Skip to content

Commit 2c751e9

Browse files
maxvphyperlint-ai[bot]pedrosousa
authored
[ZT] Add resolver policies to Route traffic (#18193)
Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> Co-authored-by: Pedro Sousa <[email protected]>
1 parent 0346a85 commit 2c751e9

File tree

4 files changed

+62
-84
lines changed

4 files changed

+62
-84
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/index.mdx‎

Lines changed: 37 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,49 +3,51 @@ pcx_content_type: concept
33
title: Route traffic
44
sidebar:
55
order: 6
6-
76
---
87

9-
When the WARP client is deployed on a device, Cloudflare processes all DNS requests and network traffic by default. However, under certain circumstances, you may need to exclude specific DNS requests or network traffic from WARP.
10-
11-
There are three settings you can configure:
12-
13-
* **Use [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/)** to instruct the WARP client to proxy DNS requests for a specified domain to a resolver that is not Cloudflare Gateway. This is useful when you have private hostnames that would not otherwise resolve on the public Internet.
14-
15-
:::caution
16-
17-
18-
DNS requests to domain names entered here will not be encrypted, monitored or subject to DNS policies by Cloudflare Gateway.
19-
20-
21-
:::
22-
23-
* **Use the [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude mode** to instruct the WARP client to ignore traffic to a specified set of IP addresses or domains. Any traffic that is destined to an IP address or domain defined in the Split Tunnels Exclude configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you want the majority of your traffic encrypted and processed by Gateway, but need to exclude certain routes due to app compatibility, or if you need WARP to run alongside a VPN.
24-
25-
* **Use the [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Include mode** mode to instruct the WARP client to only handle traffic to a specified set of IP addresses or domains. Any traffic that is not included by IP address or domains defined in the Split Tunnel Include configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you only want specific traffic processed by Gateway, such as when using Tunnels for a specific resource.
26-
27-
:::caution
28-
29-
30-
Traffic excluded from WARP by Split Tunnel configuration will not be encrypted, managed or monitored by Cloudflare Gateway.
8+
When the WARP client is deployed on a device, Cloudflare will process all DNS queries and network traffic by default. However, under certain circumstances, you may need to exclude specific DNS queries or network traffic from WARP. For example, you may need to resolve an internal hostname with a private DNS resolver instead of Cloudflare's [public DNS resolver](/1.1.1.1/).
319

10+
There are four options you can configure to exclude traffic from WARP:
3211

33-
:::
12+
- [Resolver policies](/cloudflare-one/policies/gateway/resolver-policies/): Use Gateway resolver policies to route DNS queries to custom resolvers based on matching traffic. Resolver policies are only available on Enterprise plans.
13+
- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/): Use Local Domain Fallback to instruct the WARP client to proxy DNS requests for a specified domain to a resolver that is not Cloudflare Gateway. This is useful when you have private hostnames that would not otherwise resolve on the public Internet.
14+
:::caution
15+
Gateway will not encrypt, monitor, or apply DNS policies to DNS queries to domain names entered in Local Domain Fallback.
16+
:::
17+
- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude mode: Use Exclude mode to instruct the WARP client to ignore traffic to a specified set of IP addresses or domains. Any traffic that is destined to an IP address or domain defined in the Split Tunnels Exclude configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you want the majority of your traffic encrypted and processed by Gateway, but need to exclude certain routes due to app compatibility, or if you need WARP to run alongside a VPN.
18+
- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Include mode: Use Include mode to instruct the WARP client to only handle traffic to a specified set of IP addresses or domains. Any traffic that is not included by an IP address or domain defined in the Split Tunnel Include configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you only want specific traffic processed by Gateway, such as when using Tunnels for a specific resource.
19+
:::caution
20+
Gateway will not encrypt, manage, or monitor traffic excluded from WARP by a Split Tunnel configuration.
21+
:::
3422

3523
## How the WARP client handles DNS requests
3624

37-
When you use the WARP client together with `cloudflared` Tunnels or third-party VPNs, Cloudflare evaluates each request and routes it according to the following traffic flow.
25+
When you use the WARP client together with `cloudflared` Tunnels or third-party VPNs, Cloudflare evaluates each request and routes it according to the following traffic flow:
3826

