You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx
+8-12Lines changed: 8 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,18 +20,15 @@ To enable remote access to your private network, follow the guide below.
20
20
To connect your infrastructure with Cloudflare Tunnel:
21
21
22
22
1. Create a Cloudflare Tunnel for your server by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). You can skip the connect an application step and go straight to connecting a network.
23
-
24
23
2. In the **Private Networks** tab for the tunnel, enter the IP/CIDR range of your private network (for example `10.0.0.0/8`). This makes the WARP client aware that any requests to this IP range need to be routed to your new tunnel.
25
24
26
25
:::note
27
-
28
26
Cloudflare Tunnel only supports routes in the [private IP address space](https://www.rfc-editor.org/rfc/rfc1918.html#section-3):
29
27
30
28
-`10.0.0.0` - `10.255.255.255`
31
29
-`172.16.0.0` - `172.31.255.255`
32
30
-`192.168.0.0` - `192.168.255.255`
33
-
34
-
:::
31
+
:::
35
32
36
33
## 2. Set up the client
37
34
@@ -63,7 +60,6 @@ You can create Zero Trust policies to manage access to specific applications on
63
60
64
61
5. For **Value**, enter the IP address for your application (for example, `10.128.0.7`).
65
62
:::note
66
-
67
63
If you would like to create a policy for an IP/CIDR range instead of a specific IP address, you can build a [Gateway Network policy](/cloudflare-one/policies/gateway/network-policies/) using the **Destination IP** selector.
68
64
:::
69
65
@@ -74,15 +70,17 @@ You can create Zero Trust policies to manage access to specific applications on
74
70
8. Modify the policies to include additional identity-based conditions. For example:
Policies are evaluated in [numerical order](/cloudflare-one/policies/gateway/order-of-enforcement/#order-of-precedence), so a user with an email ending in @example.com will be able to access `10.128.0.7` while all others will be blocked. For more information on building network policies, refer to our [dedicated documentation](/cloudflare-one/policies/gateway/network-policies/).
88
86
@@ -111,7 +109,5 @@ Check the local IP address of the device and ensure that it does not fall within
111
109
To resolve the IP conflict, you can either:
112
110
113
111
- Reconfigure the user's router to use a non-overlapping IP range. Compatible routers typically use `192.168.1.0/24`, `192.168.0.0/24` or `172.16.0.0/24`.
114
-
115
112
- Tighten the IP range in your Split Tunnel configuration to exclude the `10.0.0.0/24` range. This will only work if your private network does not have any hosts within `10.0.0.0/24`.
116
-
117
113
- Change the IP/CIDR of your private network so that it does not overlap with a range commonly used by home networks.
Copy file name to clipboardExpand all lines: src/content/partials/cloudflare-one/tunnel/enable-gateway-proxy.mdx
+8-9Lines changed: 8 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,14 +2,15 @@
2
2
{}
3
3
---
4
4
5
-
import { Details } from"~/components";
5
+
import { Tabs, TabItem } from"~/components";
6
6
7
7
1. Go to **Settings** > **Network**.
8
-
2. Enable **Proxy** for TCP.
9
-
3. (Recommended) To proxy traffic to internal DNS resolvers, select **UDP**.
10
-
4. (Recommended) To proxy traffic for diagnostic tools such as `ping` and `traceroute`, select **ICMP**. You may also need to update your system to allow ICMP traffic through `cloudflared`:
8
+
2. Turn on **Proxy**.
9
+
3. Select **TCP**.
10
+
4. (Recommended) To proxy traffic to internal DNS resolvers, select **UDP**.
11
+
5. (Recommended) To proxy traffic for diagnostic tools such as `ping` and `traceroute`, select **ICMP**. You may also need to update your system to allow ICMP traffic through `cloudflared`:
11
12
12
-
<Detailsheader="Linux">
13
+
<Tabs> <TabItemlabel="Linux"icon="linux">
13
14
14
15
1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`.
15
16
@@ -36,14 +37,12 @@ import { Details } from "~/components";
36
37
cloudflared tunnel run --icmpv4-src <IP of primary interface>
In your environment, modify the `ping_group_range` parameter to include the Group ID (GID) of the user running `cloudflared`.
44
43
45
44
By default the [`cloudflared` Docker container](https://github.com/cloudflare/cloudflared/blob/master/Dockerfile#L29C6-L29C13) executes as a user called `nonroot` inside of the container. `nonroot` is a specific user that exists in the [base image](https://github.com/GoogleContainerTools/distroless/blob/859eeea1f9b3b7d59bdcd7e24a977f721e4a406c/base/base.bzl#L8) we use, and its Group ID is hardcoded to 65532.
46
45
47
-
</Details>
46
+
</TabItem> </Tabs>
48
47
49
48
Cloudflare will now proxy traffic from enrolled devices, except for the traffic excluded in your [split tunnel settings](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#3-route-private-network-ips-through-warp). For more information on how Gateway forwards traffic, refer to [Gateway proxy](/cloudflare-one/policies/gateway/proxy/).
Copy file name to clipboardExpand all lines: src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-route-ips.mdx
-3Lines changed: 0 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,11 @@
1
1
---
2
2
{}
3
-
4
3
---
5
4
6
5
By default, WARP excludes traffic bound for [RFC 1918 space](https://datatracker.ietf.org/doc/html/rfc1918), which are IP addresses typically used in private networks and not reachable from the Internet. In order for WARP to send traffic to your private network, you must configure [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) so that the IP/CIDR of your private network routes through WARP.
7
6
8
7
1. First, check whether your [Split Tunnels mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include** mode.
9
-
10
8
2. If you are using **Include** mode, add your network's IP/CIDR range to the list. Your list should also include the [domains necessary for Cloudflare Zero Trust functionality](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains).
11
-
12
9
3. If you are using **Exclude** mode:
13
10
1. Delete your network's IP/CIDR range from the list. For example, if your network uses the default AWS range of `172.31.0.0/16`, delete `172.16.0.0/12`.
14
11
2. Re-add IP/CDIR ranges that are not explicitly used by your private network. For the AWS example above, you would add new entries for `172.16.0.0/13`, `172.24.0.0/14`, `172.28.0.0/15`, and `172.30.0.0/16`. This ensures that only traffic to `172.31.0.0/16` routes through WARP.
0 commit comments