Reference Architecture Diagram: Deploying self hosted VoIP services for hybrid users #17822

securitypedant · 2024-10-28T17:01:26Z

Summary

Screenshots (optional)

Documentation checklist

The documentation style guide has been adhered to.
If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
Files which have changed name or location have been allocated redirects.

hyperlint-ai

1 files reviewed, 2 total issue(s) found.

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com>

cloudflare-workers-and-pages · 2024-10-28T17:10:17Z

Deploying cloudflare-docs with Cloudflare Pages

Latest commit:	`e7a3ddd`
Status:	✅ Deploy successful!
Preview URL:	https://5d30e8a4.cloudflare-docs-7ou.pages.dev
Branch Preview URL:	https://sthorpe-deploying-self-hoste.cloudflare-docs-7ou.pages.dev

View logs

github-actions · 2024-10-28T17:10:34Z

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/reference-architecture/diagrams/sase/deploying-self-hosted-voip-services-for-hybrid-users/	https://sthorpe-deploying-self-hoste.cloudflare-docs-7ou.pages.dev/reference-architecture/diagrams/sase/deploying-self-hosted-voip-services-for-hybrid-users/

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Co-authored-by: ranbel <[email protected]>

ranbel

Noticed a few more tiny issues during my second read-through. Otherwise the doc looks good to me!

ranbel · 2024-10-30T23:56:35Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+Cloudflare improves over traditional VPN solutions by leveraging its [global network](https://www.cloudflare.com/network/) of data centers in over 300 cities to significantly reduce latency for remote users. When using our device agent, remote users are automatically connected to the nearest Cloudflare data center, thus reducing latency. 
+
+This document explains how Cloudflare can be architected with a self-hosted VoIP service. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users.


Suggested change

This document explains how Cloudflare can be architected with a self-hosted VoIP service. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users.

This document explains how to architect a self-hosted VoIP service using Cloudflare products. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users.

ranbel · 2024-10-30T23:57:38Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+![Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg "Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.")
+
+The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the <GlossaryTooltip term="CGNAT IP">CGNAT range</GlossaryTooltip>, which is used for the private network created between device agents. The WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications.


Suggested change

The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the <GlossaryTooltip term="CGNAT IP">CGNAT range</GlossaryTooltip>, which is used for the private network created between device agents. The WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications.

The diagram above shows the WARP Connector and our device agent deployed to establish highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the <GlossaryTooltip term="CGNAT IP">CGNAT range</GlossaryTooltip>, which is used for the private network created between device agents. The WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications.

ranbel · 2024-10-30T23:58:39Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+## Call flow examples
+
+VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, `100.96.0.0/12`. As routing has been established to Cloudflare for `100.96.0.0/12` and to the on-prem network of `10.0.50.0/24`, call flows will work as normal – both direct and indirect media are supported.


Suggested change

VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, `100.96.0.0/12`. As routing has been established to Cloudflare for `100.96.0.0/12` and to the on-prem network of `10.0.50.0/24`, call flows will work as normal – both direct and indirect media are supported.

VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, `100.96.0.0/12`. As routing has been established to Cloudflare for `100.96.0.0/12` and to the on-premise network of `10.0.50.0/24`, call flows will work as normal – both direct and indirect media are supported.

ranbel · 2024-10-30T23:59:07Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+### Remote user calling another remote user
+
+When calls are made from user to user, some traffic flows from user devices through Cloudflare to the on-premises server, while other traffic flows through Cloudflare directly to the other user. Note that the device agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server.


Suggested change

When calls are made from user to user, some traffic flows from user devices through Cloudflare to the on-premises server, while other traffic flows through Cloudflare directly to the other user. Note that the device agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server.

When calls are made from user to user, some traffic flows from user devices through Cloudflare to the on-premise server, while other traffic flows through Cloudflare directly to the other user. Note that the device agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server.

ranbel · 2024-10-30T23:59:48Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+The above diagram shows the high level signaling and media paths.
+
+1. Alice registers directly with the SIP server (`10.0.50.60`) with her Cloudflare assigned CGNAT IP of `100.96.0.12`.


Suggested change

1. Alice registers directly with the SIP server (`10.0.50.60`) with her Cloudflare assigned CGNAT IP of `100.96.0.12`.

1. Alice registers directly with the SIP server (`10.0.50.60`) with a Cloudflare assigned CGNAT IP of `100.96.0.12`.

ranbel · 2024-10-31T00:03:51Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+4. The default gateway for the SIP server is `10.50.0.1`, but we have defined a static route such that for destination `100.96.0.0/12`, the next hop is the WARP Connector interface (`10.0.50.10`).
+5. The SIP INVITE message will be sent on the local network to Bob.
+6. Bob accepts and the SIP server will send SIP/SDP messages to both Alice and Bob specifying which parameters to use for the RTP (audio) data.
+7. Bob will send audio to Alice at 100.96.0.12, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at 10.0.50.101, which will be sent from Cloudflare across the WARP Connector to the on-premise local network.


Suggested change

7. Bob will send audio to Alice at 100.96.0.12, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at 10.0.50.101, which will be sent from Cloudflare across the WARP Connector to the on-premise local network.

7. Bob will send audio to Alice at `100.96.0.12`, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at `10.0.50.101`, which will be sent from Cloudflare across the WARP Connector to the on-premise local network.

ranbel · 2024-10-31T00:06:55Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+## Summary
+
+Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits:


Suggested change

Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits:

With Cloudflare's WARP Connector, remote users communicating with other remote users or on-premise users via on-premise SIP servers will have a seamless and secure experience for both ends. Key benefits include:

ranbel · 2024-10-31T00:08:00Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits:
+
+1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using an encrypted tunnel, ensuring data integrity and encryption.


