Skip to content

Commit f6e3c01

Browse files
ranbelranbel
committed
update policies, testing, troubleshooting
1 parent 97ad52c commit f6e3c01

File tree

3 files changed

+14
-55
lines changed

3 files changed

+14
-55
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr.mdx‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -39,32 +39,6 @@ To connect your infrastructure with Cloudflare Tunnel:
3939

4040
If you have applications clearly defined by IPs or hostnames, we recommend [creating an Access application](/cloudflare-one/applications/non-http/self-hosted-private-app/) and managing user access alongside your SaaS and other web apps. Alternatively, if you prefer to secure a private network using a traditional firewall model, you can build Gateway network and DNS policies for IP ranges and domains.
4141

42-
<Details header="Example network policies">
43-
The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic.
44-
45-
1. Allow company employees
46-
47-
| Selector | Operator | Value | Logic | Action |
48-
| -------------- | ------------- | ---------------- | ----- | ------ |
49-
| Destination IP | in | `10.0.0.0/8` | And | Allow |
50-
| User Email | matches regex | `.*@example.com` | | |
51-
52-
2. Catch-all block policy
53-
54-
| Selector | Operator | Value | Action |
55-
| -------------- | -------- | ------------ | ------ |
56-
| Destination IP | in | `10.0.0.0/8` | Block |
57-
58-
</Details>
59-
60-
<Details header="Example DNS policy">
61-
62-
| Selector | Operator | Value | Logic | Action |
63-
| -------------- | ------------- | ---------------- | ----- | ------ |
64-
| Host | is | `wiki.internal.local` | And | Allow |
65-
| User Email | matches regex | `.*@example.com` | | |
66-
</Details>
67-
6842
For more information on building Gateway policies, refer to [Secure your first application](/learning-paths/replace-vpn/build-policies/create-policy/) and [Common network policies](/cloudflare-one/policies/gateway/network-policies/common-policies/#restrict-access-to-private-networks).
6943

7044
## 5. Connect as a user

‎src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname.mdx‎

Lines changed: 13 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ For more details on configuring Split Tunnels, refer to [Route private network I
127127

128128
<Render file="tunnel/filter-network-traffic" />
129129

130-
#### Enable Gateway proxy
130+
#### Enable the Gateway proxy
131131

132132
<Render file="tunnel/enable-gateway-proxy" />
133133

@@ -148,25 +148,17 @@ If your private hostname points to an HTTPS application on port 443, you can sec
148148

149149
1. Allow company employees
150150

151-
| Selector | Operator | Value | Logic | Action |
152-
| -------------- | ------------- | ---------------- | ----- | ------ |
153-
| SNI | is | `wiki.internal.local` | And | Allow |
154-
| User Email | matches regex | `.*@example.com` | | |
151+
<Render file="gateway/policies/restrict-access-to-private-networks-allow" product="cloudflare-one" params={{ selector: "SNI", value: "wiki.internal.local" }} />
155152

156153
2. Catch-all block policy
157154

158-
| Selector | Operator | Value | Action |
159-
| -------------- | -------- | ------------ | ------ |
160-
| Destination IP | in | `10.0.0.0/8` | Block |
155+
<Render file="gateway/policies/restrict-access-to-private-networks-block" product="cloudflare-one" />
161156
</Details>
162157

163158
<Details header="Example DNS policy">
164159

165-
| Selector | Operator | Value | Logic | Action |
166-
| -------------- | ------------- | ---------------- | ----- | ------ |
167-
| Host | is | `wiki.internal.local` | And | Allow |
168-
| User Email | matches regex | `.*@example.com` | | |
169-
</Details>
160+
<Render file="gateway/policies/restrict-access-to-private-networks-dns" product="cloudflare-one" />
161+
</Details>
170162

171163

172164
##### Non-HTTPS applications
@@ -177,35 +169,28 @@ Access policies and Gateway network policies only support hostname-based filteri
177169

178170
1. Allow company employees
179171

180-
| Selector | Operator | Value | Logic | Action |
181-
| -------------- | ------------- | ---------------- | ----- | ------ |
182-
| Destination IP | in | `10.0.0.0/8` | And | Allow |
183-
| User Email | matches regex | `.*@example.com` | | |
172+
<Render file="gateway/policies/restrict-access-to-private-networks-allow" product="cloudflare-one" params={{ selector: "Destination IP", value: "10.0.0.0/8" }} />
184173

185174
2. Catch-all block policy
186175

187-
| Selector | Operator | Value | Action |
188-
| -------------- | -------- | ------------ | ------ |
189-
| Destination IP | in | `10.0.0.0/8` | Block |
176+
<Render file="gateway/policies/restrict-access-to-private-networks-block" product="cloudflare-one" />
190177

191178
</Details>
192179

193-
194180
<Details header="Example DNS policy">
195181

196-
| Selector | Operator | Value | Logic | Action |
197-
| -------------- | ------------- | ---------------- | ----- | ------ |
198-
| Host | is | `wiki.internal.local` | And | Allow |
199-
| User Email | matches regex | `.*@example.com` | | |
182+
<Render file="gateway/policies/restrict-access-to-private-networks-dns" product="cloudflare-one" />
200183
</Details>
201184

185+
### 7. Test the connection
202186

203-
### 7. Connect as a user
187+
End users can now reach the application by going to its private hostname. For example, to test an HTTP application, open a browser and go to `wiki.internal.local`.
204188

205-
End users can now reach the application by going to its private hostname. For example, to test an HTTP application, you can open a browser and go to `wiki.internal.local`.
189+
If you [enabled the Gateway proxy](#enable-the-gateway-proxy), you can view the traffic in your [Gateway activity logs](/cloudflare-one/insights/logs/gateway-logs/).
206190

207-
---- what's a good example for a non-HTTP app?---
191+
### Troubleshooting
208192

193+
For a step-by-step troubleshooting procedure, refer to [Troubleshoot private network connectivity](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/private-networks/).
209194

210195
## Supported on-ramps/off-ramps
211196

‎src/content/partials/cloudflare-one/tunnel/troubleshoot-private-networks.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ If WARP is stuck in the `Disconnected` state or frequently changes between `Conn
2020

2121
## 2. Is the WARP client connecting to your private DNS server?
2222

23-
This step is only needed if users access your application via a private hostname (for example, `wiki.internal.com`).
23+
This step is only needed if users access your application via a private hostname (for example, `wiki.internal.local`).
2424

2525
- If you are using [custom resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) to handle private DNS, go to your Gateway DNS logs (**Logs** > **Gateway** > **DNS**) and search for DNS queries to the hostname.
2626

0 commit comments

Comments
 (0)