Skip to content

Commit 4e67b00

Browse files
ranbelranbel
committed
FRH IPs
1 parent 6983678 commit 4e67b00

File tree

4 files changed

+61
-49
lines changed

4 files changed

+61
-49
lines changed

‎src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/firewall.mdx‎

Lines changed: 57 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -5,54 +5,69 @@ sidebar:
55
order: 9
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, Details } from "~/components";
99

1010
If your organization uses a firewall or other policies to restrict or intercept Internet traffic, you may need to exempt the following IP addresses and domains to allow the WARP client to connect.
1111

1212
## Client orchestration API
1313

14-
The WARP client connects to Cloudflare via a standard HTTPS connection outside the tunnel for operations like registration or settings changes. To perform these operations, you must allow `zero-trust-client.cloudflareclient.com` which will lookup the following IP addresses:
14+
The WARP client connects to Cloudflare via a standard HTTPS connection outside the tunnel for operations like registration or settings changes. To perform these operations, you must allow the following IPs and domains:
1515

1616
<Render file="warp/client-orchestration-ips" product="cloudflare-one" />
1717

18-
<Render
19-
file="warp/firewall"
20-
product="cloudflare-one"
21-
params={{
22-
domain: "zero-trust-client.cloudflareclient.com",
23-
}}
24-
/>
18+
Even though `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` may resolve to different IP addresses, WARP overrides the resolved IPs with the IPs listed above. To avoid connectivity issues, ensure that the above IPs are permitted through your firewall.
19+
20+
<Details header="FedRAMP High requirements">
21+
22+
To deploy WARP in FedRAMP High environments, you will need to allow a different set of IPs and domains through your firewall:
23+
24+
- IPv4 API endpoints: `162.159.213.1` and `172.64.98.1`
25+
- IPv6 API endpoints: `2606:54c1:11::` and `2a06:98c1:4b::`
26+
- SNIs: `api.devices.fed.cloudflare.com` and `notifications.devices.fed.cloudflare.com`
27+
28+
</Details>
2529

2630
## DoH IP
2731

2832
:::note
2933
Only required for [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode.
3034
:::
3135

32-
In [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode, the WARP client sends DNS requests to Gateway over an HTTPS connection. For DNS to work correctly, you must allow `<ACCOUNT_ID>.cloudflare-gateway.com` which will lookup the following IPs:
36+
In [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode, the WARP client sends DNS requests to Gateway over an HTTPS connection. For DNS to work correctly, you must allow the following IPs and domains:
37+
38+
- IPv4 DoH addresses: `162.159.36.1` and `162.159.46.1`
39+
- IPv6 DoH addresses: `2606:4700:4700::1111` and `2606:4700:4700::1001`
40+
- SNIs: `<ACCOUNT_ID>.cloudflare-gateway.com`
41+
42+
Even though `<ACCOUNT_ID>.cloudflare-gateway.com` may resolve to different IP addresses, WARP overrides the resolved IPs with the IPs listed above. To avoid connectivity issues, ensure that the above IPs are permitted through your firewall.
3343

34-
- IPv4 DoH Addresses: `162.159.36.1` and `162.159.46.1`
35-
- IPv6 DoH Addresses: `2606:4700:4700::1111` and `2606:4700:4700::1001`
44+
<Details header="FedRAMP High requirements">
45+
To deploy WARP in FedRAMP High environments, you will need to allow a different set of IPs and domains through your firewall:
3646

37-
<Render
38-
file="warp/firewall"
39-
product="cloudflare-one"
40-
params={{
41-
domain: "<ACCOUNT_ID>.cloudflare-gateway.com",
42-
}}
43-
/>
47+
- IPv4 DoH addresses: `172.64.100.3` and `172.64.101.3`
48+
- IPv6 DoH addresses: `2606:54c1:13::2`
49+
- SNIs: `<ACCOUNT_ID>.fed.cloudflare-gateway.com`
50+
</Details>
4451

4552
### Android devices
4653

4754
If you are deploying the Cloudflare One Agent on Android/ChromeOS, you must also add `cloudflare-dns.com` to your firewall exception list. On Android/ChromeOS devices, WARP uses `cloudflare-dns.com` to resolve domains on your [Split Tunnel list](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels).
4855

4956
## Client authentication endpoint
5057

51-
When you [log in to your Zero Trust organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/), you will have to complete the authentication steps required by your organization in the browser window that opens. To perform these operations, you must allow the following domains:
58+
When you [log in to your Cloudflare One organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/), you will have to complete the authentication steps required by your organization in the browser window that opens. To perform these operations, you must allow the following domains:
5259

53-
- The IdP used to authenticate to Cloudflare Zero Trust
60+
- The IdP used to authenticate to Cloudflare One
5461
- `<your-team-name>.cloudflareaccess.com`
5562

63+
<Details header="FedRAMP High requirements">
64+
To deploy WARP in FedRAMP High environments, you will need to allow different domains through your firewall:
65+
66+
- FedRAMP High IdP used to authenticate to Cloudflare One
67+
- `<your-team-name>.fed.cloudflareaccess.com`.
68+
69+
</Details>
70+
5671
## WARP ingress IP
5772

