Skip to content

Commit 22b4647

Browse files
ranbelranbel
authored
[ZT] Terraform split tunnels (#22277)
* split tunnel mode * add split tunnel route
1 parent e3a01d3 commit 22b4647

File tree

3 files changed

+163
-2
lines changed

3 files changed

+163
-2
lines changed

‎src/content/partials/cloudflare-one/warp/add-split-tunnels-route.mdx‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
import { GlossaryTooltip, TabItem, Tabs, Render } from "~/components";
66

7+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
8+
79
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**.
810
2. Under **Device settings**, locate the [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) you would like to modify and select **Configure**.
911
3. Under **Split Tunnels**, check whether your [Split Tunnels mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include**.
@@ -33,6 +35,107 @@ import { GlossaryTooltip, TabItem, Tabs, Render } from "~/components";
3335

3436
</TabItem> </Tabs>
3537

38+
</TabItem> <TabItem label="Terraform (v5)">
39+
40+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
41+
- `Zero Trust Write`
42+
43+
2. Choose a [`cloudflare_zero_trust_device_default_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_default_profile) or [`cloudflare_zero_trust_device_custom_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_custom_profile) resource to modify, or [create a new device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#create-a-new-profile).
44+
45+
3. (Optional) Create a list of split tunnel routes that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles:
46+
47+
```tf title="split-tunnels.local.tf"
48+
locals {
49+
global_exclude_list = [
50+
# Default Split Tunnel entries recommended by Cloudflare
51+
{
52+
address = "ff05::/16"
53+
},
54+
{
55+
address = "ff04::/16"
56+
},
57+
{
58+
address = "ff03::/16"
59+
},
60+
{
61+
address = "ff02::/16"
62+
},
63+
{
64+
address = "ff01::/16"
65+
},
66+
{
67+
address = "fe80::/10"
68+
description = "IPv6 Link Local"
69+
},
70+
{
71+
address = "fd00::/8"
72+
},
73+
{
74+
address = "255.255.255.255/32"
75+
description = "DHCP Broadcast"
76+
},
77+
{
78+
address = "240.0.0.0/4"
79+
},
80+
{
81+
address = "224.0.0.0/24"
82+
},
83+
{
84+
address = "192.168.0.0/16"
85+
},
86+
{
87+
address = "192.0.0.0/24"
88+
},
89+
{
90+
address = "172.16.0.0/12"
91+
},
92+
{
93+
address = "169.254.0.0/16"
94+
description = "DHCP Unspecified"
95+
},
96+
{
97+
address = "100.64.0.0/10"
98+
},
99+
{
100+
address = "10.0.0.0/8"
101+
}
102+
]
103+
}
104+
```
105+
4. In the device profile, exclude or include routes based on either their IP address or domain:
106+
107+
```tf title="device-profiles.tf"
108+
resource "cloudflare_zero_trust_device_custom_profile" "example" {
109+
account_id = var.cloudflare_account_id
110+
name = "Example custom profile with split tunnels"
111+
enabled = true
112+
precedence = 101
113+
service_mode_v2 = {mode = "warp"}
114+
match = "identity.email == \"[email protected]\""
115+
116+
exclude = concat(
117+
# Global entries
118+
local.global_exclude_list,
119+
120+
# Profile-specific entries
121+
[
122+
{
123+
address = "192.0.2.0/24"
124+
description = "Example IP to exclude from WARP"
125+
},
126+
{
127+
host = "example.com"
128+
description = "Example domain to exclude from WARP"
129+
}
130+
]
131+
)
132+
}
133+
```
134+
When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to [Domain-based Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels).
135+
136+
</TabItem>
137+
</Tabs>
138+
36139
<Render file="warp/client-notification-lag" product="cloudflare-one" />
37140

38141
We recommend keeping the Split Tunnels list short, as each entry takes time for the client to parse. In particular, domains are slower to action than IP addresses because they require on-the-fly IP lookups and routing table / local firewall changes. A shorter list will also make it easier to understand and debug your configuration. For information on device profile limits, refer to [Account limits](/cloudflare-one/account-limits/#warp).

