diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c8d78282060a5e..46822e5714c2b6 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -59,8 +59,8 @@ /src/content/docs/cloudflare-one/applications/ @kennyj42 @ranbel @cloudflare/pcx-technical-writing /src/content/docs/cloudflare-one/identity/ @kennyj42 @ranbel @cloudflare/pcx-technical-writing /src/content/docs/cloudflare-one/policies/access/ @kennyj42 @ranbel @cloudflare/pcx-technical-writing -/src/content/docs/cloudflare-one/connections/connect-devices/ @ranbel @cloudflare/pcx-technical-writing -/src/content/docs/cloudflare-one/connections/connect-networks/ @nikitacano @ranbel @cloudflare/pcx-technical-writing +/src/content/docs/cloudflare-one/team-and-resources/devices/ @ranbel @cloudflare/pcx-technical-writing +/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/ @nikitacano @ranbel @cloudflare/pcx-technical-writing /src/content/docs/cloudflare-one/applications/casb/ @maxvp @cloudflare/pcx-technical-writing /src/content/docs/cloudflare-one/policies/gateway/ @maxvp @cloudflare/pcx-technical-writing /src/content/docs/cloudflare-one/policies/browser-isolation/ @maxvp @ranbel @cloudflare/pcx-technical-writing diff --git a/public/__redirects b/public/__redirects index 5ed0d71be41734..872647ab533822 100644 --- a/public/__redirects +++ b/public/__redirects @@ -2352,6 +2352,8 @@ /logs/get-started/enable-destinations/* /logs/logpush/logpush-job/enable-destinations/:splat 301 /logs/reference/log-fields/* /logs/logpush/logpush-job/datasets/:splat 301 /speed/optimization/other/* /speed/optimization/ 301 +/cloudflare-one/connections/connect-devices/* /cloudflare-one/team-and-resources/devices 301 +/cloudflare-one/connections/connect-networks/* /cloudflare-one/networks/connectors/cloudflare-tunnel/ 301 # AI Crawl Control /ai-audit/* /ai-crawl-control/:splat 301 @@ -2360,6 +2362,7 @@ /autorag/* /ai-search/:splat 301 # Cloudflare One / Zero Trust +/cloudflare-one/connections/ /cloudflare-one/ 301 /cloudflare-one/applications/configure-apps/dash-sso-apps/ /fundamentals/account/account-security/dashboard-sso/ 301 /cloudflare-one/connections/connect-networks/install-and-setup/tunnel-guide/local/as-a-service/* /cloudflare-one/connections/connect-networks/configure-tunnels/local-management/as-a-service/:splat 301 /cloudflare-one/connections/connect-apps/install-and-setup/deployment-guides/* /cloudflare-one/connections/connect-networks/deployment-guides/:splat 301 diff --git a/src/content/changelog/access/2024-10-01-ssh-with-access-for-infrastructure.mdx b/src/content/changelog/access/2024-10-01-ssh-with-access-for-infrastructure.mdx index d6f845be962924..0c668cbc1b535d 100644 --- a/src/content/changelog/access/2024-10-01-ssh-with-access-for-infrastructure.mdx +++ b/src/content/changelog/access/2024-10-01-ssh-with-access-for-infrastructure.mdx @@ -8,7 +8,7 @@ products: Organizations can now eliminate long-lived credentials from their SSH setup and enable strong multi-factor authentication for SSH access, similar to other Access applications, all while generating access and command logs. -SSH with [Access for Infrastructure](/cloudflare-one/applications/non-http/infrastructure-apps/) uses short-lived SSH certificates from Cloudflare, eliminating SSH key management and reducing the security risks associated with lost or stolen keys. It also leverages a common deployment model for Cloudflare One customers: [WARP-to-Tunnel](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/). +SSH with [Access for Infrastructure](/cloudflare-one/applications/non-http/infrastructure-apps/) uses short-lived SSH certificates from Cloudflare, eliminating SSH key management and reducing the security risks associated with lost or stolen keys. It also leverages a common deployment model for Cloudflare One customers: [WARP-to-Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel/). SSH with Access for Infrastructure enables you to: @@ -18,4 +18,4 @@ SSH with Access for Infrastructure enables you to: ![Example of an infrastructure Access application](~/assets/images/changelog/access/infrastructure-app.png) -To get started, refer to [SSH with Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/). +To get started, refer to [SSH with Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/). diff --git a/src/content/changelog/access/2025-07-01-browser-based-rdp-open-beta.mdx b/src/content/changelog/access/2025-07-01-browser-based-rdp-open-beta.mdx index 3278d173d6737d..9a15f6363ef8a0 100644 --- a/src/content/changelog/access/2025-07-01-browser-based-rdp-open-beta.mdx +++ b/src/content/changelog/access/2025-07-01-browser-based-rdp-open-beta.mdx @@ -6,7 +6,7 @@ products: - access --- -[Browser-based RDP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/) with [Cloudflare Access](/cloudflare-one/policies/access/) is now available in open beta for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. +[Browser-based RDP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](/cloudflare-one/policies/access/) is now available in open beta for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. With browser-based RDP, you can: @@ -17,4 +17,4 @@ With browser-based RDP, you can: ![Example of a browsed-based RDP Access application](~/assets/images/changelog/access/browser-based-rdp-access-app.png) -To get started, see [Connect to RDP in a browser](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/). +To get started, see [Connect to RDP in a browser](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). diff --git a/src/content/changelog/access/2025-08-15-sftp.mdx b/src/content/changelog/access/2025-08-15-sftp.mdx index 035c27d1175f33..9dfcae403bca10 100644 --- a/src/content/changelog/access/2025-08-15-sftp.mdx +++ b/src/content/changelog/access/2025-08-15-sftp.mdx @@ -6,4 +6,4 @@ products: - access --- -[SSH with Cloudflare Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) now supports SFTP. It is compatible with SFTP clients, such as Cyberduck. +[SSH with Cloudflare Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) now supports SFTP. It is compatible with SFTP clients, such as Cyberduck. diff --git a/src/content/changelog/access/2025-09-22-browser-based-rdp-ga.mdx b/src/content/changelog/access/2025-09-22-browser-based-rdp-ga.mdx index 6ebfb31f9763c6..211cfde01efae5 100644 --- a/src/content/changelog/access/2025-09-22-browser-based-rdp-ga.mdx +++ b/src/content/changelog/access/2025-09-22-browser-based-rdp-ga.mdx @@ -6,11 +6,11 @@ products: - access --- -[Browser-based RDP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/) with [Cloudflare Access](/cloudflare-one/policies/access/) is now generally available for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. +[Browser-based RDP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](/cloudflare-one/policies/access/) is now generally available for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. Since we announced our [open beta](/changelog/access/#2025-06-30), we've made a few improvements: - Support for targets with IPv6. -- Support for [Magic WAN](/magic-wan/) and [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) as on-ramps. +- Support for [Magic WAN](/magic-wan/) and [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) as on-ramps. - More robust error messaging on the login page to help you if you encounter an issue. - Worldwide keyboard support. Whether your day-to-day is in Portuguese, Chinese, or something in between, your browser-based RDP experience will look and feel exactly like you are using a desktop RDP client. - Cleaned up some other miscellaneous issues, including but not limited to enhanced support for Entra ID accounts and support for usernames with spaces, quotes, and special characters. @@ -24,4 +24,4 @@ As a refresher, here are some benefits browser-based RDP provides: ![Example of a browser-based RDP Access application](~/assets/images/changelog/access/browser-based-rdp-access-app.png) -To get started, refer to [Connect to RDP in a browser](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/). +To get started, refer to [Connect to RDP in a browser](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). diff --git a/src/content/changelog/cloudflare-tunnel/2024-12-19-diagnostic-logs.mdx b/src/content/changelog/cloudflare-tunnel/2024-12-19-diagnostic-logs.mdx index ec4c32f5081fe9..267fccac7ca1bb 100644 --- a/src/content/changelog/cloudflare-tunnel/2024-12-19-diagnostic-logs.mdx +++ b/src/content/changelog/cloudflare-tunnel/2024-12-19-diagnostic-logs.mdx @@ -12,4 +12,4 @@ A diagnostic report collects data from a single instance of `cloudflared` runnin -For more information, refer to [Diagnostic logs](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs/). +For more information, refer to [Diagnostic logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs/). diff --git a/src/content/changelog/cloudflare-tunnel/2025-07-15-udp-improvements.mdx b/src/content/changelog/cloudflare-tunnel/2025-07-15-udp-improvements.mdx index 893c2fc21807df..2167d606318510 100644 --- a/src/content/changelog/cloudflare-tunnel/2025-07-15-udp-improvements.mdx +++ b/src/content/changelog/cloudflare-tunnel/2025-07-15-udp-improvements.mdx @@ -6,7 +6,7 @@ date: 2025-07-15 import { Render } from "~/components"; -Your real-time applications running over [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/) are now faster and more reliable. We've completely re-architected the way `cloudflared` proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel. +Your real-time applications running over [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) are now faster and more reliable. We've completely re-architected the way `cloudflared` proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel. This is a foundational improvement to Cloudflare Tunnel, delivered automatically to all customers. There are no settings to configure — your UDP traffic is already flowing faster and more reliably. @@ -14,4 +14,4 @@ This is a foundational improvement to Cloudflare Tunnel, delivered automatically - **Faster UDP performance**: We've significantly reduced the latency for establishing new UDP sessions, making applications like private DNS much more responsive. - **Greater reliability for mixed traffic**: UDP packets are no longer affected by heavy TCP traffic, preventing timeouts and connection drops for your real-time services. -Learn more about running [TCP or UDP applications](/reference-architecture/architectures/sase/#connecting-applications) and [private networks](/cloudflare-one/connections/connect-networks/private-net/) through [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/). \ No newline at end of file +Learn more about running [TCP or UDP applications](/reference-architecture/architectures/sase/#connecting-applications) and [private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) through [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/). \ No newline at end of file diff --git a/src/content/changelog/cloudflare-tunnel/2025-09-02-tunnel-networks-list-endpoints-new-default.mdx b/src/content/changelog/cloudflare-tunnel/2025-09-02-tunnel-networks-list-endpoints-new-default.mdx index 419dcfcbfa35c6..6d0b194ceba0f5 100644 --- a/src/content/changelog/cloudflare-tunnel/2025-09-02-tunnel-networks-list-endpoints-new-default.mdx +++ b/src/content/changelog/cloudflare-tunnel/2025-09-02-tunnel-networks-list-endpoints-new-default.mdx @@ -13,8 +13,8 @@ No action is required if you already explicitly set `is_deleted=false` or if you This change affects the following API endpoints: * List all tunnels: [`GET /accounts/{account_id}/tunnels`](/api/resources/zero_trust/subresources/tunnels/methods/list/) -* List [Cloudflare Tunnels](/cloudflare-one/connections/connect-networks/): [`GET /accounts/{account_id}/cfd_tunnel`](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/list/) -* List [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) tunnels: [`GET /accounts/{account_id}/warp_connector`](/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/list/) +* List [Cloudflare Tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/): [`GET /accounts/{account_id}/cfd_tunnel`](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/list/) +* List [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) tunnels: [`GET /accounts/{account_id}/warp_connector`](/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/list/) * List tunnel routes: [`GET /accounts/{account_id}/teamnet/routes`](/api/resources/zero_trust/subresources/networks/subresources/routes/methods/list/) * List subnets: [`GET /accounts/{account_id}/zerotrust/subnets`](/api/resources/zero_trust/subresources/networks/subresources/subnets/methods/list/) * List virtual networks: [`GET /accounts/{account_id}/teamnet/virtual_networks`](/api/resources/zero_trust/subresources/networks/subresources/virtual_networks/methods/list/) diff --git a/src/content/changelog/cloudflare-tunnel/2025-09-18-tunnel-hostname-routing.mdx b/src/content/changelog/cloudflare-tunnel/2025-09-18-tunnel-hostname-routing.mdx index 8256206da02530..4e34d1466bbe61 100644 --- a/src/content/changelog/cloudflare-tunnel/2025-09-18-tunnel-hostname-routing.mdx +++ b/src/content/changelog/cloudflare-tunnel/2025-09-18-tunnel-hostname-routing.mdx @@ -6,9 +6,9 @@ date: 2025-09-18 import { Render } from "~/components"; -You can now route private traffic to [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/) based on a hostname or domain, moving beyond the limitations of IP-based routing. This new capability is **free for all Cloudflare One customers**. +You can now route private traffic to [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) based on a hostname or domain, moving beyond the limitations of IP-based routing. This new capability is **free for all Cloudflare One customers**. -Previously, Tunnel routes could only be defined by IP address or [CIDR range](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/). This created a challenge for modern applications with dynamic or ephemeral IP addresses, often forcing administrators to maintain complex and brittle IP lists. +Previously, Tunnel routes could only be defined by IP address or [CIDR range](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/). This created a challenge for modern applications with dynamic or ephemeral IP addresses, often forcing administrators to maintain complex and brittle IP lists. ![Hostname-based routing in Cloudflare Tunnel](~/assets/images/changelog/cloudflare-one/tunnel-hostname-routing.webp) @@ -18,6 +18,6 @@ Previously, Tunnel routes could only be defined by IP address or [CIDR range](/c - **Precise Egress Control**: Route traffic for public hostnames (e.g., `bank.example.com`) through a specific Tunnel to enforce a dedicated source IP, solving the IP allowlist problem for third-party services. - **No More IP Lists**: This feature makes the workaround of maintaining dynamic IP Lists for Tunnel connections obsolete. -Get started in the Tunnels section of the Zero Trust dashboard with your first [private hostname](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname/) or [public hostname](/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared/) route. +Get started in the Tunnels section of the Zero Trust dashboard with your first [private hostname](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) or [public hostname](/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared/) route. Learn more in our [blog post](https://blog.cloudflare.com/tunnel-hostname-routing/). \ No newline at end of file diff --git a/src/content/changelog/gateway/2025-03-21-pdns-user-locations-role.mdx b/src/content/changelog/gateway/2025-03-21-pdns-user-locations-role.mdx index 80e031d4c3fd07..07dcb4136ba3d0 100644 --- a/src/content/changelog/gateway/2025-03-21-pdns-user-locations-role.mdx +++ b/src/content/changelog/gateway/2025-03-21-pdns-user-locations-role.mdx @@ -7,14 +7,14 @@ products: hidden: false --- -We're excited to introduce the [**Cloudflare Zero Trust Secure DNS Locations Write role**](/cloudflare-one/connections/connect-devices/agentless/dns/locations/#secure-dns-locations), designed to provide DNS filtering customers with granular control over third-party access when configuring their Protective DNS (PDNS) solutions. +We're excited to introduce the [**Cloudflare Zero Trust Secure DNS Locations Write role**](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/#secure-dns-locations), designed to provide DNS filtering customers with granular control over third-party access when configuring their Protective DNS (PDNS) solutions. Many DNS filtering customers rely on external service partners to manage their DNS location endpoints. This role allows you to grant access to external parties to administer DNS locations without overprovisioning their permissions. **Secure DNS Location Requirements:** -- Mandate usage of [Bring your own DNS resolver IP addresses](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip) if available on the account. +- Mandate usage of [Bring your own DNS resolver IP addresses](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip) if available on the account. - Require source network filtering for IPv4/IPv6/DoT endpoints; token authentication or source network filtering for the DoH endpoint. -You can assign the new role via Cloudflare Dashboard (`Manage Accounts > Members`) or via API. For more information, refer to the [Secure DNS Locations documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/dns/locations/#secure-dns-locations). +You can assign the new role via Cloudflare Dashboard (`Manage Accounts > Members`) or via API. For more information, refer to the [Secure DNS Locations documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/agentless/dns/locations/#secure-dns-locations). diff --git a/src/content/changelog/gateway/2025-09-11-dns-filtering-for-private-network-onramps.mdx b/src/content/changelog/gateway/2025-09-11-dns-filtering-for-private-network-onramps.mdx index c22f717847819e..1328b328c1b4ac 100644 --- a/src/content/changelog/gateway/2025-09-11-dns-filtering-for-private-network-onramps.mdx +++ b/src/content/changelog/gateway/2025-09-11-dns-filtering-for-private-network-onramps.mdx @@ -8,7 +8,7 @@ products: date: "2025-09-11" --- -[Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/#dns-filtering) and [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/#configure-dns-resolver-on-devices) users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet. +[Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/#dns-filtering) and [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-internet/#configure-dns-resolver-on-devices) users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet. Routing DNS traffic to the Gateway resolver allows DNS resolution and filtering for traffic coming from private networks while preserving source internal IP visibility. This ensures Magic WAN users have full integration with our Cloudflare One features, including [Internal DNS](/cloudflare-one/policies/gateway/resolver-policies/#internal-dns) and [hostname-based policies](/cloudflare-one/policies/gateway/egress-policies/#selector-prerequisites). diff --git a/src/content/changelog/load-balancing/2025-05-06-private-health-monitoring-methods.mdx b/src/content/changelog/load-balancing/2025-05-06-private-health-monitoring-methods.mdx index ec24d39aa0c7a1..829ea5bc4d55e4 100644 --- a/src/content/changelog/load-balancing/2025-05-06-private-health-monitoring-methods.mdx +++ b/src/content/changelog/load-balancing/2025-05-06-private-health-monitoring-methods.mdx @@ -12,6 +12,6 @@ Cloudflare Load Balancing now supports **UDP (Layer 4)** and **ICMP (Layer 3)** - Use **UDP monitors** for lightweight health checks on non-TCP workloads, such as DNS, VoIP, or custom UDP-based services. - Gain better visibility and uptime guarantees for services running behind **Private Network Load Balancing**, without requiring public IP addresses. -This enhancement is ideal for internal applications that rely on low-level protocols, especially when used in conjunction with [**Cloudflare Tunnel**](/cloudflare-one/connections/connect-networks/), [**WARP**](/cloudflare-one/connections/connect-devices/warp/), and [**Magic WAN**](/magic-wan/) to create a secure and observable private network. +This enhancement is ideal for internal applications that rely on low-level protocols, especially when used in conjunction with [**Cloudflare Tunnel**](/cloudflare-one/networks/connectors/cloudflare-tunnel/), [**WARP**](/cloudflare-one/team-and-resources/devices/warp/), and [**Magic WAN**](/magic-wan/) to create a secure and observable private network. Learn more about [Private Network Load Balancing](/load-balancing/private-network/) or view the full list of [supported health monitor protocols](/load-balancing/monitors/#supported-protocols). diff --git a/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-android.mdx b/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-android.mdx index 20b3d40e08c58c..12d65128c2392d 100644 --- a/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-android.mdx +++ b/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-android.mdx @@ -4,10 +4,10 @@ description: Cloudflare One Agent for Android (version 2.4) date: 2025-03-17 --- -A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release includes a new feature allowing [team name insertion by