You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname.mdx
The selected CGNAT IP is called the initial resolved IP.
37
37
5. Gateway's network engine stores the mapping between the private hostname (`wiki.internal.local`), initial resolved IP (`100.80.0.1`), and the actual IP (`10.0.0.5`).
@@ -43,13 +43,71 @@ As shown in Figure 2 below, the WARP client will now send `wiki.internal.local`
43
43
44
44
The initial resolved IP mechanism is required because Gateway's network engine operates at L3/L4 and can only see IPs (not hostnames) when processing the connection. Because the packet's destination IP falls within the designated CGNAT range, Gateway knows that it corresponds to a hostname route and can apply hostname-based policies. Traffic that passes your Gateway policies will route through Cloudflare Tunnel to the application's actual origin IP. When the initial resolved IP expires, WARP will send a new DNS request (Figure 1) to refresh the initial resolved IP.
45
45
46
-
## Connect to a private hostname
46
+
## Supported on-ramps/off-ramps
47
+
48
+
The table below summarizes the Cloudflare One products that are compatible with private hostname routing. Refer to the table legend for guidance on interpreting the table.
49
+
50
+
✅ Product works with no caveats <br/>
51
+
🚧 Product can be used with some caveats <br/>
52
+
❌ Product cannot be used <br/>
53
+
54
+
### Device connectivity
55
+
56
+
End users can connect to private hostnames using the following traffic on-ramps:
<Checkboxlabel="Private network CIDR where the application is located" />
82
+
<Checkboxlabel="Internal DNS resolver IP" />
83
+
<Checkboxlabel="DNS queries for your private hostname" />
84
+
85
+
Configuration steps vary depending on your [device on-ramp](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname/#device-connectivity):
86
+
87
+
<Detailsheader="WARP clients">
88
+
1. In [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the IPs listed above route through the WARP tunnel. For example, if you are using the default Split Tunnels Exclude configuration and your application and DNS resolver have private IPs in the range `10.0.0.0/8`, delete `100.64.0.0/10` and `10.0.0.0/8` from the Split Tunnels list. We recommend adding back the IPs that are not explicitly used by your network — refer to our [Split Tunnels calculator](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) for details.
89
+
2. In [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/), delete the top-level domain for your private hostname.
90
+
3. In [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/#create-a-resolver-policy), delete any existing entries that match your private hostname.
91
+
</Details>
92
+
93
+
<Detailsheader="WARP Connector">
94
+
95
+
1. In your [WARP Connector device profile](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/#3-route-traffic-between-warp-connector-and-cloudflare), ensure that the IPs listed above route through the WARP tunnel.
96
+
2. Depending on where you installed WARP Connector, you may also need to route those destination IPs through WARP Connector and point your DNS resolver to Cloudflare Gateway. Refer to [Route traffic from subnet to WARP Connector](/astro.config.tscloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/#4-route-traffic-from-subnet-to-warp-connector).
97
+
98
+
</Details>
99
+
100
+
<Detailsheader="Magic WAN">
101
+
102
+
1. Ensure that the IPs listed above route through Magic WAN to Cloudflare.
103
+
2.[Point the DNS resolver](/magic-wan/zero-trust/cloudflare-gateway/) for your Magic WAN network to Cloudflare Gateway.
104
+
105
+
</Details>
47
106
48
-
This section covers how to enable remote access to a private hostname application using `cloudflared` and WARP.
9. In the **Hostname routes** tab, enter the fully qualified domain name (FDQN) that represents your application (for example, `wiki.internal.local`).
55
113
@@ -94,42 +152,17 @@ Gateway will automatically resolve DNS queries using your internal DNS server as
94
152
95
153
3. From the dropdown menu, select the `- Private` routing option and the [virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) where the DNS server is located.
### 4. (Recommended) Filter network traffic with Gateway
100
156
101
-
<Renderfile="tunnel/warp-to-tunnel-client" />
102
-
103
-
### 5. Route traffic through WARP
104
-
105
-
This section details routing requirements for WARP client deployments. For information about WARP Connector and other connectivity methods, refer to [Supported on-ramps](#device-connectivity).
106
-
107
-
#### Split Tunnels
108
-
109
-
In your WARP [device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), configure [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) so that the following IPs route through the WARP tunnel:
- Private network CIDR where the application is located
114
-
- Internal DNS resolver IP
115
-
116
-
For example, if you are using the default Split Tunnels Exclude configuration and your application and DNS resolver have private IPs in the range `10.0.0.0/8`, delete `100.64.0.0/10` and `10.0.0.0/8` from the Split Tunnels list. We recommend adding back the IPs that are not explicitly used by your network — refer to our [Split Tunnels calculator](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) for details.
117
-
118
-
#### Local Domain Fallback
119
-
120
-
By default, the WARP client uses the local DNS resolver on the device to resolve common local domains (such as `.internal` and `local`). These top-level domains are on your [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) list and bypass the Gateway resolver. To resolve a private hostname with Gateway, [delete its domain](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/#delete-a-domain) from Local Domain Fallback.
121
-
122
-
### 6. (Recommended) Filter network traffic with Gateway
WARP users can now reach the application by going to its private hostname. For example, to connect to a private web application, open a browser and go to `wiki.internal.local`.
216
+
End users can now reach the application by going to its private hostname. For example, to connect to a private web application, open a browser and go to `wiki.internal.local`.
184
217
185
218
#### Troubleshooting
186
219
@@ -233,42 +266,3 @@ You can run the following tests to check if private hostname routing is properly
233
266
234
267
If the request fails, confirm that the initial resolved IP [routes through the WARP tunnel](#split-tunnels). You can also check your [tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/) to confirm that requests are routing to the application's private IP.
235
268
236
-
## Supported on-ramps/off-ramps
237
-
238
-
The table below summarizes the Cloudflare One products that are compatible with private hostname routing. Refer to the table legend for guidance on interpreting the table.
239
-
240
-
✅ Product works with no caveats <br/>
241
-
🚧 Product can be used with some caveats <br/>
242
-
❌ Product cannot be used <br/>
243
-
244
-
### Device connectivity
245
-
246
-
End users can connect to private hostnames using the following traffic on-ramps:
247
-
248
-
<Renderfile="gateway/egress-selector-onramps" />
249
-
250
-
#### WARP Connector and Magic WAN routes
251
-
252
-
If devices are behind WARP Connector or Magic WAN, you may need to update the routing table on your device or router to send traffic to Gateway. Ensure that traffic to the following destination IPs route through WARP Connector / Magic WAN:
0 commit comments