`. You may also navigate directly to this URL.
+4. Select the port that you want to connect to. The port selection screen only appears if the Access application allows RDP traffic on multiple ports (for example, port `3389` and port `65321`).
+5. Enter your Windows username and password.
+
+You now have access to the remote Windows desktop.
+
+## Product compatibility
+
+
+
+
diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication.mdx
new file mode 100644
index 000000000000000..586c6147dd6535a
--- /dev/null
+++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication.mdx
@@ -0,0 +1,52 @@
+---
+pcx_content_type: how-to
+title: Connect to RDP with client-side cloudflared
+sidebar:
+ order: 5
+ label: RDP with client-side cloudflared
+---
+
+import { Render } from "~/components";
+
+End users can connect to an RDP server without the WARP client by authenticating through `cloudflared` in their native terminal. This method requires having `cloudflared` installed on both the server machine and on the client machine, as well as an active zone on Cloudflare. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials.
+
+Client-side `cloudflared` can be used in conjunction with [routing over WARP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel/) and [Browser-based RDP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method.
+
+## 1. Connect the server to Cloudflare
+
+1. Create a Cloudflare Tunnel by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/).
+
+2. In the **Public Hostnames** tab, choose a domain from the drop-down menu and specify any subdomain (for example, `rdp.example.com`).
+
+3. For **Service**, select _RDP_ and enter the [RDP listening port](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port) of your server (for example, `localhost:3389`). It will likely be port `3389`.
+
+4. Select **Save hostname**.
+
+## 2. (Recommended) Create an Access application
+
+By default, anyone on the Internet can connect to the server using its public hostname. To allow or block specific users, create a [self-hosted application](/cloudflare-one/applications/configure-apps/self-hosted-public-app/) in Cloudflare Access.
+
+## 3. Connect as a user
+
+1. [Install `cloudflared`](/cloudflare-one/connections/connect-networks/downloads/) on the client machine.
+2. Run this command to open an RDP listening port:
+
+ ```sh
+ cloudflared access rdp --hostname rdp.example.com --url rdp://localhost:3389
+ ```
+
+ This process will need to be configured to stay alive and autostart. If the process is killed, users will not be able to connect.
+
+:::note
+
+If the client machine is running Windows, port `3389` may already be consumed locally. Select an alternative port to `3389` that is not being used.
+:::
+
+3. While `cloudflared access` is running, connect from an RDP client such as Microsoft Remote Desktop:
+ 1. Open Microsoft Remote Desktop and select **Add a PC**.
+ 2. For **PC name**, enter `localhost:3389`.
+ 3. For **User account**, enter your RDP server username and password.
+ 4. Double-click the newly added PC.
+ 5. When asked if you want to continue, select **Continue**.
+
+When the client launches, a browser window will open and prompt the user to authenticate with Cloudflare Access.
\ No newline at end of file
diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx
new file mode 100644
index 000000000000000..b4cf0deff5f042c
--- /dev/null
+++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx
@@ -0,0 +1,79 @@
+---
+pcx_content_type: how-to
+title: Connect to RDP using WARP
+sidebar:
+ order: 2
+ label: RDP with WARP client
+---
+
+import { Render } from "~/components";
+
+Cloudflare WARP to Tunnel allows users to connect to RDP servers using their preferred RDP client. Cloudflare Tunnel creates a secure, outbound-only connection from your RDP server to Cloudflare's global network; this requires running the `cloudflared` daemon on the server (or any other host machine within the private network). Users install the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device and enroll in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can connect to the RDP server unless you build policies to allow or block specific users.
+
+This example walks through how to set up an RDP server on a Google Cloud Platform (GCP) virtual machine (VM), but you can use any machine that supports RDP connections.
+
+## 1. Set up an RDP server in GCP
+
+1. In your [Google Cloud Console](https://console.cloud.google.com/), [create a new project](https://developers.google.com/workspace/guides/create-project).
+2. Go to **Compute Engine** > **VM instances**.