3927
```mermaid
4028
flowchart TD
41-
accTitle: WARP traffic is evaluated and routed through various parts of the Cloudflare network
42-
A[WARP User requests resource] -- Domain does not match Local Domain Fallback --> C{WARP client resolves query according to Gateway DNS policies}
43-
A -- Domain matches Local Domain Fallback --> D[WARP client proxies DNS traffic to specified fallback server]
44-
D -- Resolver IP included in Tunnel per Split Tunnel configuration --> E[Query sent via WARP Tunnel to be resolved]
45-
D -- Resolver IP not included in Tunnel per Split Tunnel configuration --> F{Query sent to resolver IP outside WARP Tunnel}
46-
E -- Matches CF Gateway block policy --> G{Traffic blocked by CF}
47-
E -- "Passes CF Gateway network policies (allowed or unblocked)" --> H[Evaluated by Cloudflare Tunnel routes]
48-
H -- Tunnel routes do not include resolver IP --> I{CF Gateway proxies query to resolver IP via normal WARP egress route}
49-
H -- Tunnel routes include resolver IP --> J[Cloudflare Tunnel advertises route that includes Resolver IP]
50-
J --> L{Private resolver returns IP address to WARP client}
29+
D["WARP client proxies DNS traffic to specified fallback server"] -- Resolver IP included in Tunnel per Split Tunnel configuration --> E["Query sent via WARP Tunnel to be resolved"]
30+
D -- Resolver IP not included in Tunnel per Split Tunnel configuration --> F["Query sent to resolver IP outside WARP Tunnel"]
31+
E -- Blocked by Gateway --> G["Traffic blocked by Cloudflare"]
32+
E -- Allowed by Gateway --> H["Evaluated by Cloudflare Tunnel routes"]
33+
H -- Tunnel routes do not include resolver IP --> I["Gateway proxies query to resolver IP via normal WARP egress route"]
34+
H -- Tunnel routes include resolver IP --> J["Cloudflare Tunnel advertises route that includes Resolver IP"]
35+
J --> L["Private resolver returns IP address to WARP client"]
36+
n1["Local Domain Fallback"] -- Matches domain --> C["WARP client resolves query according to Gateway policies"]
37+
n1 -- Does not match domain --> D
38+
A["WARP user requests resource"] --> n2["Gateway resolver policies"]
39+
n2 -- Does not match traffic --> n1
40+
n2 -- Matches traffic --> C
41+
42+
D@{ shape: rect}
43+
E@{ shape: hex}
44+
F@{ shape: terminal}
45+
G@{ shape: terminal}
46+
H@{ shape: hex}
47+
I@{ shape: terminal}
48+
L@{ shape: terminal}
49+
n1@{ shape: hex}
50+
C@{ shape: terminal}
51+
A@{ shape: in-out}
52+
n2@{ shape: proc}
5153
```

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels.mdx‎

Lines changed: 17 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,14 @@ pcx_content_type: how-to
33
title: Split Tunnels
44
sidebar:
55
order: 3
6-
76
---
87

9-
import { Render } from "~/components"
8+
import { Render } from "~/components";
109

1110
Split Tunnels can be configured to exclude or include IP addresses or domains from going through WARP. This feature is commonly used to run WARP alongside a VPN (in Exclude mode) or to provide access to a specific private network (in Include mode).
1211

1312
:::caution
14-
15-
1613
Split Tunnels only impacts the flow of IP traffic. DNS requests are still resolved by Gateway and subject to DNS policies unless you add the domains to your [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) configuration.
17-
18-
1914
:::
2015

2116
Because Split Tunnels controls what Gateway has visibility on at the network level, we recommend testing all changes before rolling out updates to end users. It may take up to 24 hours for changes to propagate to clients, depending on how many devices are connected to your organization.
@@ -32,45 +27,42 @@ Because Split Tunnels controls what Gateway has visibility on at the network lev
3227

3328
Use Split Tunnels when you need to bypass Gateway entirely for a site or allow traffic through the [firewall that WARP creates](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall). Common scenarios include:
3429

35-
* Connect to a third-party application which requires the actual IP address of the end-user device (for example, [Microsoft 365](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic)).
36-
* Optimize voice and video.
37-
* Connect to a [third-party VPN](/cloudflare-one/connections/connect-devices/warp/deployment/vpn/) endpoint.
30+
- Connect to a third-party application which requires the actual IP address of the end-user device (for example, [Microsoft 365](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic)).
31+
- Optimize voice and video.
32+
- Connect to a [third-party VPN](/cloudflare-one/connections/connect-devices/warp/deployment/vpn/) endpoint.
3833

3934
### When not to use Split Tunnels
4035

4136
Do not exclude a site from Split Tunnels if you want to see the traffic in your Gateway logs. In particular, we do not recommend using Split Tunnels to:
4237

43-
* Solve connectivity issues with a specific website. For configuration guidance, refer to our [troubleshooting guide](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#cannot-connect-to-a-specific-app-or-website).
44-
* Solve performance issues with a specific website. Since Cloudflare operates within 50 milliseconds of 95% of the Internet-connected population, it is usually faster to send traffic through us. If you are encountering a performance-related issue, it is best to first explore your Gateway policies or reach out to Support.
38+
- Solve connectivity issues with a specific website. For configuration guidance, refer to our [troubleshooting guide](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#cannot-connect-to-a-specific-app-or-website).
39+
- Solve performance issues with a specific website. Since Cloudflare operates within 50 milliseconds of 95% of the Internet-connected population, it is usually faster to send traffic through us. If you are encountering a performance-related issue, it is best to first explore your Gateway policies or reach out to Support.
4540

4641
## Cloudflare Zero Trust domains
4742

4843
Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/identity/devices/) and [WARP session durations](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add the following domains in order for these features to function:
4944