URL](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. +A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release includes a new feature allowing [team name insertion by URL](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. **Changes and improvements** - Improved in-app error messages. -- Improved mobile client login with support for [team name insertion by URL](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/#enroll-using-a-url). +- Improved mobile client login with support for [team name insertion by URL](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/#enroll-using-a-url). - Fixed an issue preventing admin split tunnel settings taking priority for traffic from certain applications. diff --git a/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-ios.mdx b/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-ios.mdx index 046b998bb37c7d..eaaddb574ba163 100644 --- a/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-ios.mdx +++ b/src/content/changelog/zero-trust-warp/2025-03-17-warp-ga-ios.mdx @@ -4,10 +4,10 @@ description: Cloudflare One Agent for iOS (version 1.10) date: 2025-03-17 --- -A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release includes a new feature allowing [team name insertion by URL](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. +A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release includes a new feature allowing [team name insertion by URL](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. **Changes and improvements** - Improved in-app error messages. -- Improved mobile client login with support for [team name insertion by URL](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/#enroll-using-a-url). +- Improved mobile client login with support for [team name insertion by URL](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/#enroll-using-a-url). - Bug fixes and performance improvements. diff --git a/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-android.mdx b/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-android.mdx index d682d4f41a4726..aa4ac972509945 100644 --- a/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-android.mdx +++ b/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-android.mdx @@ -5,12 +5,12 @@ date: 2025-06-30 --- A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release -contains improvements and new exciting features, including [post-quantum cryptography](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). +contains improvements and new exciting features, including [post-quantum cryptography](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate [protection of post-quantum cryptography](https://blog.cloudflare.com/pq-2024/) without needing to upgrade any of your individual corporate applications or systems. **Changes and improvements** - QLogs are now disabled by default and can be enabled in the app by turning on **Enable qlogs** under **Settings** > **Advanced** > **Diagnostics** > **Debug Logs**. The QLog setting from previous releases will no longer be respected. - DNS over HTTPS traffic is now included in the WARP tunnel by default. -- The WARP client now applies [post-quantum cryptography](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). +- The WARP client now applies [post-quantum cryptography](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). - Fixed an issue that caused WARP connection failures on ChromeOS devices. diff --git a/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-ios.mdx b/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-ios.mdx index 915e015f6774be..e1a10a235b39b8 100644 --- a/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-ios.mdx +++ b/src/content/changelog/zero-trust-warp/2025-06-30-warp-ga-ios.mdx @@ -5,11 +5,11 @@ date: 2025-06-30 --- A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release -contains improvements and new exciting features, including [post-quantum cryptography](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). +contains improvements and new exciting features, including [post-quantum cryptography](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate [protection of post-quantum cryptography](https://blog.cloudflare.com/pq-2024/) without needing to upgrade any of your individual corporate applications or systems. **Changes and improvements** - QLogs are now disabled by default and can be enabled in the app by turning on **Enable qlogs** under **Settings** > **Advanced** > **Diagnostics** > **Debug Logs**. The QLog setting from previous releases will no longer be respected. - DNS over HTTPS traffic is now included in the WARP tunnel by default. -- The WARP client now applies [post-quantum cryptography](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). +- The WARP client now applies [post-quantum cryptography](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#enable_post_quantum). diff --git a/src/content/changelog/zero-trust-warp/2025-08-29-warp-AI-diag-analyzer.mdx b/src/content/changelog/zero-trust-warp/2025-08-29-warp-AI-diag-analyzer.mdx index bc4502ffaea219..216086c57bf263 100644 --- a/src/content/changelog/zero-trust-warp/2025-08-29-warp-AI-diag-analyzer.mdx +++ b/src/content/changelog/zero-trust-warp/2025-08-29-warp-AI-diag-analyzer.mdx @@ -4,4 +4,4 @@ description: Cloudflare One WARP Diagnostic AI Analyzer date: 2025-08-29 --- -We're excited to share a new AI feature, the [WARP diagnostic analyzer](https://blog.cloudflare.com/AI-troubleshoot-warp-and-network-connectivity-issues/), to help you troubleshoot and resolve WARP connectivity issues faster. This beta feature is now available in the [Zero Trust dashboard](https://one.dash.cloudflare.com/) to all users. The AI analyzer makes it easier for you to identify the root cause of client connectivity issues by parsing [remote captures](/cloudflare-one/insights/dex/remote-captures/#start-a-remote-capture) of [WARP diagnostic logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diag-logs). The WARP diagnostic analyzer provides a summary of impact that may be experienced on the device, lists notable events that may contribute to performance issues, and recommended troubleshooting steps and articles to help you resolve these issues. Refer to [WARP diagnostics analyzer (beta)](/cloudflare-one/insights/dex/remote-captures/#warp-diagnostics-analyzer-beta) to learn more about how to maximize using the WARP diagnostic analyzer to troubleshoot the WARP client. +We're excited to share a new AI feature, the [WARP diagnostic analyzer](https://blog.cloudflare.com/AI-troubleshoot-warp-and-network-connectivity-issues/), to help you troubleshoot and resolve WARP connectivity issues faster. This beta feature is now available in the [Zero Trust dashboard](https://one.dash.cloudflare.com/) to all users. The AI analyzer makes it easier for you to identify the root cause of client connectivity issues by parsing [remote captures](/cloudflare-one/insights/dex/remote-captures/#start-a-remote-capture) of [WARP diagnostic logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#warp-diag-logs). The WARP diagnostic analyzer provides a summary of impact that may be experienced on the device, lists notable events that may contribute to performance issues, and recommended troubleshooting steps and articles to help you resolve these issues. Refer to [WARP diagnostics analyzer (beta)](/cloudflare-one/insights/dex/remote-captures/#warp-diagnostics-analyzer-beta) to learn more about how to maximize using the WARP diagnostic analyzer to troubleshoot the WARP client. diff --git a/src/content/docs/1.1.1.1/setup/google-cloud.mdx b/src/content/docs/1.1.1.1/setup/google-cloud.mdx index 7185d08a82c70d..7ee83176e8867f 100644 --- a/src/content/docs/1.1.1.1/setup/google-cloud.mdx +++ b/src/content/docs/1.1.1.1/setup/google-cloud.mdx @@ -17,7 +17,7 @@ Google Cloud supports configuring [outbound server policy](https://cloud.google. :::note -If you are using [Cloudflare Zero Trust](/cloudflare-one/), you can choose assigned [locations](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) to apply custom [DNS policies](/cloudflare-one/policies/gateway/dns-policies/) via Gateway. +If you are using [Cloudflare Zero Trust](/cloudflare-one/), you can choose assigned [locations](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) to apply custom [DNS policies](/cloudflare-one/policies/gateway/dns-policies/) via Gateway. ::: diff --git a/src/content/docs/aegis/index.mdx b/src/content/docs/aegis/index.mdx index 9c68eb4e43dbb4..08d6046cc04c35 100644 --- a/src/content/docs/aegis/index.mdx +++ b/src/content/docs/aegis/index.mdx @@ -35,7 +35,7 @@ Cloudflare Aegis is available in early access to Enterprise customers. Contact y Cloudflare Access determines who can reach your application by applying the Access policies you configure. - + Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. diff --git a/src/content/docs/bots/get-started/super-bot-fight-mode.mdx b/src/content/docs/bots/get-started/super-bot-fight-mode.mdx index a4f67964bbec11..93eed53b937fa2 100644 --- a/src/content/docs/bots/get-started/super-bot-fight-mode.mdx +++ b/src/content/docs/bots/get-started/super-bot-fight-mode.mdx @@ -73,7 +73,7 @@ To start using Super Bot Fight Mode: :::caution[Warning] -If your organization also uses [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/), keep **Definitely Automated** set to **Allow**. Otherwise, tunnels might fail with a `websocket: bad handshake` error. +If your organization also uses [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/), keep **Definitely Automated** set to **Allow**. Otherwise, tunnels might fail with a `websocket: bad handshake` error. ::: diff --git a/src/content/docs/browser-rendering/rest-api/json-endpoint.mdx b/src/content/docs/browser-rendering/rest-api/json-endpoint.mdx index eba8fd7772bccf..b7dc8778e288fb 100644 --- a/src/content/docs/browser-rendering/rest-api/json-endpoint.mdx +++ b/src/content/docs/browser-rendering/rest-api/json-endpoint.mdx @@ -206,7 +206,7 @@ curl --request POST 'https://api.cloudflare.com/client/v4/accounts/CF_ACCOUNT_ID }, { "name": "Tunnel", - "link": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/" + "link": "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/" }, { "name": "Gateway", diff --git a/src/content/docs/browser-rendering/rest-api/links-endpoint.mdx b/src/content/docs/browser-rendering/rest-api/links-endpoint.mdx index a4ec95abdffb90..551496529a7642 100644 --- a/src/content/docs/browser-rendering/rest-api/links-endpoint.mdx +++ b/src/content/docs/browser-rendering/rest-api/links-endpoint.mdx @@ -56,7 +56,7 @@ curl -X POST 'https://api.cloudflare.com/client/v4/accounts//browser- "https://playground.ai.cloudflare.com/", "https://developers.cloudflare.com/products/?product-group=AI", "https://developers.cloudflare.com/cloudflare-one/policies/access/", - "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/", + "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/", "https://developers.cloudflare.com/cloudflare-one/policies/gateway/", "https://developers.cloudflare.com/cloudflare-one/policies/browser-isolation/", "https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/", @@ -66,7 +66,7 @@ curl -X POST 'https://api.cloudflare.com/client/v4/accounts//browser- "https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYZb6HbW5QDGU2AAwBWABwBGAOyjRANgDMAFgCcygFwsWbYBzhcafASInS5S1QFgAUAGF0VCAFMH2ACJQAzjHQeo0e2ok2ngExCRUcMCODABEUDSOAB4AdABWHjGkqFBgzpHRcQkp6THWdg7OENgAKnQwjoFwMDBgfARQ9sipcABucB68CLAQANTA6LjgjtbWSd5IJLiOqHDgECQA3lYkJP10VLxBjhC8ABYAFAiOAI4gjh4QAJSb2zskyABUH69vHyQASo4WnBeI4SAADK7jJzgkgAdz8pxIEFOYNOPnWdEo8M8SIg6BIHmcuBIV1u9wgHmR6B+Ow+yFpvHsD1JjmhYIYJBipwgEBgHjUyGQSUiLUcySZwEyVlpVwgIAQVF2cLgfiOJwuUPQTgANKzyQ9HkRXgBfHVWE1EayaZjaXT6Hj8IRiKQyBQqZRlexOFzuLw+PwdKiBYK6UgRKKxKKEXSZII5PKRmJkMDoMilWzeyo1OoNXbNVq8dqddL2GZWDYxYCqqgAfXGk1yMTUhSWxQyJutNrtoQdhmdJjd5mUzCAA", "https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYZb6HbW5QDGU2AAwBmACyiAnBMFSAbIICMALhYs2wDnC40+AkeKkyJ8hQFgAUAGF0VCAFNb2ACJQAzjHSuo0G0pLq8AmISKjhgOwYAIigaOwAPADoAK1dI0lQoMAcwiOjYxJTIi2tbBwhsABU6GDs-OBgYMD4CKBtkJLgANzhXXgRYCABqYHRccDsLC3iPJBJcO1Q4cAgSAG9zEhIeuipefzsIXgALAAoEOwBHEDtXCABKNY3Nkl4bW7mb6FCfKgBVACUADIkBgkSJHCAQGCuJTIZDxMKNOwJV7ANJPTavKjvW4EECuazzEEkYSKIgYkjnCAgBBUEj-G4ebHI848c68CAnea3GItGwAwEAGhIuOpBNGdju5M2AF9BeYZUQLKpmOpNNoePwhGJJNI5IpijZ7I4XO5PN5WlQ-AFNKRQuEouFCJo0v5MtkHZEyGB0GQilYjWVKtValsGk1eHyqO1XDZJuZVpFgHAYgB9EZjLKRJR5eYFVIy5UqtVBDW6bUGPXGRTMIA", "https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYZb6HbW5QDGU2AAwAOAJwBmAIyiATKMkB2AKwyAXCxZtgHOFxp8BIidLmKVAWABQAYXRUIAU3vYAIlADOMdO6jQ7qki08AmISKjhgBwYAIigaBwAPADoAK3do0lQoMCcIqNj45LToq1t7JwhsABU6GAcAuBgYMD4CKDtkFLgANzh3XgRYCABqYHRccAcrK0SvJBJcB1Q4cAgSAG9LEhI+uipeQIcIXgALAAoEBwBHEAd3CABKDa3tnfc9g9RqXj8qEgBZI4ncYAOXQEAAgmAwOgAO4OXAXa63e5PTavV6XCAgBB-KgOWEkABKdy8VHcDjOAANARBgbgSAASdaXG53CBJSJ08YAXzC4J20LhCKSVIANM8MRj7gQQO4AgAWQRKMUvKUkE4OOCLBDyyXq15QmGwgLRADiAFEqtFVQaSDzbVKeQ8iGr7W7kMgSAB5KhgOgkS1VEislEQdwkWGYADWkd8JxIdI8JBgCHQCToSTdUFQJCRbPunKB4xIAEIGAwSOardEnlicX9afSwZChfDEaH2S63fXcYdjucqScIBAYPLPYkIs0HEleOhgFTu9sHZYeUQrBpmFodHoePwhGIpLJ5MoZKU7I5nG5PN5fO0qAEgjpSOFIjEudqQhlAtlcm-omQMJkCUNgXhU1S1PUOxNC0vBtB0aR2NMljrNEwBwHEAD6YwTDk0SqAUixFOkPIbpu24hLuBgHsYx5mDIzBAA", - "https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/", + "https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/warp/", "https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/", "https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/", "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/", @@ -172,7 +172,7 @@ curl -X POST 'https://api.cloudflare.com/client/v4/accounts//browser- "https://playground.ai.cloudflare.com/", "https://developers.cloudflare.com/products/?product-group=AI", "https://developers.cloudflare.com/cloudflare-one/policies/access/", - "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/", + "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/", "https://developers.cloudflare.com/cloudflare-one/policies/gateway/", "https://developers.cloudflare.com/cloudflare-one/policies/browser-isolation/", "https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/", @@ -182,7 +182,7 @@ curl -X POST 'https://api.cloudflare.com/client/v4/accounts//browser- "https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYZb6HbW5QDGU2AAwBWABwBGAOyjRANgDMAFgCcygFwsWbYBzhcafASInS5S1QFgAUAGF0VCAFMH2ACJQAzjHQeo0e2ok2ngExCRUcMCODABEUDSOAB4AdABWHjGkqFBgzpHRcQkp6THWdg7OENgAKnQwjoFwMDBgfARQ9sipcABucB68CLAQANTA6LjgjtbWSd5IJLiOqHDgECQA3lYkJP10VLxBjhC8ABYAFAiOAI4gjh4QAJSb2zskyABUH69vHyQASo4WnBeI4SAADK7jJzgkgAdz8pxIEFOYNOPnWdEo8M8SIg6BIHmcuBIV1u9wgHmR6B+Ow+yFpvHsD1JjmhYIYJBipwgEBgHjUyGQSUiLUcySZwEyVlpVwgIAQVF2cLgfiOJwuUPQTgANKzyQ9HkRXgBfHVWE1EayaZjaXT6Hj8IRiKQyBQqZRlexOFzuLw+PwdKiBYK6UgRKKxKKEXSZII5PKRmJkMDoMilWzeyo1OoNXbNVq8dqddL2GZWDYxYCqqgAfXGk1yMTUhSWxQyJutNrtoQdhmdJjd5mUzCAA", "https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYZb6HbW5QDGU2AAwBmACyiAnBMFSAbIICMALhYs2wDnC40+AkeKkyJ8hQFgAUAGF0VCAFNb2ACJQAzjHSuo0G0pLq8AmISKjhgOwYAIigaOwAPADoAK1dI0lQoMAcwiOjYxJTIi2tbBwhsABU6GDs-OBgYMD4CKBtkJLgANzhXXgRYCABqYHRccDsLC3iPJBJcO1Q4cAgSAG9zEhIeuipefzsIXgALAAoEOwBHEDtXCABKNY3Nkl4bW7mb6FCfKgBVACUADIkBgkSJHCAQGCuJTIZDxMKNOwJV7ANJPTavKjvW4EECuazzEEkYSKIgYkjnCAgBBUEj-G4ebHI848c68CAnea3GItGwAwEAGhIuOpBNGdju5M2AF9BeYZUQLKpmOpNNoePwhGJJNI5IpijZ7I4XO5PN5WlQ-AFNKRQuEouFCJo0v5MtkHZEyGB0GQilYjWVKtValsGk1eHyqO1XDZJuZVpFgHAYgB9EZjLKRJR5eYFVIy5UqtVBDW6bUGPXGRTMIA", "https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYZb6HbW5QDGU2AAwAOAJwBmAIyiATKMkB2AKwyAXCxZtgHOFxp8BIidLmKVAWABQAYXRUIAU3vYAIlADOMdO6jQ7qki08AmISKjhgBwYAIigaBwAPADoAK3do0lQoMCcIqNj45LToq1t7JwhsABU6GAcAuBgYMD4CKDtkFLgANzh3XgRYCABqYHRccAcrK0SvJBJcB1Q4cAgSAG9LEhI+uipeQIcIXgALAAoEBwBHEAd3CABKDa3tnfc9g9RqXj8qEgBZI4ncYAOXQEAAgmAwOgAO4OXAXa63e5PTavV6XCAgBB-KgOWEkABKdy8VHcDjOAANARBgbgSAASdaXG53CBJSJ08YAXzC4J20LhCKSVIANM8MRj7gQQO4AgAWQRKMUvKUkE4OOCLBDyyXq15QmGwgLRADiAFEqtFVQaSDzbVKeQ8iGr7W7kMgSAB5KhgOgkS1VEislEQdwkWGYADWkd8JxIdI8JBgCHQCToSTdUFQJCRbPunKB4xIAEIGAwSOardEnlicX9afSwZChfDEaH2S63fXcYdjucqScIBAYPLPYkIs0HEleOhgFTu9sHZYeUQrBpmFodHoePwhGIpLJ5MoZKU7I5nG5PN5fO0qAEgjpSOFIjEudqQhlAtlcm-omQMJkCUNgXhU1S1PUOxNC0vBtB0aR2NMljrNEwBwHEAD6YwTDk0SqAUixFOkPIbpu24hLuBgHsYx5mDIzBAA", - "https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/", + "https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/warp/", "https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/", "https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/", "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/", diff --git a/src/content/docs/byoip/index.mdx b/src/content/docs/byoip/index.mdx index 9dd1ec758b77dc..e55f48dbb11a96 100644 --- a/src/content/docs/byoip/index.mdx +++ b/src/content/docs/byoip/index.mdx @@ -19,7 +19,7 @@ Get Cloudflare's security and performance while using your own IPs. Considering [how Cloudflare works as a reverse proxy](/fundamentals/concepts/how-cloudflare-works/), for some customers it may be important to maintain this functionality while also keeping their website or application associated with their own public IP space (instead of Cloudflare's[^1]). -With Bring Your Own IP (BYOIP), Cloudflare announces your IPs in all our locations. Use your IPs with [Magic Transit](/magic-transit/), [Spectrum](/spectrum/), [CDN services](/cache/), or Gateway [DNS locations](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) and [dedicated egress IPs](/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips/). +With Bring Your Own IP (BYOIP), Cloudflare announces your IPs in all our locations. Use your IPs with [Magic Transit](/magic-transit/), [Spectrum](/spectrum/), [CDN services](/cache/), or Gateway [DNS locations](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) and [dedicated egress IPs](/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips/). Learn how to [get started](/byoip/get-started/). diff --git a/src/content/docs/china-network/concepts/global-acceleration.mdx b/src/content/docs/china-network/concepts/global-acceleration.mdx index 068020f8d65050..c6c86fd9991151 100644 --- a/src/content/docs/china-network/concepts/global-acceleration.mdx +++ b/src/content/docs/china-network/concepts/global-acceleration.mdx @@ -42,7 +42,7 @@ CDN Global Acceleration provides stable and reliable connections for dynamic con ## WARP Global Acceleration -WARP Global Acceleration is a verified solution for enabling [WARP client](/cloudflare-one/connections/connect-devices/warp/) access within China, allowing remote employees to maintain secure and consistent connections. +WARP Global Acceleration is a verified solution for enabling [WARP client](/cloudflare-one/team-and-resources/devices/warp/) access within China, allowing remote employees to maintain secure and consistent connections. ## Magic WAN Global Acceleration diff --git a/src/content/docs/cloudflare-one/applications/configure-apps/index.mdx b/src/content/docs/cloudflare-one/applications/configure-apps/index.mdx index 3915f2613e440a..11906144780757 100644 --- a/src/content/docs/cloudflare-one/applications/configure-apps/index.mdx +++ b/src/content/docs/cloudflare-one/applications/configure-apps/index.mdx @@ -18,7 +18,7 @@ You can protect the following types of web applications: - **Self-hosted applications** consist of internal applications that you host in your own environment. These can be the data center versions of tools like the Atlassian suite or applications created by your own team. Setup requirements for a self-hosted application depend on whether the application is publicly accessible on the Internet or restricted to users on a private network. - [**Public hostname applications**](/cloudflare-one/applications/configure-apps/self-hosted-public-app/) are web applications that have public DNS records. Anyone on the Internet can access the application by entering the URL in their browser and authenticating through Cloudflare Access. Securing access to a public website requires a Cloudflare DNS [full setup](/dns/zone-setups/full-setup/) or [partial CNAME setup](/dns/zone-setups/partial-setup/). - - [**Private network applications**](/cloudflare-one/applications/non-http/self-hosted-private-app/) do not have public DNS records, meaning they are not reachable from the public Internet. To connect using a private IP or private hostname, the user's traffic must route through Cloudflare Gateway. The preferred method is to install the WARP client on the user's device, but you could also forward device traffic from a [network location](/magic-wan/) or use an agentless option such as [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/) or [Clientless Web Isolation](/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/). + - [**Private network applications**](/cloudflare-one/applications/non-http/self-hosted-private-app/) do not have public DNS records, meaning they are not reachable from the public Internet. To connect using a private IP or private hostname, the user's traffic must route through Cloudflare Gateway. The preferred method is to install the WARP client on the user's device, but you could also forward device traffic from a [network location](/magic-wan/) or use an agentless option such as [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) or [Clientless Web Isolation](/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/). - [**Model Context Protocol (MCP) servers**](/cloudflare-one/applications/configure-apps/mcp-servers/) are web applications that enable generative AI tools to read and write data within your business applications. For example, Salesforce provides an [MCP server](https://github.com/salesforcecli/mcp) for developers to interact with resources in their Salesforce tenant using GitHub Copilot or other AI code editors. diff --git a/src/content/docs/cloudflare-one/applications/configure-apps/self-hosted-public-app.mdx b/src/content/docs/cloudflare-one/applications/configure-apps/self-hosted-public-app.mdx index b1ef5cc692fb97..d76947d267f1c7 100644 --- a/src/content/docs/cloudflare-one/applications/configure-apps/self-hosted-public-app.mdx +++ b/src/content/docs/cloudflare-one/applications/configure-apps/self-hosted-public-app.mdx @@ -24,7 +24,7 @@ You can securely publish internal tools and applications by adding Cloudflare Ac ## 2. Connect your origin to Cloudflare -[Set up a Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) to publish your internal application. Only users who match your Access policies will be granted access. +[Set up a Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) to publish your internal application. Only users who match your Access policies will be granted access. :::note We recommend [creating an Access application](#1-add-your-application-to-access) before setting up the tunnel route. If you do not have an Access application in place, the published application will be available to anyone on the Internet. diff --git a/src/content/docs/cloudflare-one/applications/non-http/browser-rendering.mdx b/src/content/docs/cloudflare-one/applications/non-http/browser-rendering.mdx index 71f5674f2e7cc9..080198fed90f58 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/browser-rendering.