+3. Select **Create instance**.
+4. Name your VM instance, for example `windows-rdp-server`.
+5. Configure your VM instance:
+ 1. Scroll down to **Boot Disk** and select **Change**.
+ 2. For **Operating system**, select _Windows Server_.
+ 3. Choose a **Version** with Desktop Experience, for example _Windows Server 2016 Datacenter_.
+6. Once your VM is running, open the dropdown next to **RDP** and select _View gcloud command to reset password_.
+7. Select **Run in Cloud Shell**.
+8. Run the command in the Cloud Shell terminal. You will be asked to confirm the password reset.
+9. Copy the auto-generated password and username to a safe place.
+
+## 2. Install Microsoft Remote Desktop
+
+You can use any RDP client to access and configure the RDP server.
+
+To access the server through Microsoft Remote Desktop:
+
+1. Download and install [Microsoft Remote Desktop](https://apps.microsoft.com/store/detail/microsoft-remote-desktop/9WZDNCRFJ3PS).
+2. Once downloaded, open Microsoft Remote Desktop and select **Add a PC**.
+3. For **PC name**, enter the public IP address of your RDP server. In GCP, this is the **External IP** of the VM instance.
+4. For **User account**, select **Add User Account** and enter your auto-generated password and username.
+5. Select **Add**. The PC will display in Microsoft Remote Desktop.
+6. To test basic connectivity, double-click the newly added PC.
+7. When asked if you want to continue, select **Continue**.
+
+You can now remotely access the RDP server using its public IP. The next steps will configure access to the server using its private IP.
+
+:::note
+
+By default, Internet Explorer will be installed and configured in [Enhanced Security mode](https://learn.microsoft.com/troubleshoot/developer/browsers/security-privacy/enhanced-security-configuration-faq#internet-explorer-enhanced-security-configuration). If the browser is slow or unable to load, you can turn off Enhanced Security and install an alternate browser such as Google Chrome.
+:::
+
+## 3. Connect the server to Cloudflare
+
+
+
+2. In the **Private Networks** tab for the tunnel, enter the private IP or CIDR address of your server. In GCP, the server IP is the **Internal IP** of the VM instance.
+
+3. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server.
+
+## 4. Set up the client
+
+
+
+## 5. Route private network IPs through WARP
+
+
+
+## 6. Connect as a user
+
+Once the WARP client is configured, you can use your RDP client to connect to the server's private IP address (instead of the public IP address used initially).
+
+To connect in Microsoft Remote Desktop:
+
+1. Open Microsoft Remote Desktop and select **Add a PC**.
+2. For **PC name**, enter the private IP address of your RDP server. In GCP, this is the **Internal IP** of the VM instance.
+3. For **User account**, enter your RDP server username and password.
+4. To test Zero Trust connectivity, double-click the newly added PC.
+5. When asked if you want to continue, select **Continue**.
+
+You now have secure, remote access to the RDP server.
\ No newline at end of file
diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx
index 8c099811d2aafe6..deb7934716b6050 100644
--- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx
+++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx
@@ -20,14 +20,13 @@ While SMB was developed for Microsoft Windows, Samba provides SMB connectivity f
## Connect to SMB server with WARP to Tunnel
-
+You can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare's global network. This requires running the `cloudflared` daemon on the server. Users reach the service by installing the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can access the service unless you build policies to allow or block specific users.
### 1. Connect the server to Cloudflare
-1. Create a Cloudflare Tunnel for your server by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). You can skip the connect an application step and go straight to connecting a network.
-
-2. In the **Private Networks** tab for the tunnel, enter the private IP address of your server (or a range that includes the server IP).
+
+2. In the **Private Networks** tab for the tunnel, enter the private IP or CIDR address of your server.
3. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server.
### 2. Set up the client
@@ -60,7 +59,9 @@ While SMB was developed for Microsoft Windows, Samba provides SMB connectivity f
## Connect to SMB server with `cloudflared access`
-
+Cloudflare Tunnel can also route applications through a public hostname, which allows users to connect to the application without the WARP client. This method requires having `cloudflared` installed on both the server machine and on the client machine, as well as an active zone on Cloudflare. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials.
