Skip to content

[ZT] Gateway proxy and global WARP settings in Terraform #23083

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 18, 2025
Merged

[ZT] Gateway proxy and global WARP settings in Terraform #23083

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e7cb546
enable gateway proxy
ranbel Jun 17, 2025
8c14c08
global warp settings
ranbel Jun 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions ...content/docs/learning-paths/replace-vpn/configure-device-agent/enable-proxy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,4 @@ import { Render } from "~/components"

## Enable the proxy

<Render file="tunnel/enable-gateway-proxy" product="cloudflare-one" />

Cloudflare will now proxy traffic from enrolled devices, except for the traffic excluded in your [split tunnel settings](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#3-route-private-network-ips-through-warp). For more information on how Gateway forwards traffic, refer to [Gateway proxy](/cloudflare-one/policies/gateway/proxy/).
<Render file="tunnel/enable-gateway-proxy" product="cloudflare-one" />
13 changes: 12 additions & 1 deletion src/content/partials/cloudflare-one/tunnel/enable-gateway-proxy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,18 @@ import { Tabs, TabItem } from "~/components";
</TabItem>
<TabItem label="Terraform (v5)">

Proxy settings are not currently supported by the Terraform v5 provider (as of version 5.3.0). To turn on the Gateway proxy, use the dashboard or API.
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
- `Zero Trust Write`

2. Turn on the TCP and/or UDP proxy using the [`cloudflare_zero_trust_device_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_settings) resource:

```tf
resource "cloudflare_zero_trust_device_settings "global_warp_settings" {
account_id = var.cloudflare_account_id
gateway_proxy_enabled = true
gateway_udp_proxy_enabled = true
}
```

</TabItem>
</Tabs>
Expand Down
13 changes: 11 additions & 2 deletions src/content/partials/learning-paths/zero-trust/device-profiles.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ To customize the default settings:

4. Save the profile.

5. Under [**Global settings**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#global-settings),
5. Configure [global settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#global-settings) for all device profiles:
1. (Recommended) Enable **Admin override code** if you turned on **Lock WARP switch**.
2. Enable **Install CA to system certificate store** if you want users to see a [custom block page](/cloudflare-one/policies/gateway/block-page/).

Expand Down Expand Up @@ -105,7 +105,16 @@ https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/settings \
}
```

3. [Global settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#global-settings) are not currently supported by the Terraform v5 provider (as of version 5.3.0). To turn on **Admin override code** and **Install CA to system certificate store**, use the dashboard or API.
3. Configure [global settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#global-settings) using the [`cloudflare_zero_trust_device_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_settings) resource:

```tf
resource "cloudflare_zero_trust_device_settings" "global_warp_settings" {
account_id = var.cloudflare_account_id
disable_for_time = 3600
root_certificate_installation_enabled = true
use_zt_virtual_ip = false
}
```

</TabItem>
</Tabs>
Expand Down