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/browser-rendering.mdx @@ -23,7 +23,7 @@ Cloudflare can render SSH, VNC, and RDP applications in a browser without the ne To turn on browser rendering for an SSH or VNC application: 1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Applications**. -2. Locate the SSH or VNC application you created when [connecting the server to Cloudflare](/cloudflare-one/connections/connect-networks/use-cases/ssh/). Select **Configure**. +2. Locate the SSH or VNC application you created when [connecting the server to Cloudflare](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/). Select **Configure**. 3. In the **Policies** tab, ensure that only **Allow** or **Block** policies are present. **Bypass** and **Service Auth** are not supported for browser-rendered applications. 4. Go to **Advanced settings** > **Browser rendering settings**. 5. For **Browser rendering**, choose _SSH_ or _VNC_. @@ -33,7 +33,7 @@ When users authenticate and visit the URL of the application, Cloudflare will re ### RDP -To set up browser-rendering for RDP, refer to our [browser-based RDP guide](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/). +To set up browser-rendering for RDP, refer to our [browser-based RDP guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). ### SSH key exchange algorithms diff --git a/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp.mdx b/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp.mdx index 6a369555fa06b3..3e2cb95bebc2cc 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp.mdx @@ -23,7 +23,7 @@ Cloudflare Access provides a mechanism for end users to authenticate with their The Cloudflare daemon, `cloudflared`, will maintain a secure, persistent, outbound-only connection from the machine to Cloudflare. Arbitrary TCP traffic will be proxied over this connection using [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/). -Follow [these instructions](/cloudflare-one/connections/connect-networks/downloads/) to download and install `cloudflared` on the machine hosting the resource. +Follow [these instructions](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) to download and install `cloudflared` on the machine hosting the resource. ### 2. Authenticate the Cloudflare daemon diff --git a/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/index.mdx b/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/index.mdx index d8ddad2ac62ca5..1040d3dbbd6538 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/index.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/cloudflared-authentication/index.mdx @@ -19,7 +19,7 @@ For examples of how to connect to Access applications with client-side `cloudfla * [Connect through Access using a CLI](/cloudflare-one/tutorials/cli/) * [Connect through Access using kubectl](/cloudflare-one/tutorials/kubectl/) -* [Connect over SSH with cloudflared](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-cloudflared-authentication/) (legacy) -- SSH connections are now managed through [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/). -* [Connect over RDP with cloudflared](/cloudflare-one/connections/connect-networks/use-cases/rdp/#connect-to-rdp-server-with-cloudflared-access) -* [Connect over SMB with cloudflared](/cloudflare-one/connections/connect-networks/use-cases/smb/) +* [Connect over SSH with cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication/) (legacy) -- SSH connections are now managed through [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/). +* [Connect over RDP with cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/#connect-to-rdp-server-with-cloudflared-access) +* [Connect over SMB with cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb/) * [Connect over arbitrary TCP with cloudflared](/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp/) \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/applications/non-http/index.mdx b/src/content/docs/cloudflare-one/applications/non-http/index.mdx index fefb5b7eac5809..7864d4cb361610 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/index.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/index.mdx @@ -10,7 +10,7 @@ import { Render, Stream } from "~/components"; Cloudflare offers both client-based and clientless ways to grant secure access to non-HTTP applications. :::note -Non-HTTP applications require [connecting your private network](/cloudflare-one/connections/connect-networks/private-net/) to Cloudflare. For more details, refer to our [Replace your VPN](/learning-paths/replace-vpn/connect-private-network/) implementation guide. +Non-HTTP applications require [connecting your private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) to Cloudflare. For more details, refer to our [Replace your VPN](/learning-paths/replace-vpn/connect-private-network/) implementation guide. ::: -| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -27,13 +27,13 @@ import { Badge, Details, Tabs, TabItem, Render } from "~/components"; Access for Infrastructure allows you to have granular control over how users access individual servers, clusters, or databases. By adding an infrastructure application to Cloudflare Access, you can configure how users authenticate to the resource as well as control and authorize the ports, protocols, and usernames that they can connect with. Access and command logs ensure regulatory compliance and allow for auditing of user activity in case of a security breach. :::note -Access for Infrastructure currently only supports [SSH](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/). To connect using other protocols, [add a self-hosted private application](/cloudflare-one/applications/non-http/self-hosted-private-app/). For browser-based SSH, RDP, or VNC, refer to [browser-rendered terminal](/cloudflare-one/applications/non-http/browser-rendering/). +Access for Infrastructure currently only supports [SSH](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/). To connect using other protocols, [add a self-hosted private application](/cloudflare-one/applications/non-http/self-hosted-private-app/). For browser-based SSH, RDP, or VNC, refer to [browser-rendered terminal](/cloudflare-one/applications/non-http/browser-rendering/). ::: ## Prerequisites -- [Connect your infrastructure](/cloudflare-one/connections/connect-networks/private-net/) to Cloudflare using `cloudflared` or WARP Connector. -- [Deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) on user devices in Gateway with WARP mode. +- [Connect your infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) to Cloudflare using `cloudflared` or WARP Connector. +- [Deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) on user devices in Gateway with WARP mode. ## 1. Add a target @@ -59,7 +59,7 @@ Access for Infrastructure currently only supports [SSH](/cloudflare-one/connecti Certain protocols require configuring the server to trust connections through Access for Infrastructure. For more information, refer to the protocol-specific tutorial: -- [SSH](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#6-configure-ssh-server) +- [SSH](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#6-configure-ssh-server) ## 5. Connect as a user @@ -67,7 +67,7 @@ Users connect to the target's IP address using their preferred client software. ### Connect to different VNET -To connect to targets that are in different VNETS, users will need to [switch their connected virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/#connect-to-a-virtual-network) in the WARP client. +To connect to targets that are in different VNETS, users will need to [switch their connected virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/#connect-to-a-virtual-network) in the WARP client. :::note If a user is connected to a target in VNET-A and needs to connect to a target in VNET-B, switching their VNET will not break any existing connections to targets within VNET-A. At present, connections are maintained between VNETs. diff --git a/src/content/docs/cloudflare-one/applications/non-http/self-hosted-private-app.mdx b/src/content/docs/cloudflare-one/applications/non-http/self-hosted-private-app.mdx index 3deadfe87cad40..0a441fcb339c8d 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/self-hosted-private-app.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/self-hosted-private-app.mdx @@ -16,9 +16,9 @@ This feature replaces the legacy [private network app type](/cloudflare-one/appl ## Prerequisites -- Private IPs and hostnames are reachable over Cloudflare WARP, Magic WAN or Browser Isolation. For more details, refer to [Connect a private network](/cloudflare-one/connections/connect-networks/private-net/). -- Private hostnames route to your custom DNS resolver through [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) or [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/). -- Public IPs and hostnames can be used to define a private application, however the IP or hostname must route through Cloudflare via [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/private-net/cloudflared/), [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), or [Magic WAN](/magic-wan/configuration/manually/how-to/configure-routes/). +- Private IPs and hostnames are reachable over Cloudflare WARP, Magic WAN or Browser Isolation. For more details, refer to [Connect a private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/). +- Private hostnames route to your custom DNS resolver through [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) or [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/). +- Public IPs and hostnames can be used to define a private application, however the IP or hostname must route through Cloudflare via [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/), [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/), or [Magic WAN](/magic-wan/configuration/manually/how-to/configure-routes/). - (Optional) Turn on [Gateway TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/) if you want to use Access JWTs to manage [HTTPS application sessions](#https-applications). ## Add your application to Access @@ -41,7 +41,7 @@ This feature replaces the legacy [private network app type](/cloudflare-one/appl 1. Select the [**Identity providers**](/cloudflare-one/identity/idp-integration/) you want to enable for your application. 2. (Recommended) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/applications/login-page/). Instead, Cloudflare will redirect users directly to your SSO login event. - 3. (Recommended) Turn on **WARP authentication identity** to allow users to authenticate to the application using their [WARP session identity](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). We recommend turning this on if your application is not in the browser and cannot handle a `302` redirect. + 3. (Recommended) Turn on **WARP authentication identity** to allow users to authenticate to the application using their [WARP session identity](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). We recommend turning this on if your application is not in the browser and cannot handle a `302` redirect. 9. Select **Next**. diff --git a/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx b/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx index 456cb88177a1cf..64e58793d0ddab 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx @@ -9,7 +9,7 @@ sidebar: import { Render } from "~/components"; :::note -Not recommended for new deployments. We recommend using [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) to configure short-lived certificates for SSH. +Not recommended for new deployments. We recommend using [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) to configure short-lived certificates for SSH. ::: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/index.mdx b/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/index.mdx deleted file mode 100644 index 588df6f22ddbb0..00000000000000 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/index.mdx +++ /dev/null @@ -1,16 +0,0 @@ ---- -pcx_content_type: navigation -title: Deploy WARP -sidebar: - order: 5 -head: - - tag: title - content: Deploy WARP to your organization - ---- - -Depending on how your organization is structured, you can deploy WARP in one of two ways: - -* [Manual deployment](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) — If you are a small organization, asking your users to download the client themselves and type in the required settings is the ideal way to get started with WARP. - -* [Managed deployment](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) — Bigger organizations with MDM tools like Intune or JAMF can deploy WARP to their entire fleet of devices from a single operation. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/index.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/private-net/index.mdx deleted file mode 100644 index 991bdfe977ced5..00000000000000 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/index.mdx +++ /dev/null @@ -1,21 +0,0 @@ ---- -pcx_content_type: concept -title: Private networks -sidebar: - order: 7 ---- - -With Cloudflare Zero Trust, you can connect private networks and the services running in those networks to Cloudflare's global network. This involves installing a [connector](#connectors) on the private network, and then [setting up routes](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2b-connect-a-network) which define the IP addresses available in that environment. Unlike [published applications](/cloudflare-one/connections/connect-networks/routing-to-tunnel/), private network routes can expose both HTTP and non-HTTP resources. - -To reach private network IPs, end users must connect their device to Cloudflare and enroll in your Zero Trust organization. The most common method is to install the [WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device, or you can onboard their network traffic to Cloudflare using our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) or [Magic WAN](/magic-wan/zero-trust/cloudflare-tunnel/). - -Administrators can optionally set [Gateway network policies](/cloudflare-one/policies/gateway/network-policies/) to control access to services based on user identity and device posture. - -## Connectors - -Here are the different ways you can connect your private network to Cloudflare: - -- [**cloudflared**](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) installs on a server in your private network to create a secure, outbound tunnel to Cloudflare. Cloudflare Tunnel using `cloudflared` only proxies traffic initiated from a user to a server. Any service or application running behind the tunnel will use the server's default routing table for server-initiated connectivity. -- [**WARP-to-WARP**](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/) uses the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) to establish peer-to-peer connectivity between two or more devices. Each device running WARP can access services on any other device running WARP via an assigned virtual IP address. -- [**WARP Connector**](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) installs on a Linux server in your private network to establish site-to-site, bidirectional, and mesh networking connectivity. The WARP Connector acts as a subnet router to relay client-initiated and server-initiated traffic between all devices on a private network and Cloudflare. -- [**Magic WAN**](/magic-wan/) relies on configuring legacy networking equipment to establish anycast GRE or IPsec tunnels between an entire network location and Cloudflare. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/index.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/index.mdx deleted file mode 100644 index 397339f1e45ea0..00000000000000 --- a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/index.mdx +++ /dev/null @@ -1,16 +0,0 @@ ---- -pcx_content_type: concept -title: Published applications -sidebar: - order: 8 ---- - -Cloudflare Tunnel allows you to publish local applications to the Internet via a public hostname. For example, you can [add a published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application) that points `docs.example.com` to `https://localhost:8080`. Anyone can now view your application by going to `docs.example.com` in their web browser. - -Cloudflare can route traffic down your Cloudflare Tunnel using a [DNS record](/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns/) or [Cloudflare Load Balancer](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/). You can configure either option from the Cloudflare dashboard by pointing a DNS `CNAME` record or a load balancer pool to your Cloudflare Tunnel subdomain (`.cfargotunnel.com`). You can also associate these records with your tunnel from `cloudflared` directly. - -:::note - -You do not need a paid Cloudflare Access plan to publish an application via Cloudflare Tunnel. [Access seats](/cloudflare-one/identity/users/seat-management/) are only required if you want to [secure the application using Access policies](/cloudflare-one/applications/configure-apps/self-hosted-public-app/), such as requiring users to log in via an identity provider. - -::: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/index.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/index.mdx deleted file mode 100644 index 4b700b218438b0..00000000000000 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/index.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -pcx_content_type: navigation -title: Use cases -hidden: false -sidebar: - order: 4 - ---- - -Cloudflare Tunnel creates a secure, outbound-only connection between your services and Cloudflare by deploying a lightweight connector in your environment. Here is how to use tunnels with some specific services: - -* [SSH](/cloudflare-one/connections/connect-networks/use-cases/ssh/) -* [RDP](/cloudflare-one/connections/connect-networks/use-cases/rdp/) -* [SMB](/cloudflare-one/connections/connect-networks/use-cases/smb/) -* [gRPC](/cloudflare-one/connections/connect-networks/use-cases/grpc/) diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/index.