+
+The public hostname method can be implemented in conjunction with routing over WARP so that there are multiple ways to connect to the server. You can reuse the same tunnel for both the private network and public hostname routes.
### 1. Connect the server to Cloudflare
diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx
index 639d887bd9d861b..03c3b7a2c805792 100644
--- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx
+++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx
@@ -20,9 +20,9 @@ import { Tabs, TabItem, Badge, Render } from "~/components";
## 1. Connect the server to Cloudflare
-1. Create a Cloudflare Tunnel for your server by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). You can skip the connect an application step and go straight to connecting a network.
+
-2. In the **Private Networks** tab for the tunnel, enter the IP address of your server (or a range that includes the server IP). Typically this would be a private IP, but public IPs are also allowed.
+
## 2. Set up the client
@@ -38,7 +38,7 @@ To connect your devices to Cloudflare:
## 4. Add a target
-
+
## 5. Add an infrastructure application
diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx
index e1b87ef1cd3b5bd..3866ba385beb7ad 100644
--- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx
+++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx
@@ -59,7 +59,11 @@ In order to be able to establish an SSH connection, do not enable [OS Login](htt
## 3. Connect the server to Cloudflare
-
+
+
+2. In the **Private Networks** tab for the tunnel, enter the private IP or CIDR address of your server. In GCP, the server IP is the **Internal IP** of the VM instance.
+
+3. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server.
## 4. Set up the client
diff --git a/src/content/docs/cloudflare-one/identity/users/session-management.mdx b/src/content/docs/cloudflare-one/identity/users/session-management.mdx
index eb1f04b69440d97..bd677d73491f28a 100644
--- a/src/content/docs/cloudflare-one/identity/users/session-management.mdx
+++ b/src/content/docs/cloudflare-one/identity/users/session-management.mdx
@@ -47,9 +47,13 @@ You can set an application session duration for self-hosted and private Access a
The application token will expire after this period of time (unless you have set a [policy session duration](#set-policy-session-duration)).
-#### SaaS application sessions
+#### SaaS applications
-
+
+
+#### SSH, RDP, and VNC
+
+
### Set policy session duration
diff --git a/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx b/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx
index 9c6e059dbc4379c..fba100ca701bb36 100644
--- a/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx
+++ b/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx
@@ -84,7 +84,7 @@ Identity-based authentication logs contain the following fields:
| **IP address** | IP address of the authenticating user. |
| **App UID** | UUID of the Access application. |
| **App domain** | URL of the Access application. |
-| **App type** | The type specifies if the Access application is self-hosted, SaaS, or infrastructure. |
+| **App type** | Specifies the type of Access application: self-hosted, browser SSH, browser VNC, browser RDP, SaaS, or infrastructure. |
| **Event** | Type of authentication event, such as a login attempt. |
| **Connection** | IdP used to authenticate. |
| **Allow** | Result of the authentication event. |
diff --git a/src/content/docs/learning-paths/zero-trust-web-access/access-application/create-access-app.mdx b/src/content/docs/learning-paths/zero-trust-web-access/access-application/create-access-app.mdx
index 9584d8f4e849738..cb00cfbae1c5025 100644
--- a/src/content/docs/learning-paths/zero-trust-web-access/access-application/create-access-app.mdx
+++ b/src/content/docs/learning-paths/zero-trust-web-access/access-application/create-access-app.mdx
@@ -14,6 +14,6 @@ Each application can have multiple policies with different constraints depending
## Add your application to Access
-
+
When users go to the application, they will be prompted to login with your identity provider.
diff --git a/src/content/partials/cloudflare-one/access/add-access-policies.mdx b/src/content/partials/cloudflare-one/access/add-access-policies.mdx
new file mode 100644
index 000000000000000..d497342ed365f0f
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/add-access-policies.mdx
@@ -0,0 +1,5 @@
+---
+{}
+---
+
+Add [Access policies](/cloudflare-one/policies/access/) to control who can connect to your application. All Access applications are deny by default -- a user must match an Allow policy before they are granted access.
