Skip to content

Commit 51728a9

Browse files
ranbelranbel
committed
configure virtual networks
1 parent 18a0c3d commit 51728a9

File tree

2 files changed

+82
-12
lines changed

2 files changed

+82
-12
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import { TabItem, Tabs, Render } from "~/components";
99

1010
A remotely-managed tunnel only requires the tunnel token to run. Anyone with access to the token will be able to run the tunnel.
1111

12-
## View the tunnel token
12+
## Get the tunnel token
1313

1414
To get the token for a remotely-managed tunnel:
1515

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks.mdx‎

Lines changed: 81 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Here are a few scenarios where virtual networks may prove useful:
4646
The following example demonstrates how to add two overlapping IP routes to Cloudflare (`10.128.0.1/32` staging and `10.128.0.1/32` production).
4747

4848
<Tabs>
49-
<TabItem label="Dashboard">
49+
<TabItem label="Dashboard">
5050
To route overlapping IPs over virtual networks:
5151

5252
1. First, create two unique virtual networks:
@@ -67,10 +67,81 @@ The following example demonstrates how to add two overlapping IP routes to Cloud
6767

6868
We now have two overlapping IP addresses routed over `staging-vnet` and `production-vnet` respectively. You can use the Cloudflare WARP client to [switch between virtual networks](#connect-to-a-virtual-network).
6969

70-
</TabItem>
70+
</TabItem>
7171

72-
<TabItem label="cli">
73-
To route overlapping IPs over virtual networks:
72+
<TabItem label="Terraform (v5)">
73+
To route overlapping IPs over virtual networks:
74+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
75+
- `Cloudflare Tunnel Write`
76+
77+
2. Create two unique virtual networks:
78+
```tf
79+
resource "cloudflare_zero_trust_tunnel_cloudflared_virtual_network" "staging_vnet" {
80+
account_id = var.cloudflare_account_id
81+
name = "staging-vnet"
82+
comment = "Staging virtual network"
83+
is_default = false
84+
}
85+
86+
resource "cloudflare_zero_trust_tunnel_cloudflared_virtual_network" "production_vnet" {
87+
account_id = var.cloudflare_account_id
88+
name = "production-vnet"
89+
comment = "Production virtual network"
90+
is_default = false
91+
}
92+
```
93+
94+
3. Create a Cloudflare Tunnel for each private network:
95+
```tf
96+
resource "random_bytes" "staging_tunnel_secret" {
97+
length = 64
98+
}
99+
100+
resource "cloudflare_zero_trust_tunnel_cloudflared" "staging_tunnel" {
101+
account_id = var.cloudflare_account_id
102+
name = "Staging tunnel"
103+
tunnel_secret = random_bytes.staging_tunnel_secret.base64
104+
config_src = "cloudflare"
105+
}
106+
107+
resource "random_bytes" "production_tunnel_secret" {
108+
length = 64
109+
}
110+
111+
resource "cloudflare_zero_trust_tunnel_cloudflared" "production_tunnel" {
112+
account_id = var.cloudflare_account_id
113+
name = "Production tunnel"
114+
tunnel_secret = random_bytes.production_tunnel_secret.base64
115+
config_src = "cloudflare"
116+
}
117+
```
118+
119+
4. Route `10.128.0.1/32` through `Staging tunnel` and assign it to `staging-vnet`. Route `10.128.0.1/32` through `Production tunnel` and assign it to `production-vnet`.
120+
121+
```tf
122+
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "staging_tunnel_route" {
123+
account_id = var.cloudflare_account_id
124+
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.staging_tunnel.id
125+
network = "10.128.0.1/32"
126+
comment = "Staging tunnel route"
127+
virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.staging_vnet.id
128+
}
129+
130+
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "production_tunnel_route" {
131+
account_id = var.cloudflare_account_id
132+
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.production_tunnel.id
133+
network = "10.128.0.1/32"
134+
comment = "Production tunnel route"
135+
virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.production_vnet.id
136+
}
137+
```
138+
5. [Get the token](/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions/#get-the-tunnel-token) for each tunnel.
139+
140+
6. Using the tunnel tokens, run `Staging tunnel` in your staging environment and run `Production tunnel` in your production environment. Refer to [Install and run the tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api/#4-install-and-run-the-tunnel).
141+
</TabItem>
142+
143+
<TabItem label="Locally-managed tunnels">
144+
To route overlapping IPs over virtual networks for [locally-managed tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/):
74145

75146
1. Create a tunnel for each private network:
76147

@@ -113,10 +184,9 @@ The following example demonstrates how to add two overlapping IP routes to Cloud
113184
cloudflared tunnel vnet list
114185
```
115186

116-
{/* Commenting out notes within tabs for now
117187
:::note[Default virtual network]
118188
All accounts come pre-configured with a virtual network named `default`. You can choose a new default by typing `cloudflared tunnel vnet update --default <virtual-network-name>`.
119-
::: */}
189+
:::
120190

121191
4. Configure your tunnels with the IP/CIDR range of your private networks, and assign the tunnels to their respective virtual networks.
122192

@@ -162,7 +232,7 @@ The following example demonstrates how to add two overlapping IP routes to Cloud
162232
## Delete a virtual network
163233

164234
<Tabs>
165-
<TabItem label="Dashboard">
235+
<TabItem label="Dashboard">
166236
To delete a virtual network:
167237

168238
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels** and ensure that no IP routes are assigned to the virtual network you are trying to delete. If your virtual network is in use, delete the route or reassign it to a different virtual network.
@@ -175,10 +245,10 @@ The following example demonstrates how to add two overlapping IP routes to Cloud
175245

176246
You can optionally delete the tunnel associated with your virtual network.
177247

178-
</TabItem>
248+
</TabItem>
179249

180-
<TabItem label="cli">
181-
To delete a virtual network:
250+
<TabItem label="Locally-managed tunnels">
251+
To delete a virtual network for [locally-managed tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/):
182252

183253
1. Delete all IP routes in the virtual network. For example,
184254

@@ -200,7 +270,7 @@ The following example demonstrates how to add two overlapping IP routes to Cloud
200270

201271
You can verify that the virtual network was successfully deleted by typing `cloudflared tunnel vnet list`.
202272

203-
</TabItem>
273+
</TabItem>
204274
</Tabs>
205275

206276
## Connect to a virtual network

0 commit comments

Comments
 (0)