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/index.mdx deleted file mode 100644 index c743f9e9e1ade5..00000000000000 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/index.mdx +++ /dev/null @@ -1,19 +0,0 @@ ---- -pcx_content_type: navigation -title: SSH -hidden: false -sidebar: - order: 1 -tableOfContents: false ---- - -The Secure Shell Protocol (SSH) enables users to remotely access devices through the command line. With Cloudflare Zero Trust, you can make your SSH server available over the Internet without the risk of opening inbound ports on the server. - -Cloudflare offers four ways to secure SSH: - -- [SSH with Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) (recommended) -- [Self-managed SSH keys](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/) -- [Browser-rendered SSH terminal](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-browser-rendering/) -- [SSH with client-side cloudflared](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-cloudflared-authentication/) (legacy) - -For an overview of these connection options, refer to [non-HTTP applications](/cloudflare-one/applications/non-http/). \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/faq/cloudflare-tunnels-faq.mdx b/src/content/docs/cloudflare-one/faq/cloudflare-tunnels-faq.mdx index d8e4b95b3f9ed7..8b3479905b91c8 100644 --- a/src/content/docs/cloudflare-one/faq/cloudflare-tunnels-faq.mdx +++ b/src/content/docs/cloudflare-one/faq/cloudflare-tunnels-faq.mdx @@ -69,7 +69,7 @@ Cloudflare Tunnel was previously named Warp during the beta phase. As Warp was a ## Is it possible to restore a deleted tunnel? -No. You cannot undo a tunnel deletion. If the tunnel was locally-managed, its [`config.yaml` file](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#configuration-file) will still be present and you can create a new tunnel with the same configuration. If the tunnel was remotely-managed, both the tunnel and its configuration are permanently deleted. +No. You cannot undo a tunnel deletion. If the tunnel was locally-managed, its [`config.yaml` file](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#configuration-file) will still be present and you can create a new tunnel with the same configuration. If the tunnel was remotely-managed, both the tunnel and its configuration are permanently deleted. ## How do I contact support? @@ -81,6 +81,6 @@ Before contacting the Cloudflare support team: 3. Gather any relevant error/access logs from your server. -4. (Locally-managed tunnels only) Set [`--loglevel`](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#loglevel) to `debug`, so the Cloudflare support team can get more info from the `cloudflared.log` file. +4. (Locally-managed tunnels only) Set [`--loglevel`](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#loglevel) to `debug`, so the Cloudflare support team can get more info from the `cloudflared.log` file. -5. Include your [Cloudflare Tunnel diagnostic logs](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs/) (`cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip`). +5. Include your [Cloudflare Tunnel diagnostic logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs/) (`cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip`). diff --git a/src/content/docs/cloudflare-one/faq/devices-faq.mdx b/src/content/docs/cloudflare-one/faq/devices-faq.mdx index 95e850e9b78f20..7a911812936cf2 100644 --- a/src/content/docs/cloudflare-one/faq/devices-faq.mdx +++ b/src/content/docs/cloudflare-one/faq/devices-faq.mdx @@ -34,22 +34,22 @@ Cloudflare WARP is in part powered by 1.1.1.1. When visiting sites or going to a The Wi-Fi network may have a captive portal that is blocking WARP from establishing a secure connection. In order to access the portal, and therefore the Internet, you will need to temporarily turn off WARP. After you login to the captive portal through your browser, you can turn WARP back on to access corporate resources. -For more information, refer to [Captive portal detection](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/captive-portals/). +For more information, refer to [Captive portal detection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/captive-portals/). ## Why is my device not connecting to the Internet? -A third-party service or ISP may be blocking WARP, or Zero Trust settings may be misconfigured. For a list of common issues and steps to resolve, refer to our [troubleshooting guide](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/). +A third-party service or ISP may be blocking WARP, or Zero Trust settings may be misconfigured. For a list of common issues and steps to resolve, refer to our [troubleshooting guide](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/). ## Why is my device not connecting to the corporate Wi-Fi? -An [OS firewall rule](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall) on the device may be blocking the EAP/Radius server that allows users to join the Wi-Fi network. If your corporate Wi-Fi uses a Radius server for network authentication, add the Radius server to your [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude list. +An [OS firewall rule](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall) on the device may be blocking the EAP/Radius server that allows users to join the Wi-Fi network. If your corporate Wi-Fi uses a Radius server for network authentication, add the Radius server to your [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude list. ## Why is my device not connecting to my private network? -If your private network is [exposed via Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/private-net/cloudflared/): +If your private network is [exposed via Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/): -* Verify that the WARP client is [properly configured](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#device-configuration) on the device. +* Verify that the WARP client is [properly configured](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#device-configuration) on the device. * Verify that the user is allowed through by your Access and Gateway policies. -* Verify that the [local LAN settings](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#router-configuration) for the device do not overlap with the CIDR range of your private network. +* Verify that the [local LAN settings](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#router-configuration) for the device do not overlap with the CIDR range of your private network. -When contacting Cloudflare support, ensure that you include [WARP debug logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for your device. These logs will help Cloudflare support understand the overall architecture of your machine and networks. +When contacting Cloudflare support, ensure that you include [WARP debug logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/) for your device. These logs will help Cloudflare support understand the overall architecture of your machine and networks. diff --git a/src/content/docs/cloudflare-one/faq/getting-started-faq.mdx b/src/content/docs/cloudflare-one/faq/getting-started-faq.mdx index eb114246002fdf..467f3d96ae2d45 100644 --- a/src/content/docs/cloudflare-one/faq/getting-started-faq.mdx +++ b/src/content/docs/cloudflare-one/faq/getting-started-faq.mdx @@ -63,7 +63,7 @@ User seats can be removed for Access and Gateway at **My Team** > **Users**. Rem - **Access**: All active sessions for that user will be invalidated. A user will be able to log back into an application unless you create an [Access policy](/cloudflare-one/policies/access/) to block future logins from that user. -- **Gateway**: All active devices for that user will be logged out of your Zero Trust organization, which stops all filtering and routing via the WARP client. A user will be able to re-enroll their device unless you create a [device enrollment policy](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/) to block them. +- **Gateway**: All active devices for that user will be logged out of your Zero Trust organization, which stops all filtering and routing via the WARP client. A user will be able to re-enroll their device unless you create a [device enrollment policy](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/) to block them. :::caution diff --git a/src/content/docs/cloudflare-one/faq/troubleshooting.mdx b/src/content/docs/cloudflare-one/faq/troubleshooting.mdx index f92d8f52a5aff8..afb60f3dee8872 100644 --- a/src/content/docs/cloudflare-one/faq/troubleshooting.mdx +++ b/src/content/docs/cloudflare-one/faq/troubleshooting.mdx @@ -32,7 +32,7 @@ Cloudflare Access requires that the credentials: `same-origin parameter` be adde ## I see untrusted certificate warnings for every page and I am unable to browse the Internet. Advanced security features including HTTPS traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all of your devices, these steps will need to be performed on each new device that is to be subject to HTTP Filtering. -To install the Cloudflare root certificate, follow [this guide](/cloudflare-one/connections/connect-devices/user-side-certificates/). +To install the Cloudflare root certificate, follow [this guide](/cloudflare-one/team-and-resources/devices/user-side-certificates/). ## I see error 526 when browsing to a website. @@ -100,7 +100,7 @@ If you see this warning, you may have to disable DNS over HTTPS setting in Firef ## Chrome shows `NET::ERR_CERT_AUTHORITY_INVALID` when I use the WARP client. -Advanced security features including HTTPS traffic inspection require you to deploy a [root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on the device. If [**Install CA to system certificate store**](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/) is enabled, the WARP client will automatically install a new root certificate whenever you install or update WARP. +Advanced security features including HTTPS traffic inspection require you to deploy a [root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on the device. If [**Install CA to system certificate store**](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) is enabled, the WARP client will automatically install a new root certificate whenever you install or update WARP. Certain web browsers (such as Chrome and Microsoft Edge) load and cache root certificates when they start. Therefore, if you install a root certificate while the browser is already running, the browser may not detect the new certificate. To resolve the error, restart the browser. @@ -111,7 +111,7 @@ Cloudflare dashboard SSO does not currently support team domain changes. Contact ## WARP on Linux shows `DNS connectivity check failed`. -This error means that the `systemd-resolved` service on Linux is not allowing WARP to resolve DNS requests. You can identify this issue in the [`daemon.log`](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diag-logs) file of the `warp diag` logs, where the error message appears as `ERROR main_loop: warp::warp::connectivity_check: DNS connectivity check failed to resolve host="warp-svc."`. +This error means that the `systemd-resolved` service on Linux is not allowing WARP to resolve DNS requests. You can identify this issue in the [`daemon.log`](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#warp-diag-logs) file of the `warp diag` logs, where the error message appears as `ERROR main_loop: warp::warp::connectivity_check: DNS connectivity check failed to resolve host="warp-svc."`. To solve the issue: @@ -135,7 +135,7 @@ sudo systemctl restart systemd-resolved.service To resolve the issue, you will need to edit two Windows registry keys: -1. Configure NCSI to detect WARP's [local DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic). +1. Configure NCSI to detect WARP's [local DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic). ```txt HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\MICROSOFT\Windows\NetworkConnectivityStatusIndicator @@ -153,7 +153,7 @@ To resolve the issue, you will need to edit two Windows registry keys: Data: 1 ``` -If you continue to have issues with Microsoft 365 applications, consider enabling [**Directly route Microsoft 365 traffic**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic). +If you continue to have issues with Microsoft 365 applications, consider enabling [**Directly route Microsoft 365 traffic**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic). ## I see `WebGL Rendering Error`. @@ -185,13 +185,13 @@ Gateway does not support this downgrade mechanism. When receiving the `HTTP_1_1_ If you see an error with the title `This site can't provide a secure connection` and a subtitle of ` uses an unsupported protocol`, you must [order an Advanced Certificate](/ssl/edge-certificates/advanced-certificate-manager/manage-certificates/#create-a-certificate). -If you added a [multi-level subdomain](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-connect-an-application) (more than one level of subdomain), you must [order an Advanced Certificate for the hostname](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-connect-an-application) as Cloudflare's Universal certificate will not cover the public hostname by default. +If you added a [multi-level subdomain](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-connect-an-application) (more than one level of subdomain), you must [order an Advanced Certificate for the hostname](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-connect-an-application) as Cloudflare's Universal certificate will not cover the public hostname by default. ## As of February 2, 2025, my end-user device's browser is returning a `Your connection is not private` warning. ### Why am I getting this error? -The default global Cloudflare root certificate expired on 2025-02-02 at 16:05 UTC. If you installed the default Cloudflare certificate before 2024-10-17, you must [generate a new certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/#generate-a-cloudflare-root-certificate) and activate it for your Zero Trust organization to avoid inspection errors. If you did not generate a new certificate before February 2, 2025, you will encounter browser warnings like `Your connection is not private`. +The default global Cloudflare root certificate expired on 2025-02-02 at 16:05 UTC. If you installed the default Cloudflare certificate before 2024-10-17, you must [generate a new certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/#generate-a-cloudflare-root-certificate) and activate it for your Zero Trust organization to avoid inspection errors. If you did not generate a new certificate before February 2, 2025, you will encounter browser warnings like `Your connection is not private`. Starting with WARP client version 2024.12.554.0 and later, the WARP client will automatically install Cloudflare certificates in an end-user device's certificate store as soon as the Cloudflare certificates appear as **Available** in the Cloudflare dashboard. @@ -199,14 +199,14 @@ For WARP client versions prior to 2024.12.554.0, certificates had to be marked a ### What do I need to do? -Before deploying a new certificate, [update WARP](/cloudflare-one/connections/connect-devices/warp/download-warp/update-warp/#how-to-update-warp) to version 2024.12.554.0 or newer. +Before deploying a new certificate, [update WARP](/cloudflare-one/team-and-resources/devices/warp/download-warp/update-warp/#how-to-update-warp) to version 2024.12.554.0 or newer. For WARP client versions before and after 2024.12.554.0, certificate propagation will only occur when the WARP client is responsible for automatically installing the certificate on the client device. To enable the WARP client to propogate certificates: 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**. 2. Turn on **Install CA to system certificate store**. -If **Install CA to system certificate store** is turned off, you must [manually install the certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/), use an [MDM solution](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#mobile-device-management-mdm-software) to distribute the Cloudflare certificate to your fleet of devices, or not use the Cloudflare certificate because you do not want to have TLS decryption enabled. [TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/) must be enabled to enforce Gateway HTTP policies for HTTPS traffic. +If **Install CA to system certificate store** is turned off, you must [manually install the certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/), use an [MDM solution](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#mobile-device-management-mdm-software) to distribute the Cloudflare certificate to your fleet of devices, or not use the Cloudflare certificate because you do not want to have TLS decryption enabled. [TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/) must be enabled to enforce Gateway HTTP policies for HTTPS traffic. After enabling certificate propagation, you must update your certificate: @@ -225,7 +225,7 @@ To reset the encryption keys: 2. Select the gear icon on the top right > **Preferences**. 3. Select **Connection**, then select **Reset Encryption Keys**. -macOS Big Sur and newer releases do not allow WARP to automatically trust the certificate. You must either [manually trust the certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/#macos) as the user or [use a MDM to trust the certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#mobile-device-management-mdm-software). +macOS Big Sur and newer releases do not allow WARP to automatically trust the certificate. You must either [manually trust the certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/#macos) as the user or [use a MDM to trust the certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#mobile-device-management-mdm-software). After confirming that the certificate is installed and trusted on the end-user device, mark the certificate as **In-Use**. To mark the certificate as **In-Use**: @@ -254,7 +254,7 @@ If the new certificate is not activating on the end-user device or you are getti warp-cli tunnel rotate-keys ``` -2. [Upgrade](/cloudflare-one/connections/connect-devices/warp/download-warp/update-warp/#how-to-update-warp) to WARP version 2024.12.554.0. +2. [Upgrade](/cloudflare-one/team-and-resources/devices/warp/download-warp/update-warp/#how-to-update-warp) to WARP version 2024.12.554.0. Some customers who are on versions earlier than 2024.11.309.0 have experienced inconsistencies with certificate installation and may need to upgrade. @@ -270,7 +270,7 @@ Turning off TLS decryption should be a temporary measure. TLS decryption should ## I entered an override code for WARP that was supposed to be valid for 3 hours but the override code expired faster than I expected. -[Admin override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) codes are time-sensitive and adhere to fixed-hour time blocks. Override codes can be reused until the end of their timeout. An override code's timeout begins in the hour the override code was generated in. Refer to the following scenarios. +[Admin override](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#admin-override) codes are time-sensitive and adhere to fixed-hour time blocks. Override codes can be reused until the end of their timeout. An override code's timeout begins in the hour the override code was generated in. Refer to the following scenarios. ### Scenario one: Admin generates an override code at 9:00 AM with a timeout of one hour. @@ -294,7 +294,7 @@ If the user attempts to enter the override code at **11:59 AM** the next day, th ## I disabled WARP using an override code but WARP turned on by itself before my override code expired. -If you are using an [Admin override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) code with [Auto connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect) also enabled, WARP will turn on automatically according to the Timeout set for **Auto connect**. Using an override code to override the WARP lock switch will not disable Auto connect. As best practice, review your Auto connect settings before sending the override code to the user. +If you are using an [Admin override](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#admin-override) code with [Auto connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect) also enabled, WARP will turn on automatically according to the Timeout set for **Auto connect**. Using an override code to override the WARP lock switch will not disable Auto connect. As best practice, review your Auto connect settings before sending the override code to the user. To prevent WARP from auto connecting while using an admin override code, disable Auto connect or set a longer **Timeout** for **Auto connect**. Note the changes you make to Auto connect while the end user is using the admin override code if you need to revert these changes later. @@ -308,7 +308,7 @@ You can also examine logs in your identity provider to identify any denied reque ## WSL2 is losing connectivity when using WARP. -If your WSL2 environment is losing connectivity while using WARP, check your [split tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). +If your WSL2 environment is losing connectivity while using WARP, check your [split tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). The issue may arise because the IP range that the WSL environment uses to communicate with the host device is included in the split tunnel configuration. Excluding the WSL environment’s IP range should restore connectivity. @@ -317,7 +317,7 @@ You must ensure the host device is included in the WARP tunnel while excluding t To debug this issue: 1. Review the WSL2 environment's IP address and compare it with the laptop’s IP. -2. Check if the WSL network is [included in the split tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode). +2. Check if the WSL network is [included in the split tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode). 