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/access/add-target.mdx b/src/content/partials/cloudflare-one/access/add-target.mdx
index 8f996522e09d6c0..b4746a37622d083 100644
--- a/src/content/partials/cloudflare-one/access/add-target.mdx
+++ b/src/content/partials/cloudflare-one/access/add-target.mdx
@@ -1,12 +1,18 @@
---
-{}
+params:
+ - protocol
---
import { Tabs, TabItem, Render, Details } from "~/components";
-A target represents a single resource in your infrastructure (such as a server, Kubernetes cluster, database, or container) that users will connect to through Cloudflare. Targets are protocol-agnostic, meaning that you do not need to define a new target for each protocol that runs on the server.
+A target represents a single resource in your infrastructure (such as a server, Kubernetes cluster, database, or container) that users will connect to through Cloudflare.
-To create a new target:
+{
+ props.protocol === "rdp" ? (
+ Create a target for each Windows machine that requires RDP access.
+To create a new target:
) :
+ (Targets are protocol-agnostic, meaning that you do not need to define a new target for each protocol that runs on the server. To create a new target:
)
+}
@@ -55,14 +61,14 @@ If the target IP does not appear in the dropdown, go to **Networks** > **Routes*
```
-
+
:::note[Provider versions]
The following example requires Cloudflare provider version `>=4.45.0`.
:::
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/api_token):
- - `Teams Write`
+ - `Zero Trust Write`
2. Configure the [`cloudflare_zero_trust_infrastructure_access_target`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_infrastructure_access_target) resource:
@@ -86,4 +92,4 @@ The following example requires Cloudflare provider version `>=4.45.0`.
-Next, create an infrastructure application to secure the target.
\ No newline at end of file
+Next, create an Access application to secure the target.
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app.mdx
deleted file mode 100644
index 7d11ef74287cf85..000000000000000
--- a/src/content/partials/cloudflare-one/access/self-hosted-app.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-{}
-
----
-
-import { Render } from "~/components"
-
-1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Applications**.
-
-2. Select **Add an application**.
-
-3. Select **Self-hosted**.
-
-4. Enter any name for the application.
-
-5. In **Session Duration**, choose how often the user's [application token](/cloudflare-one/identity/authorization-cookie/application-token/) should expire.
-
- Cloudflare checks every HTTP request to your application for a valid application token. If the user's application token (and global token) has expired, they will be prompted to reauthenticate with the IdP. For more information, refer to [Session management](/cloudflare-one/identity/users/session-management/).
-
-6. Select **Add public hostname**.
-
-7. In the **Domain** dropdown, select the domain that will represent the application. Domains must belong to an active zone in your Cloudflare account. You can use [wildcards](/cloudflare-one/policies/access/app-paths/) to protect multiple parts of an application that share a root path.
-
- Alternatively, to use a [Cloudflare for SaaS custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access/), set **Input method** to _Custom_ and enter your custom hostname.
-
-8. Add [Access policies](/cloudflare-one/policies/access/) to control who can connect to your application. All Access applications are deny by default -- a user must match an Allow policy before they are granted access.
-
-9.
-
-10. Select **Next**.
-
-11. (Optional) Configure [App Launcher settings](/cloudflare-one/applications/app-launcher/) for the application.
-
-12.
-
-13. Select **Next**.
-
-14. (Optional) Configure advanced settings for your application:
-
- - [**Cross-Origin Resource Sharing (CORS) settings**](/cloudflare-one/identity/authorization-cookie/cors/)
- - [**Cookie settings**](/cloudflare-one/identity/authorization-cookie/#cookie-settings)
- - **Browser rendering settings**:
- - [Automatic `cloudflared` authentication](/cloudflare-one/applications/non-http/cloudflared-authentication/automatic-cloudflared-authentication/)
- - [Browser rendering for SSH and VNC](/cloudflare-one/applications/non-http/browser-rendering/)
- - **401 Response for Service Auth policies**: Return a `401` response code when a user (or machine) makes a request to the application without the correct [service token](/cloudflare-one/identity/service-tokens/).
