Skip to content

Commit c806794

Browse files
ranbelOxyjun
ranbel
and
Oxyjun
authored
[ZT] New WARP Connector flow (#16486)
* remove unnecessary steps * New warp connector flow * add missing iptables command * fix details component * tweak wording * split into multiple pages * remove old page * fix glossary formatting * missing components * clean up site-to-site * combine steps * site-to-Internet * user to site * apply review feedback * remove old page * update user-to-site test * add device profile note * Update src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/partials/cloudflare-one/tunnel/warp-connector-alternate-gateway.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx Co-authored-by: Jun Lee <[email protected]> --------- Co-authored-by: Jun Lee <[email protected]>
1 parent 2ba7478 commit c806794

16 files changed

+605
-424
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector.mdx‎

Lines changed: 0 additions & 423 deletions
This file was deleted.

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/index.mdx‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
pcx_content_type: concept
3+
title: WARP Connector
4+
sidebar:
5+
label: Overview
6+
order: 5
7+
badge:
8+
text: Beta
9+
tableOfContents: false
10+
---
11+
12+
import { Render, Details} from "~/components";
13+
14+
<Details header="Feature availability">
15+
16+
| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
17+
| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
18+
| Gateway with WARP | All plans |
19+
20+
| System | Availability |
21+
| -------- | ------------ |
22+
| Windows | ❌ |
23+
| macOS | ❌ |
24+
| Linux | ✅ |
25+
| iOS | ❌ |
26+
| Android | ❌ |
27+
| ChromeOS | ❌ |
28+
29+
</Details>
30+
31+
Cloudflare WARP Connector is a piece of software [^1] that enables site-to-site, bidirectional, and mesh networking connectivity without requiring changes to underlying network routing infrastructure. WARP Connector establishes a secure Layer 3 connection between a private network and Cloudflare, allowing you to:
32+
33+
- Connect two or more private networks to each other.
34+
- Connect IoT devices that cannot run external software, such as printers and IP phones.
35+
- Filter and log server-initiated traffic, such as VoIP and SIP traffic.
36+
- Apply Zero Trust security policies based on the source IP of the request.
37+
38+
![Two subnets connected with WARP Connector](~/assets/images/cloudflare-one/connections/connect-apps/warp-connector/overview.png)
39+
40+
As shown in the diagram, WARP Connector acts as a router for a subnet within the private network to on-ramp and off-ramp traffic through Cloudflare. All devices on the subnet can access any services connected to Cloudflare, and all devices connected to Cloudflare can access any services on the subnet. Each subnet runs a WARP Connector on a designated Linux machine (typically the default gateway router), but other devices on the network do not need to install software.
41+
42+
To set up WARP Connector, refer to the guide for your use case:
43+
44+
- **[Site-to-Internet](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/)**: Send requests from your private network to the Internet.
45+
- **[Site-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/)**: Send requests between two or more private networks.
46+
- **[User-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site/)**: Allow WARP client devices to send requests to your private network.
47+
- **Internet-to-site**: Not supported by WARP Connector. To provide clientless access to applications on your private network, set up a [Cloudflare Tunnel with `cloudflared`](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) and configure a [public hostname route](/cloudflare-one/connections/connect-networks/routing-to-tunnel/).
48+
49+
[^1]: WARP Connector is an extension of the [WARP client](/cloudflare-one/connections/connect-devices/warp/).