3. If the WSL network is included, exclude it from the split tunnel to prevent connectivity issues. ## Clientless Web Isolation is loading with a blank screen on a Windows device. @@ -354,7 +354,7 @@ msiexec /i /L*V Check the logs to verify if there are any missing DLLs (for example, `netstandard2.0`), which may point to a missing or outdated version of the .NET Framework. -One common cause is a missing or outdated version of the [.NET Framework Runtime](/cloudflare-one/connections/connect-devices/warp/download-warp/#windows:~:text=NET%20Framework%20version-,4.7.2%20or%20later,-HD%20space). Cloudflare WARP requires a .NET Framework version of `4.7.2` or later. +One common cause is a missing or outdated version of the [.NET Framework Runtime](/cloudflare-one/team-and-resources/devices/warp/download-warp/#windows:~:text=NET%20Framework%20version-,4.7.2%20or%20later,-HD%20space). Cloudflare WARP requires a .NET Framework version of `4.7.2` or later. Some legacy Windows systems (such as Windows 10 Enterprise 1607 LTSB, which is bundled with .NET `4.6`) do not include this runtime by default and may fail during installation with a `Setup Wizard ended prematurely` error. More recent Windows versions include .NET `4.7.2` or later by default and do not encounter this error. @@ -375,7 +375,7 @@ Cloudflare Access uses a [`CF_Session` cookie](/cloudflare-one/identity/authoriz ## Long-lived SSH sessions frequently disconnect. -All connections proxied through Cloudflare Gateway, including traffic to [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) SSH targets, have a maximum guaranteed duration of 10 hours. It is possible for connections to last longer than 10 hours. However, if a connection is active at the time of a Gateway release, Gateway will terminate the connection 10 hours later. Releases are not scheduled and can occur multiple times a week. +All connections proxied through Cloudflare Gateway, including traffic to [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) SSH targets, have a maximum guaranteed duration of 10 hours. It is possible for connections to last longer than 10 hours. However, if a connection is active at the time of a Gateway release, Gateway will terminate the connection 10 hours later. Releases are not scheduled and can occur multiple times a week. To prevent long-lived SSH connections from breaking unexpectedly, we recommend terminating sessions on a predefined schedule. For example, you could set an 8-hour idle timeout so that inactive sessions automatically disconnect during off hours. To configure an idle timeout, add the `ChannelTimeout` option to either the SSH server (`/etc/ssh/sshd_config`) or client configuration file (`~/.ssh/config`): diff --git a/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx b/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx index 9420cf35a854c5..f746f2435fcfbe 100644 --- a/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx +++ b/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx @@ -134,7 +134,7 @@ Do not enable Binding Cookie if: - You are using the Access application for non-browser based tools (such as SSH or RDP). - You have enabled [incompatible Cloudflare products](/cloudflare-one/applications/configure-apps/self-hosted-public-app/#product-compatibility) on the application domain. -- You have turned on [WARP authentication identity](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/) for the application. +- You have turned on [WARP authentication identity](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/) for the application. ### Cookie Path Attribute diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx b/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx index d8fa38b6ad4fe9..25c6f162634952 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx @@ -7,7 +7,7 @@ sidebar: These device posture checks can only be enforced for Cloudflare Access applications. They cannot be used in Gateway network policies. -| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | [WARP mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | +| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | | ----------------------------------------------------------------------------------------------- | ----- | ------- | ----- | --- | ---------------- | ---------------------------------------------------------------------------------------- | | [Microsoft Entra ID Conditional Access](/cloudflare-one/tutorials/entra-id-conditional-access/) | ✅ | ✅ | ❌ | ❌ | ❌ | WARP not required | | [Mutual TLS](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) | ✅ | ✅ | ✅ | ✅ | ✅ | WARP not required | diff --git a/src/content/docs/cloudflare-one/identity/devices/index.mdx b/src/content/docs/cloudflare-one/identity/devices/index.mdx index 617d237237c76d..12825b5002497c 100644 --- a/src/content/docs/cloudflare-one/identity/devices/index.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/index.mdx @@ -37,7 +37,7 @@ Gateway does not support device posture checks for the [Tanium Access integratio ## 4. Ensure traffic is going through WARP -[WARP client](/cloudflare-one/identity/devices/warp-client-checks/) and [service-to-service](/cloudflare-one/identity/devices/service-providers/) posture checks rely on traffic going through WARP to detect posture information for a device. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the following domains are included in WARP: +[WARP client](/cloudflare-one/identity/devices/warp-client-checks/) and [service-to-service](/cloudflare-one/identity/devices/service-providers/) posture checks rely on traffic going through WARP to detect posture information for a device. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the following domains are included in WARP: - The IdP used to authenticate to Cloudflare Zero Trust if posture check is part of an Access policy. - `.cloudflareaccess.com` if posture check is part of an Access policy. @@ -59,7 +59,7 @@ A --> G[Service provider] --interval--> C :::caution -Gateway does not terminate an [active session](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/#configure-warp-sessions-in-gateway) even if a subsequent posture check fails during that session. Gateway only evaluates posture checks at the beginning of a session, and ongoing sessions will remain uninterrupted. +Gateway does not terminate an [active session](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/#configure-warp-sessions-in-gateway) even if a subsequent posture check fails during that session. Gateway only evaluates posture checks at the beginning of a session, and ongoing sessions will remain uninterrupted. For example, if you establish an SSH session based on a successful posture check, but a posture requirement fails after the session has started, the session will remain active. diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/index.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/index.mdx index 76d8aa704184f5..37429fb4a363a3 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/index.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/index.mdx @@ -5,7 +5,7 @@ sidebar: order: 2 --- -Service-to-service integrations allow the WARP client to get device posture data from a third-party API. To use this feature, you must [deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) to your devices and enable the desired posture checks. +Service-to-service integrations allow the WARP client to get device posture data from a third-party API. To use this feature, you must [deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) to your devices and enable the desired posture checks. ## Supported WARP modes diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx index 3f105c419e8df1..10ec0e1b04c9de 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx @@ -11,7 +11,7 @@ The Client Certificate device posture attribute checks if the device has a valid
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -39,7 +39,7 @@ The Client Certificate device posture attribute checks if the device has a valid ::: -- Cloudflare WARP client is [deployed](/cloudflare-one/connections/connect-devices/warp/deployment/) on the device. +- Cloudflare WARP client is [deployed](/cloudflare-one/team-and-resources/devices/warp/deployment/) on the device. - A client certificate is [installed and trusted](#configure-the-client-certificate-check) on the device. :::note diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx index fd6669388a313f..0d22769f2c0ca3 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx @@ -22,11 +22,11 @@ Cloudflare Zero Trust allows you to build Zero Trust rules based on device UUIDs ## 1. Assign UUIDs to devices -You will need to use a [managed deployment tool](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to assign UUIDs. It is not possible to assign them manually. +You will need to use a [managed deployment tool](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) to assign UUIDs. It is not possible to assign them manually. 1. Generate a unique identifier for each corporate device. For best practices on choosing UUIDs, refer to the [Android documentation](https://developer.android.com/training/articles/user-data-ids#best-practices-android-identifiers). -2. Enter the UUIDs into your MDM configuration file using the [`unique_client_id` key](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#unique_client_id). +2. Enter the UUIDs into your MDM configuration file using the [`unique_client_id` key](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#unique_client_id). ## 2. Create a list of UUIDs diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx index 25eb2b95bb5b1d..e18c39e35c5d32 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx @@ -6,7 +6,7 @@ sidebar: --- -These device posture checks are performed by the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/). To use this feature, you must [deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) to your devices and enable the desired posture checks. +These device posture checks are performed by the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/). To use this feature, you must [deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) to your devices and enable the desired posture checks. ## Supported WARP modes diff --git a/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx b/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx index 45958b9fc22f6a..af947b3763866c 100644 --- a/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx +++ b/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx @@ -281,7 +281,7 @@ Since the SCIM request from Microsoft does not include nested group information, ## Force user interaction during WARP reauthentication -You can require users to re-enter their credentials into Entra ID whenever they [re-authenticate their WARP session](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). To configure this setting: +You can require users to re-enter their credentials into Entra ID whenever they [re-authenticate their WARP session](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). To configure this setting: 1. Make a `GET` request to the [Identity Providers endpoint](/api/resources/zero_trust/subresources/identity_providers/) and copy the response for the Entra ID identity provider. diff --git a/src/content/docs/cloudflare-one/identity/service-tokens.mdx b/src/content/docs/cloudflare-one/identity/service-tokens.mdx index 3448bc46e60a99..fb54c0efc73bc1 100644 --- a/src/content/docs/cloudflare-one/identity/service-tokens.mdx +++ b/src/content/docs/cloudflare-one/identity/service-tokens.mdx @@ -15,7 +15,7 @@ This section covers how to create, renew, and revoke a service token. -You can now configure your Access applications and [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token) to accept this service token. Make sure to set the policy action to [**Service Auth**](/cloudflare-one/policies/access/#service-auth); otherwise, Access will prompt for an identity provider login. +You can now configure your Access applications and [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#check-for-service-token) to accept this service token. Make sure to set the policy action to [**Service Auth**](/cloudflare-one/policies/access/#service-auth); otherwise, Access will prompt for an identity provider login. ## Connect your service to Access diff --git a/src/content/docs/cloudflare-one/identity/users/session-management.mdx b/src/content/docs/cloudflare-one/identity/users/session-management.mdx index b810aaa43cdaef..94ca8d91ba9ea0 100644 --- a/src/content/docs/cloudflare-one/identity/users/session-management.mdx +++ b/src/content/docs/cloudflare-one/identity/users/session-management.mdx @@ -84,7 +84,7 @@ Users who match a policy configured with a _Same as application session timeout_ ### WARP session duration -When [WARP authentication identity](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/#configure-warp-sessions-in-access) is enabled for an Access application, the WARP session duration overrides the application and policy session durations. If the global session expires but the user already has a valid WARP session, the user will not need to reauthenticate with the IdP until the WARP session expires, given the user is running WARP. +When [WARP authentication identity](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/#configure-warp-sessions-in-access) is enabled for an Access application, the WARP session duration overrides the application and policy session durations. If the global session expires but the user already has a valid WARP session, the user will not need to reauthenticate with the IdP until the WARP session expires, given the user is running WARP. ### Order of enforcement diff --git a/src/content/docs/cloudflare-one/index.mdx b/src/content/docs/cloudflare-one/index.mdx index 0d460566dfe44e..3dae36c88f9e70 100644 --- a/src/content/docs/cloudflare-one/index.mdx +++ b/src/content/docs/cloudflare-one/index.mdx @@ -33,7 +33,7 @@ Secure your organization with Cloudflare Zero Trust — a cloud security model t Cloudflare Zero Trust is part of Cloudflare One, our name for the Secure Access Service Edge (SASE) platform that protects enterprise applications, users, devices, and networks. -By progressively adopting Cloudflare One, organizations can move away from a patchwork of hardware appliances and point solutions, and instead consolidate security and networking through a unified control plane that includes products like [Cloudflare Access](/cloudflare-one/policies/access/), [Secure Web Gateway (SWG)](/cloudflare-one/policies/gateway/), [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/), [Data Loss Prevention (DLP)](/cloudflare-one/policies/data-loss-prevention/), [Remote Browser Isolation (RBI)](/cloudflare-one/policies/browser-isolation/), [Cloud Access Security Broker (CASB)](/cloudflare-one/applications/casb/), and [Email Security](/cloudflare-one/email-security/). +By progressively adopting Cloudflare One, organizations can move away from a patchwork of hardware appliances and point solutions, and instead consolidate security and networking through a unified control plane that includes products like [Cloudflare Access](/cloudflare-one/policies/access/), [Secure Web Gateway (SWG)](/cloudflare-one/policies/gateway/), [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/), [Data Loss Prevention (DLP)](/cloudflare-one/policies/data-loss-prevention/), [Remote Browser Isolation (RBI)](/cloudflare-one/policies/browser-isolation/), [Cloud Access Security Broker (CASB)](/cloudflare-one/applications/casb/), and [Email Security](/cloudflare-one/email-security/). Refer to our [SASE reference architecture](/reference-architecture/architectures/sase/) to learn how to plan, deploy, and manage SASE architecture with Cloudflare. @@ -61,7 +61,7 @@ Authenticate users accessing your applications, seamlessly onboard third-party u - + Securely connect your resources to Cloudflare without exposing a public IP by using Cloudflare Tunnel, which establishes outbound-only connections from your infrastructure to Cloudflare’s global network via the lightweight `cloudflared` daemon. @@ -73,7 +73,7 @@ Inspect and filter DNS, network, HTTP, and egress traffic to enforce your compan - + Protect corporate devices by privately sending traffic from those devices to Cloudflare's global network, build device posture rules, and enforce security policies anywhere. diff --git a/src/content/docs/cloudflare-one/insights/dex/index.mdx b/src/content/docs/cloudflare-one/insights/dex/index.mdx index 3c83623ddf5d41..2a5b6437935acc 100644 --- a/src/content/docs/cloudflare-one/insights/dex/index.mdx +++ b/src/content/docs/cloudflare-one/insights/dex/index.mdx @@ -9,20 +9,20 @@ import { DirectoryListing, Render } from "~/components"; Digital Experience Monitoring (DEX) provides visibility into device, network, and application performance across your Zero Trust organization. -With DEX, you can monitor the state of your [WARP client](/cloudflare-one/connections/connect-devices/warp/) deployment and resolve issues impacting end-user productivity. DEX is designed for IT and security teams who need to proactively monitor and troubleshoot device and network health across distributed environments. DEX is available on all Cloudflare Zero Trust and SASE plans. +With DEX, you can monitor the state of your [WARP client](/cloudflare-one/team-and-resources/devices/warp/) deployment and resolve issues impacting end-user productivity. DEX is designed for IT and security teams who need to proactively monitor and troubleshoot device and network health across distributed environments. DEX is available on all Cloudflare Zero Trust and SASE plans. Use DEX to troubleshoot other Zero Trust features: - Test connectivity to a [SaaS application secured with Access](/cloudflare-one/applications/configure-apps/saas-apps/). - Verify that a website routed through [Gateway](/cloudflare-one/policies/gateway/) is reachable from user devices. -- Confirm that users can successfully reach internal resources after configuring a [Tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). +- Confirm that users can successfully reach internal resources after configuring a [Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). ### Get started To start using DEX for device, network, and application monitoring: 1. [Create a Zero Trust organization](/cloudflare-one/setup/#create-a-zero-trust-organization). -2. [Install the WARP client](/cloudflare-one/connections/connect-devices/warp/) and sign in to register your device to the organization. +2. [Install the WARP client](/cloudflare-one/team-and-resources/devices/warp/) and sign in to register your device to the organization. 3. Create [tests](/cloudflare-one/insights/dex/tests/) to verify device connectivity to applications and networks. 4. [Monitor](/cloudflare-one/insights/dex/monitoring/) device and network health across your fleet using real-time and historical metrics. 5. Run [remote captures](/cloudflare-one/insights/dex/remote-captures/) to collect diagnostic logs and packet captures from user devices. diff --git a/src/content/docs/cloudflare-one/insights/dex/monitoring.mdx b/src/content/docs/cloudflare-one/insights/dex/monitoring.mdx index e1b8f0d98a28ec..0fb541bc64b100 100644 --- a/src/content/docs/cloudflare-one/insights/dex/monitoring.mdx +++ b/src/content/docs/cloudflare-one/insights/dex/monitoring.mdx @@ -34,10 +34,10 @@ To view analytics on a per-device level, go to [Device monitoring](/cloudflare-o | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connected | WARP has successfully established a connection to the Cloudflare global network. | | Disconnected | WARP has been intentionally or unintentionally disconnected from the Cloudflare global network. | - | Paused | A user or administrator has taken an explicit action to temporarily turn off WARP, for example by entering an [Admin Override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) code. Paused clients will [auto-connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect) after a timeout period. | + | Paused | A user or administrator has taken an explicit action to temporarily turn off WARP, for example by entering an [Admin Override](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#admin-override) code. Paused clients will [auto-connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect) after a timeout period. | | Connecting | WARP is pending connection, but is actively trying to establish a connection to the Cloudflare global network. | -- **Mode**: [WARP mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) deployed on the device. +- **Mode**: [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) deployed on the device. - **Colo**: Percentage of devices connected to a given Cloudflare data center. diff --git a/src/content/docs/cloudflare-one/insights/dex/remote-captures.mdx b/src/content/docs/cloudflare-one/insights/dex/remote-captures.mdx index 8ec4702fccd39d..2a443270311c61 100644 --- a/src/content/docs/cloudflare-one/insights/dex/remote-captures.mdx +++ b/src/content/docs/cloudflare-one/insights/dex/remote-captures.mdx @@ -35,7 +35,7 @@ You can analyze `.pcap` files using Wireshark or another third-party packet capt ### WARP Diag contents -Refer to [WARP diagnostic logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diag-logs) for a description of each file. +Refer to [WARP diagnostic logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#warp-diag-logs) for a description of each file. ## WARP diagnostics analyzer (beta) diff --git a/src/content/docs/cloudflare-one/insights/dex/tests/http.mdx b/src/content/docs/cloudflare-one/insights/dex/tests/http.mdx index 77bc1c346264ff..7ea377d6c7d907 100644 --- a/src/content/docs/cloudflare-one/insights/dex/tests/http.mdx +++ b/src/content/docs/cloudflare-one/insights/dex/tests/http.mdx @@ -9,7 +9,7 @@ import { Details } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS Filtering
