP:
9879

99-
```sh
100-
sudo sysctl net.ipv4.ping_group_range
101-
```
80+
```sh
81+
sudo sysctl net.ipv4.ping_group_range
82+
```
10283

103-
```sh output
104-
net.ipv4.ping_group_range= 0 10000
105-
```
84+
```sh output
85+
net.ipv4.ping_group_range= 0 10000
86+
```
10687

107-
d. Either add the user to a group within that range, or update the range to encompass a group the user is already in. To update `ping_group_range`:
88+
d. Either add the user to a group within that range, or update the range to encompass a group the user is already in. To update `ping_group_range`:
10889

109-
```sh
110-
echo 0 10001 | sudo tee /proc/sys/net/ipv4/ping_group_range
111-
```
90+
```sh
91+
echo 0 10001 | sudo tee /proc/sys/net/ipv4/ping_group_range
92+
```
11293

113-
e. To make the change persist on reboot, update your `systcl` parameters:
94+
e. To make the change persist on reboot, update your `systcl` parameters:
11495

115-
```sh
116-
echo "net.ipv4.ping_group_range = 0 10001" | sudo tee -a /etc/sysctl.d/99-cloudflared.conf
117-
```
96+
```sh
97+
echo "net.ipv4.ping_group_range = 0 10001" | sudo tee -a /etc/sysctl.d/99-cloudflared.conf
98+
```
11899

119-
2. If you are running multiple network interfaces (for example, `eth0` and `eth1`), configure `cloudflared` to use the external Internet-facing interface:
100+
2. If you are running multiple network interfaces (for example, `eth0` and `eth1`), configure `cloudflared` to use the external Internet-facing interface:
120101

121-
```sh
122-
cloudflared tunnel run --icmpv4-src <IP of primary interface>
123-
```
102+
```sh
103+
cloudflared tunnel run --icmpv4-src <IP of primary interface>
104+
```
124105

125106
</TabItem> <TabItem label="Docker" icon="seti:docker">
126107

‎src/content/partials/cloudflare-one/gateway/order-of-enforcement.mdx‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -141,20 +141,7 @@ When a user connects to a server with Gateway, Gateway first establishes a TCP c
141141

142142
If the TCP connection to the destination server is successful, Gateway will apply policies. If Gateway policies allow the connection, Gateway will connect the user to the destination server. If Gateway policies block the connection, Gateway will end the connection and will not send any data between the user and the destination server. If the TCP connection to the destination server is unsuccessful, Gateway will not run any policies and retry TCP connections from the user to the server.
143143

144-
```mermaid
145-
flowchart TB
146-
A(["User"]) -- Initiates connection --> B["Gateway TCP connection to destination server"]
147-
B -- Connection success --> C["Gateway applies policies"]
148-
B -- Connection failure --> E["Gateway rejects user TCP connections"]
149-
C -- Allow policies --> D["Gateway connects user to destination server"]
150-
C -- Block policies --> F["Gateway ends connection and sends no data"]
151-
152-
B@{ shape: hex}
153-
C@{ shape: hex}
154-
style E stroke:#D50000
155-
style D stroke:#00C853
156-
style F stroke:#D50000
157-
```
144+
<Render file="gateway/tcp-flowchart" product="cloudflare-one" />
158145

159146
Connections to Zero Trust will always appear in your [Zero Trust network session logs](/logs/reference/log-fields/account/zero_trust_network_sessions/) regardless of connection success. Because Gateway does not inspect failed connections, they will not appear in your [Gateway activity logs](/cloudflare-one/insights/logs/gateway-logs/).
160147

‎src/content/partials/cloudflare-one/gateway/tcp-flowchart.mdx‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
{}
3+
---
4+
5+
```mermaid
6+
flowchart TD
7+
%% Accessibility
8+
accTitle: How Gateway proxy works
9+
accDescr: Flowchart describing how the Gateway proxy uses the Happy Eyeballs algorithm to establish TCP connections and proxy user traffic.
10+
11+
%% Flowchart
12+
A[User's device sends TCP SYN to Gateway] --> B[Gateway sends TCP SYN to origin server]
13+
B --> C{{Origin server responds with TCP SYN-ACK?}}
14+
C -->|Yes| E[TCP handshakes completed]
15+
C -->|No| D[Connection fails]
16+
E --> F{{Connection allowed?}}
17+
F -->|Allow policy| G[Gateway proxies traffic bidirectionally]
18+
F -->|Block policy| H[Connection blocked by firewall policies]
19+
20+
%% Styling
21+
style D stroke:#D50000
22+
style G stroke:#00C853
23+
style H stroke:#D50000
24+
```

0 commit comments

Comments
 (0)