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Connect private network to Internet
4+
sidebar:
5+
label: Site-to-Internet
6+
order: 3
7+
---
8+
9+
import { Render, Details, GlossaryTooltip, TabItem, Tabs } from "~/components";
10+
11+
This guide covers how to connect a private network to the Internet using WARP Connector. In this example, we will create a WARP Connector for subnet `10.0.0.0/24` and install it on `10.0.0.1`.
12+
13+
```mermaid
14+
flowchart LR
15+
subgraph subnet1[Subnet 10.0.0.0/24]
16+
device1["Device
17+
10.0.0.2"]-->router1["WARP Connector
18+
10.0.0.1"]
19+
end
20+
router1-->C((Cloudflare))-->I{Internet}
21+
```
22+
23+
## Prerequisites
24+
25+
- A Linux host [^1] on the subnet
26+
- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/).
27+
28+
## 1. Install a WARP Connector
29+
30+
<Render file="tunnel/warp-connector-install" />
31+
32+
## 2. (Recommended) Create a device profile
33+
34+
<Render file="tunnel/warp-connector-device-profile" />
35+
36+
## 3. Route traffic from subnet to WARP Connector
37+
38+
Depending on where you installed the WARP Connector, you may need to configure other devices on the subnet to route outbound requests through WARP Connector.
39+
40+
### Option 1: Default gateway
41+
42+
<Render file="tunnel/warp-connector-default-gateway" />
43+
44+
### Option 2: Alternate gateway
45+
46+
<Render file="tunnel/warp-connector-alternate-gateway" />
47+
48+
#### Add route to router
49+
50+
For example, for all traffic from the subnet to egress through WARP Connector, add a rule on the router that routes `0.0.0.0` to the WARP Connector host machine (`10.0.0.100`).
51+
52+
<Render file="tunnel/warp-connector-alternate-gateway-flow" />
53+
54+
### Option 3: Intermediate gateway
55+
56+
<Render file="tunnel/warp-connector-intermediate-gateway" />
57+
58+
#### Add route to devices
59+
60+
<Render file="tunnel/warp-connector-route-all-traffic" />
61+
62+
#### Verify routes
63+
64+
<Render file="tunnel/warp-connector-verify-routes" />
65+
66+
## 4. Test the WARP Connector
67+
68+
You can now test if traffic from your subnet routes through Cloudflare. For example,
69+
70+
1. On the `10.0.0.2` device, run `curl --ipv4 www.google.com`.
71+
2. Check your [Gateway DNS logs](/cloudflare-one/insights/logs/gateway-logs/) for queries from `warp_connector@<your-team-name>.cloudflareaccess.com`. Logs may take a few minutes to populate.
72+
73+
```mermaid
74+
flowchart LR
75+
subgraph subnet1[Subnet 10.0.0.0/24]
76+
device1["Device
77+
10.0.0.2"]--Request-->router1["WARP Connector
78+
10.0.0.1"]
79+
end
80+
router1-->C((Cloudflare))-->I{Internet}
81+
```
82+
83+
[^1]: <Render file="tunnel/warp-connector-linux-packages" />