-
-15. Select **Save**.
-
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app/advanced-settings.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app/advanced-settings.mdx
new file mode 100644
index 000000000000000..d526a33967505cf
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/self-hosted-app/advanced-settings.mdx
@@ -0,0 +1,10 @@
+---
+{}
+
+---
+
+(Optional) Configure advanced settings:
+
+ - [**Cross-Origin Resource Sharing (CORS) settings**](/cloudflare-one/identity/authorization-cookie/cors/)
+ - [**Cookie settings**](/cloudflare-one/identity/authorization-cookie/#cookie-settings)
+ - **401 Response for Service Auth policies**: Return a `401` response code when a user (or machine) makes a request to the application without the correct [service token](/cloudflare-one/identity/service-tokens/).
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app/choose-domain.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app/choose-domain.mdx
new file mode 100644
index 000000000000000..bf5c7dae842e9f3
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/self-hosted-app/choose-domain.mdx
@@ -0,0 +1,10 @@
+---
+{}
+
+---
+
+import { Render } from "~/components"
+
+In the **Domain** dropdown, select the domain that will represent the application. Domains must belong to an active zone in your Cloudflare account. You can use [wildcards](/cloudflare-one/policies/access/app-paths/) to protect multiple parts of an application that share a root path.
+
+ Alternatively, to use a [Cloudflare for SaaS custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access/), set **Input method** to _Custom_ and enter your custom hostname.
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app/create-app.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app/create-app.mdx
new file mode 100644
index 000000000000000..5c57c4fb2c84f0b
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/self-hosted-app/create-app.mdx
@@ -0,0 +1,24 @@
+---
+params:
+ - private?
+
+---
+
+import { Render } from "~/components"
+
+1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Applications**.
+
+2. Select **Add an application**.
+
+3. Select **Self-hosted**.
+
+4. Enter any name for the application.
+
+5. In **Session Duration**, choose how often the user's [application token](/cloudflare-one/identity/authorization-cookie/application-token/) should expire.
+
+ Cloudflare checks every HTTP request to your application for a valid application token. If the user's application token (and global token) has expired, they will be prompted to reauthenticate with the IdP. For more information, refer to [Session management](/cloudflare-one/identity/users/session-management/).
+
+ {
+ props.private && (
+ If the application is non-HTTPS or you do not have TLS decryption turned on, the session is tracked by the WARP client per application.
)
+ }
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app/generic-public-app.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app/generic-public-app.mdx
new file mode 100644
index 000000000000000..1e0eb4a75d0904f
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/self-hosted-app/generic-public-app.mdx
@@ -0,0 +1,33 @@
+---
+{}
+
+---
+
+import { Render } from "~/components"
+
+
+
+6. Select **Add public hostname**.
+
+7.
+
+8. (Optional) Configure **Browser rendering settings**:
+ - [Automatic `cloudflared` authentication](/cloudflare-one/applications/non-http/cloudflared-authentication/automatic-cloudflared-authentication/)
+ - [Browser rendering for SSH, VNC, or RDP](/cloudflare-one/applications/non-http/browser-rendering/)
+
+9.
+
+10.
+
+11. Select **Next**.
+
+12. (Optional) Configure [App Launcher settings](/cloudflare-one/applications/app-launcher/) for the application.
+
+13.
+
+14. Select **Next**.
+
+15.
+
+16. Select **Save**.
+
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app/product-compatibility.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app/product-compatibility.mdx
new file mode 100644
index 000000000000000..9e400c75a7667fb
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/self-hosted-app/product-compatibility.mdx
@@ -0,0 +1,13 @@
+---
+{}
+
+---
+When using Access self-hosted applications, the majority of Cloudflare products will be compatible with your application.