| All plans | @@ -34,8 +34,8 @@ To set up an HTTP test for an application: 2. Select **Add a Test**. 3. Fill in the following fields: - **Name**: Enter any name for the test. - - **Target**: Enter the URL of the website or application that you want to test (for example, `https://jira.site.com`). Both public and private hostnames are supported. If testing a private hostname, ensure that the domain is on your [local domain fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) list. - - **Source device profiles**: (Optional) Select the [WARP device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) that you want to run the test on. If no profiles are selected, the test will run on all supported devices connected to your Zero Trust organization. + - **Target**: Enter the URL of the website or application that you want to test (for example, `https://jira.site.com`). Both public and private hostnames are supported. If testing a private hostname, ensure that the domain is on your [local domain fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) list. + - **Source device profiles**: (Optional) Select the [WARP device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) that you want to run the test on. If no profiles are selected, the test will run on all supported devices connected to your Zero Trust organization. - **Test type**: Select _HTTP Get_. - **Test frequency**: Specify how often the test will run. Input a minute value between 5 and 60. 4. Select **Add test**. diff --git a/src/content/docs/cloudflare-one/insights/dex/tests/traceroute.mdx b/src/content/docs/cloudflare-one/insights/dex/tests/traceroute.mdx index 73d9a92f71b9e4..15cc294c016b21 100644 --- a/src/content/docs/cloudflare-one/insights/dex/tests/traceroute.mdx +++ b/src/content/docs/cloudflare-one/insights/dex/tests/traceroute.mdx @@ -9,7 +9,7 @@ import { Details } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS Filtering
| All plans | @@ -35,7 +35,7 @@ To set up a traceroute test for an application: 3. Fill in the following fields: - **Name**: Enter any name for the test. - **Target**: Enter the IP address of the server you want to test (for example, `192.0.2.0`). You can test either a public-facing endpoint or a private endpoint you have connected to Cloudflare. - - **Source device profiles**: (Optional) Select the [WARP device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) that you want to run the test on. If no profiles are selected, the test will run on all supported devices connected to your Zero Trust organization. + - **Source device profiles**: (Optional) Select the [WARP device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) that you want to run the test on. If no profiles are selected, the test will run on all supported devices connected to your Zero Trust organization. - **Test type**: Select _Traceroute_. - **Test frequency**: Specify how often the test will run. Input a minute value between 5 and 60. 4. Select **Add test**. diff --git a/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx b/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx index 913ab013eefe6a..32da9d1c097d74 100644 --- a/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx +++ b/src/content/docs/cloudflare-one/insights/logs/audit-logs.mdx @@ -108,7 +108,7 @@ Cloudflare Access logs the following information when the user authenticates to | **Hostname** | Hostname of the infrastructure target. | | **Target ID** | UUID of the infrastructure target. | | **SSH user** | The UNIX user, such as `root`, that the authenticating user specified when connecting to the infrastructure target. | -| **SSH logs** | SSH commands that the user ran on the target. Requires configuring an [SSH encryption key](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#ssh-command-logs) before the session begins. | +| **SSH logs** | SSH commands that the user ran on the target. Requires configuring an [SSH encryption key](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#ssh-command-logs) before the session begins. | ### Non-identity authentication diff --git a/src/content/docs/cloudflare-one/insights/logs/gateway-logs/index.mdx b/src/content/docs/cloudflare-one/insights/logs/gateway-logs/index.mdx index 63b07c17952d16..330aa9b5f37ea7 100644 --- a/src/content/docs/cloudflare-one/insights/logs/gateway-logs/index.mdx +++ b/src/content/docs/cloudflare-one/insights/logs/gateway-logs/index.mdx @@ -35,7 +35,7 @@ These settings will only apply to logs displayed in Zero Trust. Logpush data is | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Query name** | Name of the domain that was queried. | | **Query ID** | UUID of the query assigned by Cloudflare. | -| **Email** | Email address of the user who registered the WARP client where traffic originated from. If a non-identity on-ramp (such as a [proxy endpoint](/cloudflare-one/connections/connect-devices/agentless/pac-files/)) or machine-level authentication (such as a [service token](/cloudflare-one/identity/service-tokens/)) was used, this value will be `non_identity@.cloudflareaccess.com`. | +| **Email** | Email address of the user who registered the WARP client where traffic originated from. If a non-identity on-ramp (such as a [proxy endpoint](/cloudflare-one/team-and-resources/devices/agentless/pac-files/)) or machine-level authentication (such as a [service token](/cloudflare-one/identity/service-tokens/)) was used, this value will be `non_identity@.cloudflareaccess.com`. | | **Action** | The [Action](/cloudflare-one/policies/gateway/dns-policies/#actions) Gateway applied to the query (such as Allow or Block). | | **Time** | Date and time of the DNS query. | | **Resolver decision** | The reason why Gateway applied a particular **Action** to the request. Refer to the [list of resolver decisions](#resolver-decisions). | @@ -46,7 +46,7 @@ These settings will only apply to logs displayed in Zero Trust. Logpush data is | Field | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -| **DNS location** | [User-configured location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) from where the DNS query was made. | +| **DNS location** | [User-configured location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) from where the DNS query was made. | | **Policy name** | Name of the matched policy. | | **Policy ID** | ID of the matched policy. | | **Policy description** | Description of the matched policy. | @@ -145,7 +145,7 @@ Gateway can log failed connections in [network session logs](/logs/logpush/logpu | Field | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -| **DNS location** | [User-configured location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) from where the DNS query was made. | +| **DNS location** | [User-configured location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) from where the DNS query was made. | | **Policy name** | Name of the matched policy. | | **Policy ID** | ID of the policy enforcing the decision Gateway made. | | **Policy description** | Description of the matched policy. | @@ -177,9 +177,9 @@ Gateway can log failed connections in [network session logs](/logs/logpush/logpu | **Transport protocol** | Protocol over which the packet was sent. | | **Detected Protocol** | The detected [network protocol](/cloudflare-one/policies/gateway/network-policies/protocol-detection/). | | **SNI** | Host whose Server Name Indication (SNI) header Gateway will filter traffic against. | -| **Virtual Network** | [Virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) that the client is connected to. | +| **Virtual Network** | [Virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) that the client is connected to. | | **Category details** | Category or categories associated with the packet. | -| **Proxy endpoint** | [PAC file proxy endpoint](/cloudflare-one/connections/connect-devices/agentless/pac-files/) Gateway forwarded traffic to, if applicable. | +| **Proxy endpoint** | [PAC file proxy endpoint](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) Gateway forwarded traffic to, if applicable. | | **Application ID** | ID of the application that matched the domain. | | **Application name** | Name of the application that matched the domain. | @@ -213,7 +213,7 @@ When an HTTP request results in an error, Gateway logs the first 512 bytes of th | Field | Description | | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -| **DNS location** | [User-configured location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) from where the DNS query was made. | +| **DNS location** | [User-configured location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) from where the DNS query was made. | | **Policy name** | Name of the matched policy. | | **Policy ID** | ID of the matched policy. | | **Policy description** | Description of the matched policy. | @@ -253,8 +253,8 @@ When an HTTP request results in an error, Gateway logs the first 512 bytes of th | **Application ID** | ID of the application that matched the domain. | | **Application name** | Name of the application that matched the domain. | | **Categories** | [Content categories](/cloudflare-one/policies/gateway/domain-categories/) that the domain belongs to. | -| **Proxy endpoint** | [PAC file proxy endpoint](/cloudflare-one/connections/connect-devices/agentless/pac-files/) Gateway forwarded traffic to, if applicable. | -| **Virtual Network** | [Virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) that the client is connected to. | +| **Proxy endpoint** | [PAC file proxy endpoint](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) Gateway forwarded traffic to, if applicable. | +| **Virtual Network** | [Virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) that the client is connected to. | | **Sandbox scanned** | Status of the [file quarantine](/cloudflare-one/policies/gateway/http-policies/file-sandboxing/). | #### File detection details diff --git a/src/content/docs/cloudflare-one/insights/logs/logpush.mdx b/src/content/docs/cloudflare-one/insights/logs/logpush.mdx index c1cfe8ab0b7135..753255327b480e 100644 --- a/src/content/docs/cloudflare-one/insights/logs/logpush.mdx +++ b/src/content/docs/cloudflare-one/insights/logs/logpush.mdx @@ -50,7 +50,7 @@ Refer to [Logpush datasets](/logs/logpush/logpush-job/datasets/) for a list of a | [Gateway DNS](/logs/logpush/logpush-job/datasets/account/gateway_dns/) | DNS queries inspected by Cloudflare Gateway | | [Gateway HTTP](/logs/logpush/logpush-job/datasets/account/gateway_http/) | HTTP requests inspected by Cloudflare Gateway | | [Gateway Network](/logs/logpush/logpush-job/datasets/account/gateway_network/) | Network packets inspected by Cloudflare Gateway | -| [SSH Logs](/logs/logpush/logpush-job/datasets/account/ssh_logs/) | SSH command logs for [Access for Infrastructure targets](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) | +| [SSH Logs](/logs/logpush/logpush-job/datasets/account/ssh_logs/) | SSH command logs for [Access for Infrastructure targets](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) | | [Zero Trust Network Session Logs](/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) | Network session logs for traffic proxied by Cloudflare Gateway | ## Parse DNS logs diff --git a/src/content/docs/cloudflare-one/insights/logs/users.mdx b/src/content/docs/cloudflare-one/insights/logs/users.mdx index 529d4b118acc71..d9bd9986d732a2 100644 --- a/src/content/docs/cloudflare-one/insights/logs/users.mdx +++ b/src/content/docs/cloudflare-one/insights/logs/users.mdx @@ -16,7 +16,7 @@ In [Zero Trust](https://one.dash.cloudflare.com/), go to **My Team** > **Users** ### Available logs -* **User Registry identity**: Select the user's name to view their last seen identity. This identity is used to evaluate Gateway policies and WARP [device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/). A refresh occurs when the user re-authenticates WARP, logs into an Access application, or has their IdP group membership updated via SCIM provisioning. To track how the user's identity has changed over time, go to the **Audit logs** tab. +* **User Registry identity**: Select the user's name to view their last seen identity. This identity is used to evaluate Gateway policies and WARP [device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/). A refresh occurs when the user re-authenticates WARP, logs into an Access application, or has their IdP group membership updated via SCIM provisioning. To track how the user's identity has changed over time, go to the **Audit logs** tab. * **Session identities**: The user's active sessions, the identity used to authenticate each session, and when each session will [expire](/cloudflare-one/identity/users/session-management/). * **Devices**: Devices registered to the user via WARP. * **Recent activities**: The user's five most recent Access login attempts. For more details, refer to your [authentication audit logs](/cloudflare-one/insights/logs/audit-logs/#authentication-audit-logs). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/index.mdx similarity index 89% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/index.mdx index 1af13d5fd49f91..592a5b97a6dec1 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/index.mdx @@ -7,10 +7,10 @@ sidebar: import { TabItem, Tabs, Render } from "~/components"; -Remotely-managed tunnels run as a service on your OS. You can modify the Cloudflare Tunnel service with one or more [general-purpose tunnel parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/). +Remotely-managed tunnels run as a service on your OS. You can modify the Cloudflare Tunnel service with one or more [general-purpose tunnel parameters](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/). :::note -For instructions on configuring a locally-managed tunnel, refer to the [configuration file documentation](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/). +For instructions on configuring a locally-managed tunnel, refer to the [configuration file documentation](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). ::: ## Update tunnel run parameters @@ -140,11 +140,11 @@ On Windows, Cloudflare Tunnel installs itself as a system service using the Regi ## Update origin configuration -To configure how `cloudflared` sends requests to your [published applications](/cloudflare-one/connections/connect-networks/routing-to-tunnel/): +To configure how `cloudflared` sends requests to your [published applications](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/): 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels**. 2. Choose a tunnel and select **Configure**. 3. Select the **Published application routes** tab. 4. Choose an application and select **Edit**. -5. Under **Additional application settings**, modify one or more [origin configuration parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters/). +5. Under **Additional application settings**, modify one or more [origin configuration parameters](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters/). 6. Select **Save**. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters.mdx similarity index 88% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters.mdx index f8f6b6071dd4b9..67ca295adee84d 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters.mdx @@ -6,7 +6,7 @@ sidebar: --- -Origin configuration parameters determine how `cloudflared` proxies traffic to your origin server. If you are using remotely-managed tunnels (default), configure these settings [using the dashboard or API](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/#update-origin-configuration). If you are using [locally-managed tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/), add these parameters to your [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/). +Origin configuration parameters determine how `cloudflared` proxies traffic to your origin server. If you are using remotely-managed tunnels (default), configure these settings [using the dashboard or API](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/#update-origin-configuration). If you are using [locally-managed tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/), add these parameters to your [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). ## TLS settings @@ -173,7 +173,7 @@ The timeout after which a TCP keepalive packet is sent on a connection between C Requires `cloudflared` to validate the [Cloudflare Access JWT](/cloudflare-one/identity/authorization-cookie/validating-json/) prior to proxying traffic to your origin. You can enforce this check on public hostname services that are protected by an Access application. For all L7 requests to these hostnames, Access will send the JWT to `cloudflared` as a `Cf-Access-Jwt-Assertion` request header. -To enable this security control in a [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/#origin-configuration), [get the AUD tag](/cloudflare-one/identity/authorization-cookie/validating-json/#get-your-aud-tag) for your Access application and add the following rule to `originRequest`: +To enable this security control in a [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/#origin-configuration), [get the AUD tag](/cloudflare-one/identity/authorization-cookie/validating-json/#get-your-aud-tag) for your Access application and add the following rule to `originRequest`: ```yml access: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters.mdx similarity index 87% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters.mdx index f78522d83cc068..2f7a652eaf10ad 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters.mdx @@ -7,9 +7,9 @@ sidebar: import { Render } from "~/components"; -This page lists general-purpose configuration options that you can [add](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/#update-tunnel-run-parameters) to the `cloudflared tunnel run` command. +This page lists general-purpose configuration options that you can [add](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/#update-tunnel-run-parameters) to the `cloudflared tunnel run` command. -Alternatively, if you are running a [locally-managed tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/) you can add these flags to your [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/) as key/value pairs. +Alternatively, if you are running a [locally-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/) you can add these flags to your [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/) as key/value pairs. ## `autoupdate-freq` @@ -32,7 +32,7 @@ For locally-managed tunnels only. | ------------------------------------------------------- | --------------------------- | | `cloudflared tunnel --config run ` | `~/.cloudflared/config.yml` | -Specifies the path to a [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/) in YAML format. +Specifies the path to a [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/) in YAML format. ## `edge-bind-address` @@ -84,9 +84,9 @@ Specifies the verbosity of logging for the local `cloudflared` instance. Availab | Syntax | Default | Environment Variable | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | -------------------- | -| `cloudflared tunnel --metrics run ` | Refer to [Tunnel metrics](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/) | `TUNNEL_METRICS` | +| `cloudflared tunnel --metrics run ` | Refer to [Tunnel metrics](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/) | `TUNNEL_METRICS` | -Exposes a Prometheus endpoint on the specified IP address and port, which you can then query for [usage metrics](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/). +Exposes a Prometheus endpoint on the specified IP address and port, which you can then query for [usage metrics](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/). ## `no-autoupdate` @@ -113,7 +113,7 @@ For locally-managed tunnels only. | ----------------------------------------------------------- | ------------------------- | -------------------- | | `cloudflared tunnel --origincert run ` | `~/.cloudflared/cert.pem` | `TUNNEL_ORIGIN_CERT` | -Specifies the [account certificate](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions/) for one of your zones, authorizing the client to serve as an origin for that zone. You can obtain a certificate by using the `cloudflared tunnel login` command or by visiting `https://dash.cloudflare.com/argotunnel`. +Specifies the [account certificate](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-permissions/) for one of your zones, authorizing the client to serve as an origin for that zone. You can obtain a certificate by using the `cloudflared tunnel login` command or by visiting `https://dash.cloudflare.com/argotunnel`. ## `pidfile` @@ -151,7 +151,7 @@ The `auto` value will automatically configure the `quic` protocol. If `cloudflar Allows you to choose the regions to which connections are established. Currently the only available value is `us`, which routes all connections through data centers in the United States. Omit or leave empty to connect to the global region. -When the region is set to `us`, `cloudflared` uses different US-specific hostnames and IPs. Refer to [Tunnel with firewall](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall/#region-us) for details. +When the region is set to `us`, `cloudflared` uses different US-specific hostnames and IPs. Refer to [Tunnel with firewall](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#region-us) for details. ## `retries` @@ -180,7 +180,7 @@ For remotely-managed tunnels only. | ----------------------------------------------- | -------------------- | | `cloudflared tunnel run --token ` | `TUNNEL_TOKEN` | -Associates the `cloudflared` instance with a specific tunnel. The tunnel's token is shown in the dashboard when you first [create the tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). You can also retrieve the token using the [API](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/token/methods/get/). +Associates the `cloudflared` instance with a specific tunnel. The tunnel's token is shown in the dashboard when you first [create the tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). You can also retrieve the token using the [API](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/token/methods/get/). ## `token-file` diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/remote-tunnel-permissions.mdx similarity index 95% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/remote-tunnel-permissions.mdx index 0b7446a3eb91ba..227975464be10f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/remote-tunnel-permissions.mdx @@ -53,7 +53,7 @@ The token value can be found in the `result`. ## Rotate a token without service disruption -Cloudflare recommends rotating the tunnel token at a regular cadence to reduce the risk of token compromise. You can rotate a token with minimal disruption to users as long as the tunnel is served by at least two [`cloudflared` replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/). To ensure service availability, we recommend performing token rotations outside of working hours or in a maintenance window. +Cloudflare recommends rotating the tunnel token at a regular cadence to reduce the risk of token compromise. You can rotate a token with minimal disruption to users as long as the tunnel is served by at least two [`cloudflared` replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/). To ensure service availability, we recommend performing token rotations outside of working hours or in a maintenance window. To rotate a tunnel token: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/deploy-replicas.