5873
WARP connects to the following IP addresses, depending on which [tunnel protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol) is configured for your device (WireGuard or MASQUE). All network traffic from your device to Cloudflare goes through these IPs and ports over UDP.
@@ -79,9 +94,24 @@ WARP connects to the following IP addresses, depending on which [tunnel protocol
7994

8095
:::note
8196

82-
Before you [log in to your Zero Trust organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/), you may see the IPv4 range `162.159.192.0/24`. This IP is used for consumer WARP services ([1.1.1.1 w/ WARP](/warp-client/)) and is not required for Zero Trust deployments.
97+
Before you [log in to your Cloudflare One organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/), you may see the IPv4 range `162.159.192.0/24`. This IP is used for consumer WARP ([1.1.1.1 w/ WARP](/warp-client/)) and is not required for Zero Trust services.
8398
:::
8499

100+
<Details header="FedRAMP High requirements">
101+
102+
Devices will use the MASQUE protocol in FedRAMP High environments. To deploy WARP for FedRAMP High, you will need to allow the following IPs and ports:
103+
104+
| | |
105+
| -------------- | ------------------------------------------------------------------------------------------------------------------- |
106+
| IPv4 address | `162.159.239.0/24` |
107+
| IPv6 address | `2606:4700:105::/48` |
108+
| Default port | `UDP 443` |
109+
| Fallback ports | `UDP 500` <br/> `UDP 1701` <br/> `UDP 4500` <br/> `UDP 4443` <br/> `UDP 8443` <br/> `UDP 8095` <br/> `TCP 443` [^1] |
110+
111+
[^1]: Required for HTTP/2 fallback
112+
113+
</Details>
114+
85115
## Captive portal
86116

87117
The following domains are used as part of our captive portal check:
@@ -101,34 +131,21 @@ As part of establishing the WARP connection, the client runs connectivity checks
101131

102132
The client connects to the following destinations to verify general Internet connectivity outside of the WARP tunnel. Make sure that these IPs and domains are on your firewall allowlist.
103133

104-
- `engage.cloudflareclient.com`: The client will always send requests directly to an IP in the [WARP ingress IPv4 or IPv6 range](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip) (or to your [`override_warp_endpoint`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint) if set). Requests will not use a proxy server, even if one is configured for the system.
105134
- `162.159.197.3`
106135
- `2606:4700:102::3`
136+
- `engage.cloudflareclient.com`: The client will always send requests directly to an IP in the [WARP ingress IPv4 or IPv6 range](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip) (or to your [`override_warp_endpoint`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint) if set). Requests will not use a proxy server, even if one is configured for the system.
107137

108-
<Render
109-
file="warp/firewall"
110-
product="cloudflare-one"
111-
params={{
112-
domain: "engage.cloudflareclient.com",
113-
}}
114-
/>
138+
Even though `engage.cloudflareclient.com` may resolve to different IP addresses, WARP overrides the resolved IPs with the IPs listed above. To avoid connectivity issues, ensure that the above IPs are permitted through your firewall.
115139

116140
### Inside tunnel
117141

118-
The WARP client connects to the following IPs to verify connectivity inside of the WARP tunnel:
142+
The WARP client connects to the following destinations to verify connectivity inside of the WARP tunnel:
119143

120144
- `162.159.197.4`
121145
- `2606:4700:102::4`
146+
- `connectivity.cloudflareclient.com`
122147

123-
Because this check happens inside of the tunnel, you do not need to add these IPs to your firewall allowlist. However, since the requests go through Gateway, ensure that they are not blocked by a Gateway HTTP or Network policy.
124-
125-
<Render
126-
file="warp/firewall"
127-
product="cloudflare-one"
128-
params={{
129-
domain: "connectivity.cloudflareclient.com",
130-
}}
131-
/>
148+
Because this check happens inside of the tunnel, you do not need to add these IPs and domains to your firewall allowlist. However, since the requests go through Gateway, ensure that they are not blocked by a Gateway HTTP or Network policy.
132149

133150
## NEL reporting (optional)
134151

‎src/content/partials/cloudflare-one/warp/client-orchestration-ips.mdx‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@
33

44
---
55

6-
* IPv4 API Endpoints: `162.159.137.105` and `162.159.138.105`
7-
* IPv6 API Endpoints: `2606:4700:7::a29f:8969` and `2606:4700:7::a29f:8a69`
6+
- IPv4 API endpoints: `162.159.137.105` and `162.159.138.105`
7+
- IPv6 API endpoints: `2606:4700:7::a29f:8969` and `2606:4700:7::a29f:8a69`
8+
- SNIs: `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com`

‎src/content/partials/cloudflare-one/warp/firewall.mdx‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎src/content/partials/learning-paths/zero-trust/install-agent.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Most admins test by manually downloading the WARP client and enrolling in your o
1010
## Install WARP
1111

1212
1. First, uninstall any existing third-party VPN software if possible. Sometimes products placed in a disconnected or disabled state will still interfere with the WARP client.
13-
2. If you are running third-party firewall or TLS decryption software, verify that it does not inspect or block traffic to the WARP client orchestration IPs:
13+
2. If you are running third-party firewall or TLS decryption software, verify that it does not inspect or block traffic to the following destinations:
1414
<Render file="warp/client-orchestration-ips" product="cloudflare-one" />
1515

1616
For more information, refer to [WARP with firewall](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/).

0 commit comments

Comments
 (0)