Skip to content

[CF1] firewall IPs clarification #23643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Jul 16, 2025
Merged

[CF1] firewall IPs clarification #23643

merged 7 commits into from
Jul 16, 2025

Conversation

@deadlypants1973
Copy link
Contributor

@deadlypants1973 deadlypants1973 commented Jul 14, 2025 •
edited
Loading

Summary

PCX-18179
related to #16062

Screenshots (optional)

Documentation checklist

  • The documentation style guide has been adhered to.
  • If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
  • Files which have changed name or location have been allocated redirects.

@deadlypants1973 deadlypants1973 requested review from a team and ranbel as code owners July 14, 2025 17:17
@hyperlint-ai
Copy link
Contributor

hyperlint-ai bot commented Jul 14, 2025

Howdy and thanks for contributing to our repo. The Cloudflare team reviews new, external PRs within two (2) weeks. If it's been two weeks or longer without any movement, please tag the PR Assignees in a comment.

We review internal PRs within 1 week. If it's something urgent or has been sitting without a comment, start a thread in the Developer Docs space internally.

PR Change Summary

Clarified the IP addresses associated with various Cloudflare domains in the firewall documentation.

  • Added notes about hardcoded IP addresses for specific Cloudflare domains.
  • Updated firewall requirements for connectivity-related domains.
  • Clarified that certain domains may resolve to different IPs but are hardcoded to specific addresses.

Modified Files

  • src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx
How can I customize these reviews?

Check out the Hyperlint AI Reviewer docs for more information on how to customize the review.

If you just want to ignore it on this PR, you can add the hyperlint-ignore label to the PR. Future changes won't trigger a Hyperlint review.

Note specifically for link checks, we only check the first 30 links in a file and we cache the results for several hours (for instance, if you just added a page, you might experience this). Our recommendation is to add hyperlint-ignore to the PR to ignore the link check for this PR.

@github-actions
Copy link
Contributor

github-actions bot commented Jul 14, 2025 •
edited
Loading

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern Owners
/src/content/docs/cloudflare-one/connections/connect-devices/ @kkrum, @kokolocomotion1, @ranbel, @cloudflare/pcx-technical-writing
* @cloudflare/pcx-technical-writing

@github-actions
Copy link
Contributor

github-actions bot commented Jul 14, 2025 •
edited
Loading

Preview URL: https://ad1dd2a9.preview.developers.cloudflare.com
Preview Branch URL: https://kate-fixes-warp-ips.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link Updated Link
https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/ https://kate-fixes-warp-ips.preview.developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/

maxvp
maxvp reviewed Jul 15, 2025
View reviewed changes
src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx Outdated
Because this check happens inside of the tunnel, you do not need to add these IPs to your firewall allowlist. However, since the requests go through Gateway, ensure that they are not blocked by a Gateway HTTP or Network policy.

Thought it may be visible in `warp-diag` and other logs, `connectivity.cloudflareclient.com` is used internally by WARP and should not be used in firewall policies.
If your firewall allows traffic only by domain, you may need to explicitly allow `connectivity.cloudflareclient.com`. Even though `connectivity.cloudflareclient.com` may resolve to different IP addresses, WARP overrides the resolved IPs with the IPs listed above. To avoid connectivity issues, ensure that the above IPs are permitted through your firewall.
Copy link
Contributor

@maxvp maxvp Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be better to create a flexible partial for these sections of text?

@github-actions github-actions bot added size/s and removed size/xs labels Jul 16, 2025
@deadlypants1973 deadlypants1973 merged commit bbc6a4e into production Jul 16, 2025
11 checks passed
@deadlypants1973 deadlypants1973 deleted the kate/fixes-warp-ips branch July 16, 2025 16:43
@jamie-sandbox jamie-sandbox mentioned this pull request Jul 23, 2025
Closed
sdnts pushed a commit to sdnts/cloudflare-docs that referenced this pull request Jul 24, 2025
@deadlypants1973 @ranbel
@maxvp @sdnts
[CF1] firewall IPs clarification (cloudflare#23643)
9f1c70b 
* [CF1] firewall IPs clarification

* Apply suggestions from code review

Co-authored-by: ranbel <[email protected]>

* Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx

* Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx

* Apply suggestions from code review

* Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx

Co-authored-by: Max Phillips <[email protected]>

* partial

---------

Co-authored-by: ranbel <[email protected]>
Co-authored-by: Max Phillips <[email protected]>
thomasgauvin pushed a commit that referenced this pull request Aug 15, 2025
@deadlypants1973 @ranbel
@maxvp @thomasgauvin
[CF1] firewall IPs clarification (#23643)
0dc5693 
* [CF1] firewall IPs clarification

* Apply suggestions from code review

Co-authored-by: ranbel <[email protected]>

* Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx

* Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx

* Apply suggestions from code review

* Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx

Co-authored-by: Max Phillips <[email protected]>

* partial

---------

Co-authored-by: ranbel <[email protected]>
Co-authored-by: Max Phillips <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ranbel ranbel ranbel left review comments

@maxvp maxvp maxvp approved these changes

Assignees

@ranbel ranbel

Labels

product:cloudflare-one size/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@deadlypants1973 @maxvp @ranbel