+
+However, the following products are not supported:
+
+* [Automatic Signed Exchanges](/speed/optimization/other/signed-exchanges/)
+* [Automatic Platform Optimization](/automatic-platform-optimization)
+* [Zaraz](/zaraz)
+
+You can disable Automatic Signed Exchanges and Zaraz for a specific application - instead of across your entire zone - using a [Configuration Rule](/rules/configuration-rules/) scoped to the application domain.
diff --git a/src/content/partials/cloudflare-one/access/self-hosted-app/ssh-sessions.mdx b/src/content/partials/cloudflare-one/access/self-hosted-app/ssh-sessions.mdx
new file mode 100644
index 000000000000000..ca8503c7fd89819
--- /dev/null
+++ b/src/content/partials/cloudflare-one/access/self-hosted-app/ssh-sessions.mdx
@@ -0,0 +1,5 @@
+---
+{}
+---
+
+Cloudflare does not control the length of an active SSH, VNC, or RDP session. [Application session durations](/cloudflare-one/identity/users/session-management/) determine the window in which a user can initiate a new connection or refresh an existing one.
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/tunnel/cloudflared-access.mdx b/src/content/partials/cloudflare-one/tunnel/cloudflared-access.mdx
deleted file mode 100644
index a038fdfb2bb4cac..000000000000000
--- a/src/content/partials/cloudflare-one/tunnel/cloudflared-access.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
----
-{}
-
----
-
-Cloudflare Tunnel can also route applications through a public hostname, which allows users to connect to the application without the WARP client. This method requires having `cloudflared` installed on both the server machine and on the client machine, as well as an active zone on Cloudflare. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials.
-
-The public hostname method can be implemented in conjunction with routing over WARP so that there are multiple ways to connect to the server. You can reuse the same tunnel for both the private network and public hostname routes.
diff --git a/src/content/partials/cloudflare-one/tunnel/connect-private-network-infra-access.mdx b/src/content/partials/cloudflare-one/tunnel/connect-private-network-infra-access.mdx
new file mode 100644
index 000000000000000..5b5bc56a5f07b77
--- /dev/null
+++ b/src/content/partials/cloudflare-one/tunnel/connect-private-network-infra-access.mdx
@@ -0,0 +1,5 @@
+---
+{}
+---
+
+2. In the **Private Networks** tab for the tunnel, enter the IP or CIDR address of your server. Typically this would be a private IP, but public IPs are also allowed.
diff --git a/src/content/partials/cloudflare-one/tunnel/connect-private-network.mdx b/src/content/partials/cloudflare-one/tunnel/connect-private-network.mdx
new file mode 100644
index 000000000000000..1883b68dbb47e6b
--- /dev/null
+++ b/src/content/partials/cloudflare-one/tunnel/connect-private-network.mdx
@@ -0,0 +1,5 @@
+---
+{}
+---
+
+1. Create a Cloudflare Tunnel for your server by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). You can skip the [connect an application step](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-connect-an-application) and go straight to connecting a network.
diff --git a/src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-intro.mdx b/src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-intro.mdx
deleted file mode 100644
index 52d7380fe027c4e..000000000000000
--- a/src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-intro.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
----
-{}
-
----
-
-You can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare's global network. This requires running the `cloudflared` daemon on the server. Users reach the service by installing the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can access the service unless you build policies to allow or block specific users.
diff --git a/src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-server.mdx b/src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-server.mdx
deleted file mode 100644
index cec90f2323525a6..000000000000000
--- a/src/content/partials/cloudflare-one/tunnel/warp-to-tunnel-server.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-{}
-
----
-
-1. Create a Cloudflare Tunnel for your server by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). You can skip the connect an application step and go straight to connecting a network.
-
-2. In the **Private Networks** tab for the tunnel, enter the private IP address of your server (or a range that includes the server IP). In GCP, the server IP is the **Internal IP** of the VM instance.
-
-3. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server.