Skip to content

Commit 41961ee

Browse files
ranbelranbel
committed
outline steps
1 parent 8c3e2cf commit 41961ee

File tree

2 files changed

+93
-13
lines changed

2 files changed

+93
-13
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname.mdx‎

Lines changed: 80 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,14 @@ sidebar:
55
order: 2
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, Details } from "~/components";
99

1010
`cloudflared` can route to non-HTTP applications on your private network using their private hostname (for example, `wiki.internal.local`). Private hostname routes are especially useful when the application has an unknown or ephemeral IP, which often occurs when infrastructure is provisioned by a third-party cloud provider.
1111

1212
:::note[Availability]
1313
Hostname routes currently require Gateway resolver policies, an Enterprise-only feature. If you are on a Free or Pay-as-you-go plan, you will need to connect the application using its [IP address](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr) and [configure Local Domain Fallback](/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns/) to resolve its private hostname.
1414
:::
1515

16-
## Limitations
17-
18-
### Supported user traffic
19-
20-
### Supported network on-ramps
21-
2216
## How private hostname routing works
2317

2418
Private hostname routing with Cloudflare Tunnel consists of three main components:
@@ -27,7 +21,7 @@ Private hostname routing with Cloudflare Tunnel consists of three main component
2721
- Gateway resolver policies instruct Gateway to resolve the private hostname using your internal DNS resolver instead of the default public resolver.
2822
- `cloudflared` installs on a host machine in your private network and proxies traffic from Cloudflare to your internal DNS resolver and internal applications.
2923

30-
Figures 1 and 2 illustrate what happens when a user connects to a private hostname (`wiki.internal.local`) from a WARP device.
24+
Figures 1 and 2 illustrate the flow of DNS and network traffic when a user connects to a private hostname (`wiki.internal.local`):
3125

3226
![Figure 1: DNS resolution for a private hostname](~/assets/images/cloudflare-one/connections/private-hostname-route-1.png "Figure 1: DNS resolution for private hostname")
3327

@@ -36,14 +30,88 @@ Figures 1 and 2 illustrate what happens when a user connects to a private hostna
3630
3. `cloudflared` does a DNS lookup to figure out what the origin IP is for `wiki.internal.local`.
3731
4. The Gateway resolver now knows that the origin IP is `10.0.0.5`.
3832
5. Rather than responding to the DNS query with the actual origin IP, Gateway responds with a random IP address from the CGNAT range `100.80.0.0/16` (for example, `100.80.0.1`). This CGNAT IP is called the initial resolved IP.
39-
6. Gateway stores the mapping between the private hostname, CGNAT initial resolved IP, and the actual IP.
33+
6. Gateway's network engine stores the mapping between the private hostname, initial resolved IP, and the actual IP.
4034
7. The WARP client receives the initial resolved IP (`100.80.0.1`) in the DNS response for `wiki.internal.local`.
4135

42-
As shown in Figure 2 below, the WARP client will now send `wiki.internal.local` traffic to the initial resolved IP through Gateway. Because the destination IP falls within the designated CGNAT range, Gateway knows how it maps to the actual origin IP. Traffic that passes your network policies will now route through Cloudflare Tunnel to the private application.
36+
As shown in Figure 2 below, the WARP client will now send `wiki.internal.local` traffic to the initial resolved IP. The initial resolved IP mechanism is required because Gateway's network engine operates at L3/L4 and can only see IPs (not hostnames) when processing the connection. Because the packet's destination IP falls within the designated CGNAT range, Gateway knows that it corresponds to a hostname route and can apply hostname-based policies. Traffic that passes your Gateway policies will route through Cloudflare Tunnel to the application's actual origin IP.
4337

4438
![Figure 2: Network traffic flow for a private hostname route](~/assets/images/cloudflare-one/connections/private-hostname-route-2.png "Figure 1: Network traffic flow for a private hostname route")
4539

46-
To learn more about the initial resolved IP mechanism, refer to the [Cloudflare blog]().
40+
To learn more about hostname routing, refer to the [Cloudflare blog]().
41+
42+
## Connect to a private hostname
43+
44+
This section covers how to enable remote access to a private hostname application using `cloudflared` and WARP.
45+
46+
### 1. Connect the server to Cloudflare
47+
48+
### 2. Set up the client
49+
50+
<Details header="Feature availability">
51+
52+
| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
53+
| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
54+
| Gateway with WARP | Enterprise |
55+
56+
| System | Availability | Minimum WARP version |
57+
| -------- | ------------ | -------------------- |
58+
| Windows | ✅ | 2025.4.929.0 |
59+
| macOS | ✅ | 2025.4.929.0 |
60+
| Linux | ✅ | 2025.4.929.0 |
61+
| iOS | ❌ | |
62+
| Android | ❌ | |
63+
| ChromeOS | ❌ | |
64+
65+
</Details>
66+
67+
68+
### 3. Route private network IPs through WARP
69+
70+
- Initial resolved IP CGNAT range: `100.80.0.0/16`
71+
- Private network CIDR where the application is located, e.g. `10.0.0.0/8`. (Still need to know the IP range of the network. Do not need to know the specific IP of the application)
72+
- Internal DNS resolver IP
73+
74+
### 4. Create a resolver policy
75+
76+
### 5. (Recommended) Filter network traffic with Gateway
77+
78+
#### Enable Gateway proxy for TCP and UDP
79+
#### Zero Trust policies
80+
81+
If you're running a private app on port 443:
82+
83+
Option 1: create an Access self-hosted private app https://developers.cloudflare.com/cloudflare-one/applications/non-http/self-hosted-private-app/
84+
85+
Option 2: create a Gateway network policy using the SNI selector https://developers.cloudflare.com/cloudflare-one/policies/gateway/network-policies/#sni
86+
87+
Self-hosted private apps and Gateway network policies are not currently supported for services on non-443 ports. You can only create a Gateway DNS policy.
88+
89+
90+
### 6. Connect as a user
91+
92+
93+
94+
## Supported on-ramps/off-ramps
95+
96+
### Device connectivity
97+
98+
End users can connect to private hostnames from the following device on-ramps:
99+
100+
| On-ramp method | Compatibility |
101+
| ------------------------------------------------------------------------------------------ | ------------- |
102+
| [WARP client](/cloudflare-one/connections/connect-devices/warp/) | ✅ |
103+
| [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/) | ✅ |
104+
| [Browser Isolation](/cloudflare-one/policies/browser-isolation/) | ✅ |
105+
| [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) | ❌ |
106+
| [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) | ❌ |
107+
108+
### Private network connectivity
47109

48-
## Configure a private hostname route
110+
To route to private applications using hostnames instead of IPs, connect your infrastructure to Cloudflare using a supported traffic off-ramp:
49111

112+
| Connector | Compatibility |
113+
| ------------------------------------------------------------------------------------------ | ------------- |
114+
| [cloudflared](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) | ✅ |
115+
| [WARP-to-WARP](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/) | ❌ |
116+
| [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) | ❌ |
117+
| [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) | ❌ |

‎src/content/docs/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared.mdx‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,16 @@ For example, assume that your organization's banking service, `app.bank.com`, ex
2828

2929
## Prerequisites
3030

31-
## Configure a public hostname route
31+
## 1. Connect private network to Cloudflare
32+
33+
## 2. Add a public hostname route
34+
35+
## 3. Route private network IPs through WARP
36+
37+
## 4. (Optional) Filter network traffic with Gateway
38+
39+
## 5. Create an egress policy
40+
41+
Create an egress policy that points traffic to Cloudflare Tunnel.
42+
43+
## 6. Test the connection

0 commit comments

Comments
 (0)