‎src/content/partials/cloudflare-one/warp/change-split-tunnels-mode.mdx‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22
{}
33
---
44

5+
import { Tabs, TabItem } from '~/components';
6+
7+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
8+
59
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**.
610
2. Under **Device settings**, locate the [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) you would like to modify and select **Configure**.
711
3. Scroll down to **Split Tunnels**.
@@ -10,4 +14,56 @@
1014
- **Exclude IPs and domains** — (Default) All traffic will be sent to Cloudflare Gateway except for the IPs and domains you specify.
1115
- **Include IPs and Domains** — Only traffic destined to the IPs or domains you specify will be sent to Cloudflare Gateway. All other traffic will bypass Gateway and will no longer be filtered by your network or HTTP policies. In order to use certain features, you will need to manually add [Zero Trust domains](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains).
1216

17+
</TabItem> <TabItem label="Terraform (v5)">
18+
19+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
20+
- `Zero Trust Write`
21+
22+
2. Choose a [`cloudflare_zero_trust_device_default_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_default_profile) or [`cloudflare_zero_trust_device_custom_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_custom_profile) resource to modify, or [create a new device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#create-a-new-profile).
23+
24+
3. In your device profile, configure either the `exclude` or `include` argument. You cannot set both `exclude` and `include` in a given device profile.
25+
26+
a. To manage Split Tunnel routes in **Exclude** mode, use the `exclude` argument:
27+
28+
```tf
29+
resource "cloudflare_zero_trust_device_custom_profile" "exclude_example" {
30+
account_id = var.cloudflare_account_id
31+
name = "Custom profile in Split Tunnels Exclude mode"
32+
enabled = true
33+
precedence = 101
34+
service_mode_v2 = {mode = "warp"}
35+
match = "identity.email == \"[email protected]\""
36+
37+
exclude = [{
38+
address = "10.0.0.0/8"
39+
description = "Example route to exclude from WARP tunnel"
40+
}]
41+
}
42+
```
43+
44+
In this example, all traffic will be sent to Cloudflare Gateway except for traffic destined to `10.0.0.0/8`. To exclude the default IPs and domains recommended by Cloudflare, refer to [Add a route](#add-a-route).
45+
46+
b. To manage Split Tunnel routes in **Include** mode, use the `include` argument:
47+
48+
```tf
49+
resource "cloudflare_zero_trust_device_custom_profile" "include_example" {
50+
account_id = var.cloudflare_account_id
51+
name = "Custom profile in Split Tunnels Include mode"
52+
enabled = true
53+
precedence = 101
54+
service_mode_v2 = {mode = "warp"}
55+
match = "identity.email == \"[email protected]\""
56+
57+
include = [{
58+
address = "10.0.0.0/8"
59+
description = "Example route to include in WARP tunnel"
60+
}]
61+
}
62+
```
63+
64+
In this example, only traffic destined to `10.0.0.0/8` will be sent to Cloudflare Gateway.
65+
66+
</TabItem>
67+
</Tabs>
68+
1369
All clients with this device profile will now switch to the new mode and its default route configuration. Next, [add](#add-a-route) or [remove](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) routes from your Split Tunnel configuration.

‎src/content/partials/learning-paths/zero-trust/split-tunnel-settings.mdx‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
---
55

6-
import { Render } from "~/components"
6+
import { Render} from "~/components"
77

88
Split tunnel settings determine which traffic WARP does and does not proxy.
99

@@ -14,7 +14,9 @@ WARP offers two different split tunnel modes:
1414

1515
## Update Split Tunnels mode
1616

17-
To change your Split Tunnels mode: <Render file="warp/change-split-tunnels-mode" product="cloudflare-one" />
17+
To change your Split Tunnels mode:
18+
19+
<Render file="warp/change-split-tunnels-mode" product="cloudflare-one" />
1820

1921
## Add a route
2022

0 commit comments

Comments
 (0)