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site.mdx‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Connect two or more private networks
4+
sidebar:
5+
label: Site-to-site
6+
order: 3
7+
---
8+
9+
import { Render, Details, GlossaryTooltip, TabItem, Tabs } from "~/components";
10+
11+
This guide covers how to connect two independent subnets with WARP Connector. Each subnet must run its own WARP Connector on a Linux host. Installing on your router is the simplest setup, but if you do not have access to the router, you may choose any other machine on the subnet.
12+
13+
```mermaid
14+
flowchart LR
15+
subgraph subnet1[Subnet 10.0.0.0/24]
16+
router1["WARP Connector #1
17+
10.0.0.1"]
18+
end
19+
subgraph subnet2[Subnet 192.168.1.0/24]
20+
router2["WARP Connector #2
21+
192.168.1.97"]
22+
end
23+
router1<-->C((Cloudflare))<-->router2
24+
```
25+
26+
In this example, we will create a WARP Connector for subnet `10.0.0.0/24` and install it on `10.0.0.1`. We will then create a second WARP Connector for subnet `192.168.1.0/24` and install it on `192.168.1.97`.
27+
28+
## Prerequisites
29+
30+
- A Linux host [^1] on each subnet.
31+
- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/).
32+
33+
## 1. Install a WARP Connector
34+
35+
<Render file="tunnel/warp-connector-install" />
36+
37+
## 2. (Recommended) Create a device profile
38+
39+
<Render file="tunnel/warp-connector-device-profile" />
40+
41+
## 3. Route traffic from WARP Connector to subnet
42+
43+
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Networks** > **Routes**.
44+
2. Select **Create route**.
45+
3. In **CIDR**, enter the private IPv4 address range that you wish to route through this WARP Connector (for example, `10.0.0.0/24`). WARP Connector does not currently support IPv6 routes.
46+
:::note
47+
If you do not already have a private network range, you can choose a subnet from one of these [pre-defined CIDRs](https://datatracker.ietf.org/doc/html/rfc1918#section-3).
48+
:::
49+
4. For **Tunnel**, select the name of your WARP Connector (_Subnet-10.0.0.0/24_).
50+
5. Select **Create**.
51+
6. In your WARP Connector device profile, [configure Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) so that traffic to your private network CIDR (`10.0.0.0/24`) routes through the WARP tunnel. For example, if you are using **Exclude** mode, delete `10.0.0.0/8` from Split Tunnels and re-add the following IPs: `10.0.1.0/24`, `10.0.2.0/23`, `10.0.4.0/22`, `10.0.8.0/21`, `10.0.16.0/20`, `10.0.32.0/19`, `10.0.64.0/18`, `10.0.128.0/17`, `10.1.0.0/16`, `10.2.0.0/15`, `10.4.0.0/14`, `10.8.0.0/13`, `10.16.0.0/12`, `10.32.0.0/11`, `10.64.0.0/10`, `10.128.0.0/9`
52+
53+
The WARP Connector will now forward inbound requests to devices on the subnet.
54+
55+
```mermaid
56+
flowchart LR
57+
subgraph subnet1[Subnet 10.0.0.0/24]
58+
router1["WARP Connector #1
59+
10.0.0.1"]
60+
device["Device
61+
10.0.0.2"]
62+
end
63+
64+
C((Cloudflare))--Requests to 10.0.0.2--> router1 --> device
65+
66+
```
67+
68+
## 4. Route traffic from subnet to WARP Connector
69+
70+
Depending on where you installed the WARP Connector, you may need to configure other devices on the subnet to route outbound requests through WARP Connector.
71+
72+
```mermaid
73+
flowchart LR
74+
subgraph subnet1[Subnet 10.0.0.0/24]
75+
router1["WARP Connector #1
76+
10.0.0.1"]
77+
device["Device
78+
10.0.0.2"]
79+
end
80+
81+
device --Requests to
82+
192.168.1.0/24 --> router1 --> C((Cloudflare))
83+
84+
```
85+
86+
### Option 1: Default gateway
87+
88+
<Render file="tunnel/warp-connector-default-gateway" />
89+
90+
### Option 2: Alternate gateway
91+
92+
<Render file="tunnel/warp-connector-alternate-gateway" />
93+
94+
#### Add route to router
95+
96+
For example, for devices on subnet `10.0.0.0/24` to reach applications behind subnet `192.168.1.0/24`, add a rule on the router that routes `192.168.1.0/24` to the WARP Connector host machine (`10.0.0.100`).
97+
98+
<Render file="tunnel/warp-connector-alternate-gateway-flow" />
99+
100+
### Option 3: Intermediate gateway
101+
102+
<Render file="tunnel/warp-connector-intermediate-gateway" />
103+
104+
#### Add route to devices
105+
106+
<Render file="tunnel/warp-connector-route-all-traffic" />
107+
108+
Alternatively, you can configure only certain routes to egress through WARP Connector. For example, you may only want to filter traffic destined to internal applications and devices, but allow public Internet traffic to bypass Cloudflare.
109+
110+
<Tabs> <TabItem label="Linux">
111+
112+
```sh
113+
sudo ip route add <DESTINATION-IP> via <WARP-CONNECTOR-IP> dev eth0
114+
```
115+
116+
</TabItem> <TabItem label="macOS">
117+
118+
```sh
119+
sudo route -n add -net <DESTINATION-IP> <WARP-CONNECTOR-IP>
120+
```
121+
122+
</TabItem>
123+
124+
<TabItem label="Windows">
125+
126+
```bash
127+
route /p add <DESTINATION-IP> mask 255.255.255.255 <WARP-CONNECTOR-IP>
128+
```
129+
130+
</TabItem> </Tabs>
131+
132+
133+
#### Verify routes
134+
135+
<Render file="tunnel/warp-connector-verify-routes" />
136+
137+
## 5. Install another WARP Connector
138+
139+
Repeat steps 1, 3, and 4 above to install an additional WARP Connector on subnet `192.168.1.0/24`. The device profile created in Step 2 will apply to all WARP Connectors.
140+
141+
```mermaid
142+
flowchart LR
143+
subgraph subnet1[Subnet 10.0.0.0/24]
144+
router1["WARP Connector #1
145+
10.0.0.1"]
146+
end
147+
subgraph subnet2[Subnet 192.168.1.0/24]
148+
router2["WARP Connector #2
149+
192.168.1.97"]
150+
end
151+
router1<-->C((Cloudflare))<-->router2
152+
```
153+
154+
## 6. Test the WARP Connector
155+
156+
You can now test the connection between the two subnets. For example, on the `10.0.0.2` device run `ping 192.168.1.100`.
157+
158+
```mermaid
159+
flowchart LR
160+
subgraph subnet1[Subnet 10.0.0.0/24]
161+
device1["Device
162+
10.0.0.2"]--"ping
163+
192.168.1.100"-->router1["WARP Connector #1
164+
10.0.0.1"]
165+
end
166+
subgraph subnet2[Subnet 192.168.1.0/24]
167+
router2["WARP Connector #2
168+
192.168.1.97"]-->device2["Device
169+
192.168.1.100"]
170+
end
171+
router1-->C((Cloudflare))-->router2
172+
```
173+
174+
:::note
175+
176+
If you are testing with curl using private hostnames, add the `--ipv4` flag to your curl commands.
177+
:::
178+
179+
[^1]: <Render file="tunnel/warp-connector-linux-packages" />

0 commit comments

Comments
 (0)