Suggested change

1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using an encrypted tunnel, ensuring data integrity and encryption.

1. **Bidirectional connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network using an encrypted tunnel, ensuring data integrity and encryption.

ranbel · 2024-10-31T00:08:16Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using an encrypted tunnel, ensuring data integrity and encryption.
+
+2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network.


Suggested change

2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network.

2. **Private communication over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network.

ranbel · 2024-10-31T00:08:34Z

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

+
+2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network.
+
+3. **No NAT Traversal Issues**: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-premise users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality.


Suggested change

3. **No NAT Traversal Issues**: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-premise users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality.

3. **No NAT traversal issues**: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-premise users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality.

…or hybrid users (#17822) * Initial commit * Updating images * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]> * Apply suggestions from code review Co-authored-by: ranbel <[email protected]> * Update deploying-self-hosted-VoIP-services-for-hybrid-users.mdx * Update deploying-self-hosted-VoIP-services-for-hybrid-users.mdx * import missing component --------- Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> Co-authored-by: ranbel <[email protected]>

securitypedant added 2 commits October 24, 2024 18:02

Initial commit

2052b47

Updating images

aac1280

securitypedant requested review from a team and crwaters16 as code owners October 28, 2024 17:01

github-actions bot added size/l product:reference-architecture labels Oct 28, 2024

github-actions bot assigned crwaters16 Oct 28, 2024

hyperlint-ai bot reviewed Oct 28, 2024

View reviewed changes

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Outdated Show resolved Hide resolved

...eference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Outdated Show resolved Hide resolved

securitypedant and others added 2 commits October 28, 2024 10:02

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

db53835

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

5611cad

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com>

ranbel reviewed Oct 29, 2024

View reviewed changes

ranbel self-assigned this Oct 30, 2024

securitypedant and others added 12 commits October 30, 2024 14:43

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

456fde6

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

24784af

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

b31b1d4

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

42d6d45

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

dd22e45

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

d37c206

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

1d3d878

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Update src/content/docs/reference-architecture/diagrams/sase/deployin…

d7f3245

…g-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <[email protected]>

Apply suggestions from code review

eb81f92

Co-authored-by: ranbel <[email protected]>

Update deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

9406c04

Update deploying-self-hosted-VoIP-services-for-hybrid-users.mdx

aaca61d

import missing component

e7a3ddd

ranbel approved these changes Oct 31, 2024

View reviewed changes

securitypedant merged commit 3ade708 into production Oct 31, 2024
13 checks passed

securitypedant deleted the sthorpe-deploying-self-hosted-VoIP-services-for-hybrid-users branch October 31, 2024 00:12

securitypedant restored the sthorpe-deploying-self-hosted-VoIP-services-for-hybrid-users branch October 31, 2024 00:13

securitypedant deleted the sthorpe-deploying-self-hosted-VoIP-services-for-hybrid-users branch December 10, 2024 19:46


		Cloudflare improves over traditional VPN solutions by leveraging its [global network](https://www.cloudflare.com/network/) of data centers in over 300 cities to significantly reduce latency for remote users. When using our device agent, remote users are automatically connected to the nearest Cloudflare data center, thus reducing latency.

		This document explains how Cloudflare can be architected with a self-hosted VoIP service. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users.

	This document explains how Cloudflare can be architected with a self-hosted VoIP service. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users.
	This document explains how to architect a self-hosted VoIP service using Cloudflare products. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users.


		![Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg "Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.")

		The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the <GlossaryTooltip term="CGNAT IP">CGNAT range</GlossaryTooltip>, which is used for the private network created between device agents. The WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications.


		## Call flow examples

		VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, `100.96.0.0/12`. As routing has been established to Cloudflare for `100.96.0.0/12` and to the on-prem network of `10.0.50.0/24`, call flows will work as normal – both direct and indirect media are supported.


		### Remote user calling another remote user

		When calls are made from user to user, some traffic flows from user devices through Cloudflare to the on-premises server, while other traffic flows through Cloudflare directly to the other user. Note that the device agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server.


		The above diagram shows the high level signaling and media paths.

		1. Alice registers directly with the SIP server (`10.0.50.60`) with her Cloudflare assigned CGNAT IP of `100.96.0.12`.

	7. Bob will send audio to Alice at 100.96.0.12, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at 10.0.50.101, which will be sent from Cloudflare across the WARP Connector to the on-premise local network.
	7. Bob will send audio to Alice at `100.96.0.12`, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at `10.0.50.101`, which will be sent from Cloudflare across the WARP Connector to the on-premise local network.


		## Summary

		Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits:

	Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits:
	With Cloudflare's WARP Connector, remote users communicating with other remote users or on-premise users via on-premise SIP servers will have a seamless and secure experience for both ends. Key benefits include:


		Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits:

		1. Bidirectional Connectivity: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using an encrypted tunnel, ensuring data integrity and encryption.


		1. Bidirectional Connectivity: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using an encrypted tunnel, ensuring data integrity and encryption.

		2. Private Communication Over CGNAT: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network.


		2. Private Communication Over CGNAT: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network.

		3. No NAT Traversal Issues: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-premise users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality.

Reference Architecture Diagram: Deploying self hosted VoIP services for hybrid users #17822

Reference Architecture Diagram: Deploying self hosted VoIP services for hybrid users #17822

Uh oh!

Conversation

securitypedant commented Oct 28, 2024

Summary

Screenshots (optional)

Documentation checklist

Uh oh!

hyperlint-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Oct 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying cloudflare-docs with Cloudflare Pages

Uh oh!

github-actions bot commented Oct 28, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ranbel left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cloudflare-workers-and-pages bot commented Oct 28, 2024 •

edited

Loading