50-
* The IdP used to authenticate to Cloudflare Zero Trust
51-
* `<your-team-name>.cloudflareaccess.com`
52-
* The application protected by the Access or Gateway policy
53-
* `edge.browser.run` if using [Browser Isolation](/cloudflare-one/policies/browser-isolation/)
45+
- The IdP used to authenticate to Cloudflare Zero Trust
46+
- `<your-team-name>.cloudflareaccess.com`
47+
- The application protected by the Access or Gateway policy
48+
- `edge.browser.run` if using [Browser Isolation](/cloudflare-one/policies/browser-isolation/)
5449

5550
## Domain-based Split Tunnels
5651

5752
Domain-based split tunneling has a few ramifications you should be aware of before deploying in your organization:.
5853

59-
* Routes excluded or included from WARP and Gateway visibility may change day to day, and may be different for each user depending on where they are.
60-
* You may inadvertently exclude or include additional hostnames that happen to share an IP address. This commonly occurs if you add a domain hosted by a CDN or large Internet provider such as Cloudflare, AWS, or Azure. For example, if you wanted to exclude a VPN hosted on AWS, do not add `*.amazonaws.com` as that will open up your devices to all traffic on AWS. Instead, add the specific VPN endpoint (`*.cvpn-endpoint-<UUID>.prod.clientvpn.us-west-2.amazonaws.com`).
61-
* Most services are a collection of hostnames. Until Split Tunnels mode supports [App Types](/cloudflare-one/policies/gateway/application-app-types/), you will need to manually add all domains used by a particular app or service.
62-
* WARP must handle the DNS lookup request for the domain. If a DNS result has been previously cached by the operating system or otherwise intercepted (for example, via your browser's secure DNS settings), the IP address will not be dynamically added to your Split Tunnel.
54+
- Routes excluded or included from WARP and Gateway visibility may change day to day, and may be different for each user depending on where they are.
55+
- You may inadvertently exclude or include additional hostnames that happen to share an IP address. This commonly occurs if you add a domain hosted by a CDN or large Internet provider such as Cloudflare, AWS, or Azure. For example, if you wanted to exclude a VPN hosted on AWS, do not add `*.amazonaws.com` as that will open up your devices to all traffic on AWS. Instead, add the specific VPN endpoint (`*.cvpn-endpoint-<UUID>.prod.clientvpn.us-west-2.amazonaws.com`).
56+
- Most services are a collection of hostnames. Until Split Tunnels mode supports [App Types](/cloudflare-one/policies/gateway/application-app-types/), you will need to manually add all domains used by a particular app or service.
57+
- WARP must handle the DNS lookup request for the domain. If a DNS result has been previously cached by the operating system or otherwise intercepted (for example, via your browser's secure DNS settings), the IP address will not be dynamically added to your Split Tunnel.
6358

6459
### Valid domains
6560

66-
67-
6861
| Split tunnel domain | Matches | Does not match |
6962
| --------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------- |
7063
| `example.com` | exact match of `example.com` | subdomains such as `www.example.com` |
7164
| `example.example.com` | exact match of `example.example.com` | `example.com` or subdomains such as `www.example.example.com` |
7265
| `*.example.com` | subdomains such as `www.example.com` and `sub2.sub1.example.com` | `example.com` |
73-
| | | |
7466

7567
### Platform differences
7668

@@ -84,23 +76,18 @@ Clients on these platforms work by dynamically inserting the IP address of the d
8476

8577
Due to platform differences, mobile clients can only apply Split Tunnels rules when the tunnel is initially started. This means:
8678

87-
* Domain-based Split Tunnels rules are created when the tunnel is established based on the IP address for that domain at that time. The route is refreshed each time the tunnel is established.
88-
89-
* Wildcard domain prefixes (for example, `*.example.com`) are supported only if they have valid wildcard DNS records. Other wildcard domains are not supported because the client is unable to match wildcard domains to hostnames when starting up the tunnel. Unsupported wildcard domain prefixes can still exist in your configuration, but they will be ignored on mobile platforms.
79+
- Domain-based Split Tunnels rules are created when the tunnel is established based on the IP address for that domain at that time. The route is refreshed each time the tunnel is established.
80+
- Wildcard domain prefixes (for example, `*.example.com`) are supported only if they have valid wildcard DNS records. Other wildcard domains are not supported because the client is unable to match wildcard domains to hostnames when starting up the tunnel. Unsupported wildcard domain prefixes can still exist in your configuration, but they will be ignored on mobile platforms.
9081

9182
## Remove a route
9283

9384
:::caution
94-
95-
Removing default Split Tunnel entries may cause users to lose Internet connectivity or block their access to local resources.
85+
Removing default Split Tunnel entries may cause users to lose Internet connectivity or block their access to local resources.
9686
:::
9787

9888
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**.
99-
10089
2. Under **Device settings**, locate the [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) you would like to modify and select **Configure**.
101-
10290
3. Under **Split Tunnels**. select **Manage**.
103-
10491
4. Find the IP address or hostname in the list and select **Delete**.
10592

10693
If you need to revert to the default Split Tunnel entries recommended by Cloudflare, select **Restore default entries**.

0 commit comments

Comments
 (0)