|
1 | 1 | --- |
2 | | -pcx_content_type: how-to |
3 | | -title: Connect private networks |
| 2 | +pcx_content_type: concept |
| 3 | +title: Connect with cloudflared |
| 4 | +hidden: false |
4 | 5 | sidebar: |
5 | 6 | order: 1 |
6 | 7 | --- |
7 | 8 |
|
8 | | -import { Render } from "~/components"; |
| 9 | +`cloudflared` is a daemon service that can run on nearly any host machine in your private network and proxies local traffic once validated from the Cloudflare network. The Cloudflare Tunnel created by `cloudflared` is outbound-only, meaning that it will only proxy requests initiated from a user to your private network. Requests made by a service or application running behind the tunnel will use the server's default routing table. |
9 | 10 |
|
10 | | -A private network has two primary components: the server and the client. The server's infrastructure (whether that is a single application, multiple applications, or a network segment) is connected to Cloudflare's global network by Cloudflare Tunnel. This is done by running the `cloudflared` daemon on the server. |
| 11 | +On the client side, end users connect to Cloudflare's global network using the Cloudflare WARP client. The WARP client can be rolled out to your entire organization in just a few minutes using your in-house MDM tooling. When users connect to an IP address or hostname made available through Cloudflare Tunnel, WARP sends their connection through Cloudflare's network and down the corresponding tunnel to the internal service. Traffic to services behind the tunnel will carry the local source IP address of the host machine running the `cloudflared` daemon. |
11 | 12 |
|
12 | | -On the client side, end users connect to Cloudflare's global network using the Cloudflare WARP client. The WARP client can be rolled out to your entire organization in just a few minutes using your in-house MDM tooling. When users connect to an IP made available through Cloudflare Tunnel, WARP sends their connection through Cloudflare's network to the corresponding tunnel. |
| 13 | + |
13 | 14 |
|
14 | | - |
15 | | - |
16 | | -To enable remote access to your private network, follow the guide below. |
17 | | - |
18 | | -## 1. Connect the server to Cloudflare |
19 | | - |
20 | | -To connect your infrastructure with Cloudflare Tunnel: |
21 | | - |
22 | | -<Render file="tunnel/connect-private-network" /> |
23 | | - |
24 | | -2. In the **Private Networks** tab for the tunnel, enter the IP/CIDR range that you wish to route through the tunnel (for example `10.0.0.0/8`). |
25 | | - |
26 | | -## 2. Set up the client |
27 | | - |
28 | | -<Render file="tunnel/warp-to-tunnel-client" /> |
29 | | - |
30 | | -## 3. Route private network IPs through WARP |
31 | | - |
32 | | -<Render file="tunnel/warp-to-tunnel-route-ips" params={{ one: "private network"}}/> |
33 | | - |
34 | | -## 4. (Recommended) Filter network traffic with Gateway |
35 | | - |
36 | | -By default, all WARP devices enrolled in your Zero Trust organization can connect to your private network through Cloudflare Tunnel. You can configure Gateway inspect your network traffic and either block or allow access based on user identity and device posture. |
37 | | - |
38 | | -### Enable the Gateway proxy |
39 | | - |
40 | | -<Render file="tunnel/enable-gateway-proxy" /> |
41 | | - |
42 | | -### Zero Trust policies |
43 | | - |
44 | | -Cloudflare Zero Trust allows you to configure security policies using either Access or Gateway. If you have applications clearly defined by IPs or hostnames, we recommend [creating an Access application](/cloudflare-one/applications/non-http/self-hosted-private-app/) and managing user access alongside your SaaS and other web apps. Alternatively, if you prefer to secure a private network using a traditional firewall model, you can build Gateway [network and DNS policies](/learning-paths/replace-vpn/build-policies/) for IP ranges and domains. |
45 | | - |
46 | | -## 5. Connect as a user |
47 | | - |
48 | | -End users can now reach HTTP or TCP-based services on your network by visiting any IP address in the range you have specified. |
49 | | - |
50 | | -### Troubleshooting |
51 | | - |
52 | | -#### Device configuration |
53 | | - |
54 | | -To check that their device is properly configured, the user can visit `https://help.teams.cloudflare.com/` to ensure that: |
55 | | - |
56 | | -- The page returns **Your network is fully protected**. |
57 | | -- In **HTTP filtering**, both **WARP** and **Gateway Proxy** are enabled. |
58 | | -- The **Team name** matches the Zero Trust organization from which you created the tunnel. |
59 | | - |
60 | | -#### Router configuration |
61 | | - |
62 | | -Check the local IP address of the device and ensure that it does not fall within the IP/CIDR range of your private network. For example, some home routers will make DHCP assignments in the `10.0.0.0/24` range, which overlaps with the `10.0.0.0/8` range used by most corporate private networks. When a user's home network shares the same IP addresses as the routes in your tunnel, their device will be unable to connect to your application. |
63 | | - |
64 | | -To resolve the IP conflict, you can either: |
65 | | - |
66 | | -- Reconfigure the user's router to use a non-overlapping IP range. Compatible routers typically use `192.168.1.0/24`, `192.168.0.0/24` or `172.16.0.0/24`. |
67 | | -- Tighten the IP range in your Split Tunnel configuration to exclude the `10.0.0.0/24` range. This will only work if your private network does not have any hosts within `10.0.0.0/24`. |
68 | | -- Change the IP/CIDR of your private network so that it does not overlap with a range commonly used by home networks. |
| 15 | +To enable remote access to your private network, refer to the following guides: |
| 16 | +- [**Connect a hostname**](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-hostname/): Route network traffic to an internal application using its private or public hostname. |
| 17 | +- [**Connect an IP/CIDR**](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/): Route traffic to an internal IP address or CIDR range. |
0 commit comments