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas.mdx similarity index 85% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/deploy-replicas.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas.mdx index 2a5fb27db74dab..1975491d863fb2 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/deploy-replicas.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas.mdx @@ -12,12 +12,12 @@ To deploy multiple instances of `cloudflared`, you can create and configure one You can run the same tunnel across various `cloudflared` processes for up to 100 connections (25 replicas) per tunnel. Cloudflare Load Balancers and DNS records can still point to the tunnel and its UUID. Traffic will be sent to all `cloudflared` processes associated with the tunnel. :::tip[Deploy replicas in Kubernetes] -For information about running `cloudflared` in a Kubernetes deployment, refer to the [Kubernetes guide](/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes/). +For information about running `cloudflared` in a Kubernetes deployment, refer to the [Kubernetes guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/). ::: ## Remotely-managed tunnels -1. To create a remotely-managed tunnel, follow the [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). +1. To create a remotely-managed tunnel, follow the [dashboard setup guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). 2. On the **Tunnels** page, select your newly created tunnel. 3. In the side panel, scroll down to **Connectors** to view the `cloudflared` instances for that tunnel. 3. Select **Edit**. @@ -28,7 +28,7 @@ The new replica will appear on the **Connectors** list for the tunnel. All repli ## Locally-managed tunnels -1. To create a locally-managed tunnel, complete Steps 1 through 5 in the [CLI setup guide](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/). +1. To create a locally-managed tunnel, complete Steps 1 through 5 in the [CLI setup guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/). 2. Run your newly created tunnel. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/index.mdx similarity index 81% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/index.mdx index 5f22d11ba75dd4..617ab8032c6ead 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/index.mdx @@ -39,9 +39,9 @@ By design, replicas do not offer any level of traffic steering (random, hash, or - To provide additional points of availability for a single tunnel. - To allocate failover nodes within your network. -- To update the configuration of a tunnel [without downtime](/cloudflare-one/connections/connect-networks/downloads/update-cloudflared/#update-with-multiple-cloudflared-instances). +- To update the configuration of a tunnel [without downtime](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/#update-with-multiple-cloudflared-instances). -For setup instructions, refer to [Deploy cloudflared replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/deploy-replicas/). +For setup instructions, refer to [Deploy cloudflared replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas/). ## Cloudflare Load Balancers @@ -79,11 +79,11 @@ graph LR - To get a [health alert](/notifications/notification-available/#load-balancing) when a tunnel reaches an inactive state. - To distribute traffic more evenly across your Cloudflare Tunnel-accessible origins or endpoints. -For setup instructions, refer to [Public load balancers](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/) or [Private Network Load Balancing](/load-balancing/private-network/) depending on your [use case](#types-of-load-balancers). +For setup instructions, refer to [Public load balancers](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/) or [Private Network Load Balancing](/load-balancing/private-network/) depending on your [use case](#types-of-load-balancers). ### Types of load balancers There are two types of load balancers that you can use with Cloudflare Tunnel endpoints: -- [Public load balancers](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/) steer traffic from the Internet to applications published on a Cloudflare domain. Use this method if your service is served by Cloudflare Tunnel via a [published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application). -- [Private load balancers](/load-balancing/private-network/) steer traffic from WARP clients, Magic WAN, and other on-ramps to an internal IP on your private network. Use this method if your service is connected to Cloudflare Tunnel via a [CIDR route](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/). +- [Public load balancers](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/) steer traffic from the Internet to applications published on a Cloudflare domain. Use this method if your service is served by Cloudflare Tunnel via a [published application route](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-publish-an-application). +- [Private load balancers](/load-balancing/private-network/) steer traffic from WARP clients, Magic WAN, and other on-ramps to an internal IP on your private network. Use this method if your service is connected to Cloudflare Tunnel via a [CIDR route](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/system-requirements.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements.mdx similarity index 88% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/system-requirements.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements.mdx index e7cb89c5c7c2c3..dc5d5a91016a2b 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/system-requirements.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements.mdx @@ -13,7 +13,7 @@ Our connector, `cloudflared`, was designed to be lightweight and flexible enough For most use cases, we recommend the following baseline configuration: -- Run a [`cloudflared` replica](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/#cloudflared-replicas) on two dedicated host machines per network location. Using two hosts enables server-side redundancy. +- Run a [`cloudflared` replica](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/#cloudflared-replicas) on two dedicated host machines per network location. Using two hosts enables server-side redundancy. - Size each host with minimum 4GB of RAM and 4 CPU cores. - Allocate 50,000 [ports](#number-of-ports) to the `cloudflared` process on each host. @@ -59,7 +59,7 @@ netsh int ipv6 set dynamicport udp start=11000 num=50000 ### Private DNS -DNS queries utilize [more system resources](#estimated-throughput) compared to TCP and non-DNS UDP requests. To optimize service availability, Cloudflare recommends splitting [private DNS traffic](/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns/) into its own Cloudflare Tunnel. The tunnel should run on a dedicated host and only include routes for your internal DNS resolver IPs. +DNS queries utilize [more system resources](#estimated-throughput) compared to TCP and non-DNS UDP requests. To optimize service availability, Cloudflare recommends splitting [private DNS traffic](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/) into its own Cloudflare Tunnel. The tunnel should run on a dedicated host and only include routes for your internal DNS resolver IPs. ### ulimits @@ -101,7 +101,7 @@ Our [baseline recommendations](#recommendations) serve as a starting point for a To calculate your tunnel capacity: 1. Set up a [metrics service](/cloudflare-one/tutorials/grafana/) when you run the tunnel. -2. After a week or so, query the following [tunnel metrics](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#cloudflared-metrics): +2. After a week or so, query the following [tunnel metrics](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/#cloudflared-metrics): - `cloudflared_tcp_total_sessions` - `cloudflared_udp_total_sessions` 3. Compute the average **TCP requests per second** and **Non-DNS UDP requests per second** by dividing total sessions by total time. @@ -110,4 +110,4 @@ To calculate your tunnel capacity: -You can use these results to determine if your tunnel is appropriately sized. To increase your tunnel capacity, add identical host machines running [`cloudflared` replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/#cloudflared-replicas). +You can use these results to determine if your tunnel is appropriately sized. To increase your tunnel capacity, add identical host machines running [`cloudflared` replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/#cloudflared-replicas). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall.mdx similarity index 97% rename from src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall.mdx index afeedd7b61f707..c557ffb3f855bf 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall.mdx @@ -68,7 +68,7 @@ This rule is only required for firewalls that enforce SNI. ### Region US -When using the [US region](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#region), ensure your firewall allows outbound connections to these US-region destinations on port `7844` (TCP/UDP) for tunnel operation. +When using the [US region](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#region), ensure your firewall allows outbound connections to these US-region destinations on port `7844` (TCP/UDP) for tunnel operation. #### `us-region1.v2.argotunnel.com` @@ -112,7 +112,7 @@ Allows `cloudflared` to download the latest release and perform a software updat #### `.cloudflareaccess.com` -Allows `cloudflared` to validate the Access JWT. Only required if the [`access`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters/#access) setting is enabled. +Allows `cloudflared` to validate the Access JWT. Only required if the [`access`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters/#access) setting is enabled. | IPv4 | IPv6 | Port | Protocols | | ------------------------------- | ------------------------------------------------------- | ---- | ----------- | diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/ansible.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/ansible.mdx similarity index 91% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/ansible.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/ansible.mdx index 231f1939f6bd7a..cb917728c9eb51 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/ansible.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/ansible.mdx @@ -9,14 +9,14 @@ import { Render } from "~/components"; Ansible is a software tool that enables at scale management of infrastructure. Ansible is agentless — all it needs to function is the ability to SSH to the target and Python installed on the target. -Ansible works alongside Terraform to streamline the Cloudflare Tunnel setup process. In this guide, you will use Terraform to deploy an SSH server on Google Cloud and create a [locally-managed tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/) that makes the server available over the Internet. Terraform will automatically run an Ansible playbook that installs and configures `cloudflared` on the server. +Ansible works alongside Terraform to streamline the Cloudflare Tunnel setup process. In this guide, you will use Terraform to deploy an SSH server on Google Cloud and create a [locally-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/) that makes the server available over the Internet. Terraform will automatically run an Ansible playbook that installs and configures `cloudflared` on the server. ## Prerequisites To complete the steps in this guide, you will need: - [A Google Cloud Project](https://cloud.google.com/resource-manager/docs/creating-managing-projects#creating_a_project) and [GCP CLI installed and authenticated](https://cloud.google.com/sdk/docs/install). -- [Basic knowledge of Terraform](/cloudflare-one/connections/connect-networks/deployment-guides/terraform/) and [Terraform installed](https://developer.hashicorp.com/terraform/tutorials/certification-associate-tutorials/install-cli). +- [Basic knowledge of Terraform](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform/) and [Terraform installed](https://developer.hashicorp.com/terraform/tutorials/certification-associate-tutorials/install-cli). - [A zone on Cloudflare](/fundamentals/manage-domains/add-site/). - [A Cloudflare API token](/fundamentals/api/get-started/create-token/) with `Cloudflare Tunnel` and `DNS` permissions. @@ -133,7 +133,7 @@ The following configuration will modify settings in your Cloudflare account. ### Configure GCP resources -The following configuration defines the specifications for the GCP virtual machine and installs Python3 on the machine. Python3 allows Ansible to configure the GCP instance instead of having to run a [startup script](/cloudflare-one/connections/connect-networks/deployment-guides/terraform/#create-a-startup-script) on boot. +The following configuration defines the specifications for the GCP virtual machine and installs Python3 on the machine. Python3 allows Ansible to configure the GCP instance instead of having to run a [startup script](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform/#create-a-startup-script) on boot. 1. In your configuration directory, create a `.tf` file: @@ -202,7 +202,7 @@ The following configuration defines the specifications for the GCP virtual machi ### Export variables to Ansible -The following Terraform resource exports the [tunnel token](/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions/) and other variables to `tf_ansible_vars_file.yml`. Ansible will use the tunnel token to configure and run `cloudflared` on the server. +The following Terraform resource exports the [tunnel token](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/remote-tunnel-permissions/) and other variables to `tf_ansible_vars_file.yml`. Ansible will use the tunnel token to configure and run `cloudflared` on the server. 1. In your configuration directory, create a new `tf` file: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/aws.mdx similarity index 77% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/aws.mdx index 9bff936eb84c9f..997b09ed5b4378 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/aws.mdx @@ -23,7 +23,7 @@ We will deploy: To complete the following procedure, you will need to: - [Add a website to Cloudflare](/fundamentals/manage-domains/add-site/) -- [Deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) on an end-user device +- [Deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) on an end-user device ## 1. Create a VM instance in AWS @@ -96,10 +96,10 @@ EOF ## 4. Connect using a private IP -[Private network routes](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) allow users to connect to your virtual private cloud (VPC) using the WARP client. To add a private network route for your Cloudflare Tunnel: +[Private network routes](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) allow users to connect to your virtual private cloud (VPC) using the WARP client. To add a private network route for your Cloudflare Tunnel: 1. In the **CIDR** tab, enter the **Private IPv4 address** of your AWS instance (for example, `172.31.19.0`). You can expand the IP range later if necessary. -2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the private IP is routing through WARP. For example, if you are using Split Tunnels in **Exclude** mode, delete `172.16.0.0/12`. We recommend re-adding the IPs that are not explicitly used by your AWS instance. +2. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the private IP is routing through WARP. For example, if you are using Split Tunnels in **Exclude** mode, delete `172.16.0.0/12`. We recommend re-adding the IPs that are not explicitly used by your AWS instance. To determine which IP addresses to re-add, subtract your AWS instance IPs from `172.16.0.0/12`: @@ -114,7 +114,7 @@ EOF Add the results back to your Split Tunnel Exclude mode list. 3. To test on a user device: - 1. [Log in to the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/). + 1. [Log in to the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). 2. Open a terminal window and connect to the service using its private IP: ```sh @@ -124,7 +124,7 @@ EOF ``` -You can optionally [create Gateway network policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to control who can access the instance via its private IP. +You can optionally [create Gateway network policies](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to control who can access the instance via its private IP. :::caution @@ -134,7 +134,7 @@ You can optionally [create Gateway network policies](/cloudflare-one/connections ## Firewall configuration -To secure your AWS instance, you can configure your [Security Group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) to deny all inbound traffic and allow only outbound traffic to the [Cloudflare Tunnel IP addresses](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation). All Security Group rules are Allow rules; traffic that does not match a rule is blocked. Therefore, you can delete all inbound rules and leave only the relevant outbound rules. +To secure your AWS instance, you can configure your [Security Group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) to deny all inbound traffic and allow only outbound traffic to the [Cloudflare Tunnel IP addresses](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation). All Security Group rules are Allow rules; traffic that does not match a rule is blocked. Therefore, you can delete all inbound rules and leave only the relevant outbound rules. :::note diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/azure.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/azure.mdx similarity index 95% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/azure.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/azure.mdx index 3d15b8cf3ac941..53147a89be6189 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/azure.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/azure.mdx @@ -14,7 +14,7 @@ We will walk through how to initialize a service on a Linux VM in Azure, and rou ## Prerequisites - In [Zero Trust](https://one.dash.cloudflare.com/), create a Cloudflare Zero Trust account. -- [Enroll an end-user device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) into your Cloudflare Zero Trust account. +- [Enroll an end-user device](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) into your Cloudflare Zero Trust account. ## Create your environment diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/google-cloud-platform.mdx similarity index 78% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/google-cloud-platform.mdx index 4d1e6ff1663023..93da988abbc640 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/google-cloud-platform.mdx @@ -20,7 +20,7 @@ We will deploy: To complete the following procedure, you will need to: - [Add a website to Cloudflare](/fundamentals/manage-domains/add-site/) -- [Deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) on an end-user device +- [Deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) on an end-user device ## 1. Create a VM instance in GCP @@ -77,7 +77,7 @@ To complete the following procedure, you will need to: To configure a private network route for your Cloudflare Tunnel: 1. In the **CIDR** tab, enter the **Internal IP** of your GCP VM instance (for example, `10.0.0.2`). You can expand the IP range later if necessary. -2. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the internal IP is routing through WARP. For example, if you are using Split Tunnels in **Exclude** mode, delete `10.0.0.0/8`. We recommend re-adding the IPs that are not explicitly used by your GCP VM. +2. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route), make sure the internal IP is routing through WARP. For example, if you are using Split Tunnels in **Exclude** mode, delete `10.0.0.0/8`. We recommend re-adding the IPs that are not explicitly used by your GCP VM. To determine which IP addresses to re-add, subtract your GCP instance IPs from `10.0.0.0/8`: @@ -92,7 +92,7 @@ To configure a private network route for your Cloudflare Tunnel: Add the results back to your Split Tunnel Exclude mode list. 3. To test on a user device: - 1. [Log in to the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/). + 1. [Log in to the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). 2. Open a terminal window and connect to the service using its private IP: ```sh @@ -105,11 +105,11 @@ To configure a private network route for your Cloudflare Tunnel: ``` -You can optionally [create Gateway network policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to control who can access the VM via its private IP. +You can optionally [create Gateway network policies](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to control who can access the VM via its private IP. ## Firewall configuration -To secure your VM instance, you can [configure your VPC firewall rules](https://cloud.google.com/firewall/docs/using-firewalls) to deny all ingress traffic and allow only egress traffic to the [Cloudflare Tunnel IP addresses](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation). Since GCP denies ingress traffic by [default](https://cloud.google.com/firewall/docs/firewalls#default_firewall_rules), you can delete all ingress rules and leave only the relevant egress rules. +To secure your VM instance, you can [configure your VPC firewall rules](https://cloud.google.com/firewall/docs/using-firewalls) to deny all ingress traffic and allow only egress traffic to the [Cloudflare Tunnel IP addresses](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation). Since GCP denies ingress traffic by [default](https://cloud.google.com/firewall/docs/firewalls#default_firewall_rules), you can delete all ingress rules and leave only the relevant egress rules. :::note diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes.mdx similarity index 91% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes.mdx index dec673c964b463..0bc85c42fb3b66 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes.mdx @@ -7,17 +7,17 @@ sidebar: [Kubernetes](https://kubernetes.io/) is a container orchestration tool that is used to deploy applications onto physical or virtual machines, scale the deployment to meet traffic demands, and push updates without downtime. The Kubernetes cluster, or environment, where the application instances are running is connected internally through a private network. You can install the `cloudflared` daemon inside of the Kubernetes cluster in order to connect applications inside of the cluster to Cloudflare. -This guide will cover how to expose a Kubernetes service to the public Internet using a [remotely-managed](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#remotely-managed-tunnel) Cloudflare Tunnel. For the purposes of this example, we will deploy a basic web application alongside `cloudflared` in Google Kubernetes Engine (GKE). The same principles apply to any other Kubernetes environment (such as `minikube`, `kubeadm`, or a cloud-based Kubernetes service) where `cloudflared` can connect to Cloudflare's network. +This guide will cover how to expose a Kubernetes service to the public Internet using a [remotely-managed](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#remotely-managed-tunnel) Cloudflare Tunnel. For the purposes of this example, we will deploy a basic web application alongside `cloudflared` in Google Kubernetes Engine (GKE). The same principles apply to any other Kubernetes environment (such as `minikube`, `kubeadm`, or a cloud-based Kubernetes service) where `cloudflared` can connect to Cloudflare's network. :::note[Locally-managed tunnels] -If you are looking to set up a [locally-managed tunnel](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#locally-managed-tunnel) in Kubernetes, refer to the [example code in GitHub](https://github.com/cloudflare/argo-tunnel-examples/tree/master/named-tunnel-k8s). +If you are looking to set up a [locally-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#locally-managed-tunnel) in Kubernetes, refer to the [example code in GitHub](https://github.com/cloudflare/argo-tunnel-examples/tree/master/named-tunnel-k8s). ::: ## Architecture ![Diagram showing how a user connects to Kubernetes services through Cloudflare Tunnel](~/assets/images/cloudflare-one/connections/connect-apps/kubernetes-tunnel.png) -As shown in the diagram, we recommend setting up `cloudflared` as an adjacent [deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) to the application deployments. Having a separate Kubernetes deployment for `cloudflared` allows you to scale `cloudflared` independently of the application. In the `cloudflared` deployment, you can spin up [multiple replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) running the same Cloudflare Tunnel — there is no need to build a dedicated tunnel for each `cloudflared` pod. Each `cloudflared` replica / pod can reach all Kubernetes services in the cluster. +As shown in the diagram, we recommend setting up `cloudflared` as an adjacent [deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) to the application deployments. Having a separate Kubernetes deployment for `cloudflared` allows you to scale `cloudflared` independently of the application. In the `cloudflared` deployment, you can spin up [multiple replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) running the same Cloudflare Tunnel — there is no need to build a dedicated tunnel for each `cloudflared` pod. Each `cloudflared` replica / pod can reach all Kubernetes services in the cluster. :::note We do not recommend using `cloudflared` in autoscaling setups because downscaling (removing replicas) will break existing user connections to that replica. Additionally, `cloudflared` does not load balance across replicas; replicas are strictly for high availability. To load balance traffic to your nodes, you can use [Cloudflare Load Balancer](/load-balancing/private-network/) or a third-party load balancer. @@ -291,7 +291,7 @@ To run the Cloudflare Tunnel in Kubernetes: replicaset.apps/httpbin-deployment-bc6689c5d 2 2 2 3m37s ``` -You should see two `cloudflared` pods and two `httpbin` pods with a `Running` status. If your `cloudflared` pods keep restarting, check the `command` syntax in `tunnel.yaml` and make sure that the [tunnel run parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/) are in the correct order. +You should see two `cloudflared` pods and two `httpbin` pods with a `Running` status. If your `cloudflared` pods keep restarting, check the `command` syntax in `tunnel.yaml` and make sure that the [tunnel run parameters](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/) are in the correct order. ## 6. Verify tunnel status diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/terraform.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform.mdx similarity index 99% rename from src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/terraform.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform.mdx index 7c8edbe882a37b..10e71d41aac2fe 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/terraform.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform.mdx @@ -391,7 +391,7 @@ The following configuration defines the specifications for the GCP virtual machi The following script will install `cloudflared` and run the tunnel as a service. This example also installs a lightweight HTTP application that you can use to test connectivity. :::note -If you would prefer to manually install the tunnel, refer to [Install and run the tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api/#4-install-and-run-the-tunnel). +If you would prefer to manually install the tunnel, refer to [Install and run the tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/#4-install-and-run-the-tunnel). ::: 1. In your configuration directory, create a Terraform template file: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/linux.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/linux.mdx similarity index 66% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/linux.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/linux.mdx index efa511a00897f1..941f0ac01bd2a6 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/linux.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/linux.mdx @@ -12,11 +12,11 @@ You can install `cloudflared` as a system service on Linux. ## Prerequisites -Before you install Cloudflare Tunnel as a service on Linux, follow Steps 1 through 4 of the [Tunnel CLI setup guide](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/). At this point you should have a named tunnel and a `config.yml` file in your `.cloudflared` directory. +Before you install Cloudflare Tunnel as a service on Linux, follow Steps 1 through 4 of the [Tunnel CLI setup guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/). At this point you should have a named tunnel and a `config.yml` file in your `.cloudflared` directory. ## 1. Configure `cloudflared` as a service -By default, Cloudflare Tunnel expects all of the configuration to exist in the `$HOME/.cloudflared/config.yml` [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/). At a minimum you must specify the following arguments to run as a service: +By default, Cloudflare Tunnel expects all of the configuration to exist in the `$HOME/.cloudflared/config.yml` [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). At a minimum you must specify the following arguments to run as a service: | Argument | Description | | ------------------ | ---------------------------------------------------- | @@ -45,7 +45,7 @@ By default, Cloudflare Tunnel expects all of the configuration to exist in the ` ## Next steps -You can now [route traffic through your tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/#5-start-routing-traffic). If you add IP routes or otherwise change the configuration, restart the service to load the new configuration: +You can now [route traffic through your tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#5-start-routing-traffic). If you add IP routes or otherwise change the configuration, restart the service to load the new configuration: ```sh systemctl restart cloudflared diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/macos.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/macos.mdx similarity index 74% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/macos.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/macos.mdx index 3073fb92344c4e..7e11c84c1c5be3 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/macos.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/macos.mdx @@ -12,11 +12,11 @@ You can install `cloudflared` as a system service on macOS. ## Prerequisites -Before you install Cloudflare Tunnel as a service on your OS, follow Steps 1 through 4 of the [Tunnel CLI setup guide](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/). At this point you should have a named tunnel and a `config.yml` file in your `$HOME/.cloudflared` directory. +Before you install Cloudflare Tunnel as a service on your OS, follow Steps 1 through 4 of the [Tunnel CLI setup guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/). At this point you should have a named tunnel and a `config.yml` file in your `$HOME/.cloudflared` directory. ## 1. Configure `cloudflared` as a service -By default, Cloudflare Tunnel expects all of the configuration to exist in the `$HOME/.cloudflared/config.yml` [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/). At a minimum you must specify the following arguments to run as a service: +By default, Cloudflare Tunnel expects all of the configuration to exist in the `$HOME/.cloudflared/config.yml` [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). At a minimum you must specify the following arguments to run as a service: | Argument | Description | | ------------------ | ---------------------------------------------------- | @@ -59,7 +59,7 @@ The output will be logged to `/Library/Logs/com.cloudflare.cloudflared.err.log` ## Next steps -You can now [route traffic through your tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/#5-start-routing-traffic). If you add IP routes or otherwise change the configuration, restart the service to load the new configuration: +You can now [route traffic through your tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#5-start-routing-traffic). If you add IP routes or otherwise change the configuration, restart the service to load the new configuration: ```sh sudo launchctl stop com.cloudflare.cloudflared diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/windows.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows.mdx similarity index 80% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/windows.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows.mdx index f26ee642961376..e77e0cecced062 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/windows.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows.mdx @@ -13,7 +13,7 @@ You can install `cloudflared` as a system service on Windows. ## Configure `cloudflared` as a service -By default, Cloudflare Tunnel expects all of the configuration to exist in the `%USERPROFILE%\.cloudflared\config.yml` [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/). At a minimum you must specify the following arguments to run as a service: +By default, Cloudflare Tunnel expects all of the configuration to exist in the `%USERPROFILE%\.cloudflared\config.yml` [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). At a minimum you must specify the following arguments to run as a service: | Argument | Description | | ------------------ | ---------------------------------------------------- | @@ -22,7 +22,7 @@ By default, Cloudflare Tunnel expects all of the configuration to exist in the ` ## Run `cloudflared` as a service -1. [Download](/cloudflare-one/connections/connect-networks/downloads/) the latest `cloudflared` version. +1. [Download](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) the latest `cloudflared` version. 2. Create a new directory: @@ -64,9 +64,9 @@ By default, Cloudflare Tunnel expects all of the configuration to exist in the ` cloudflared.exe tunnel create ``` - This will generate a [credentials file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#credentials-file) in `.json` format. + This will generate a [credentials file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#credentials-file) in `.json` format. -10. [Create a configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/#4-create-a-configuration-file) with the following content: +10. [Create a configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#4-create-a-configuration-file) with the following content: ```txt tunnel: @@ -125,7 +125,7 @@ By default, Cloudflare Tunnel expects all of the configuration to exist in the ` ## Next steps -You can now [route traffic through your tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/#5-start-routing-traffic). If you add IP routes or otherwise change the configuration, restart the service to load the new configuration: +You can now [route traffic through your tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#5-start-routing-traffic). If you add IP routes or otherwise change the configuration, restart the service to load the new configuration: ```bash sc stop cloudflared diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx similarity index 85% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx index 890c1eb7be6385..d2e89a7bc43fd8 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx @@ -7,19 +7,19 @@ sidebar: :::note -[Quick tunnels](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#quick-tunnels) do not need a configuration file. +[Quick tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#quick-tunnels) do not need a configuration file. ::: -Locally-managed tunnels run as an instance of `cloudflared` on your machine. You can configure `cloudflared` properties by modifying [command line parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/) or by editing the tunnel [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/#4-create-a-configuration-file). +Locally-managed tunnels run as an instance of `cloudflared` on your machine. You can configure `cloudflared` properties by modifying [command line parameters](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/) or by editing the tunnel [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#4-create-a-configuration-file). -The CLI provides a quick way to handle configurations if you are connecting a single service through `cloudflared`. The tunnel configuration file is useful if you are connecting multiple services and need to configure properties or exceptions for specific origins. In the configuration file, you can define top-level properties for your `cloudflared` instance as well as [origin-specific properties](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters/). For a full list of configuration options, type `cloudflared tunnel help` in your terminal. +The CLI provides a quick way to handle configurations if you are connecting a single service through `cloudflared`. The tunnel configuration file is useful if you are connecting multiple services and need to configure properties or exceptions for specific origins. In the configuration file, you can define top-level properties for your `cloudflared` instance as well as [origin-specific properties](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters/). For a full list of configuration options, type `cloudflared tunnel help` in your terminal. In the absence of a configuration file, `cloudflared` will proxy outbound traffic through port `8080`. ## File structure for private networks -If you are [exposing a private network](/cloudflare-one/connections/connect-networks/private-net/) to end users running WARP, you need to add the `warp-routing` key and set it to `true`: +If you are [exposing a private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) to end users running WARP, you need to add the `warp-routing` key and set it to `true`: ```yml tunnel: @@ -81,7 +81,7 @@ You can also enter regular expressions for the `path` key. For example, if `host ### Services -In addition to HTTP, `cloudflared` supports protocols like SSH, RDP, arbitrary TCP services, and Unix sockets. You can also route traffic to the built-in `hello_world` test server or respond to traffic with an HTTP status. For a full list of supported service types, refer to [Protocols for published applications](/cloudflare-one/connections/connect-networks/routing-to-tunnel/protocols/). +In addition to HTTP, `cloudflared` supports protocols like SSH, RDP, arbitrary TCP services, and Unix sockets. You can also route traffic to the built-in `hello_world` test server or respond to traffic with an HTTP status. For a full list of supported service types, refer to [Protocols for published applications](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols/). ```yml tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef @@ -103,7 +103,7 @@ ingress: ### Origin configuration -If you need to proxy traffic to multiple origins within one instance of `cloudflared`, you can define the way `cloudflared` sends requests to each service by specifying [configuration options](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters/) as part of your ingress rules. +If you need to proxy traffic to multiple origins within one instance of `cloudflared`, you can define the way `cloudflared` sends requests to each service by specifying [configuration options](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters/) as part of your ingress rules. In the following example, the top-level configuration `connectTimeout: 30s` sets a 30-second connection timeout for all services within that instance of `cloudflared`. The ingress rule for `service: localhost:8002` then configures an exception to the top-level configuration by setting `connectTimeout` for that service at `10s`. The 30-second connection timeout still applies to all other services. @@ -157,7 +157,7 @@ Matched rule #3 ## Update a configuration file -When making changes to the configuration file for a given tunnel, we suggest relying on [`cloudflared` replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) to propagate the new configuration with minimal downtime. +When making changes to the configuration file for a given tunnel, we suggest relying on [`cloudflared` replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) to propagate the new configuration with minimal downtime. 1. Have a `cloudflared` instance running with the original version of the configuration file. 2. Start a `cloudflared` replica running with the updated version of the configuration file. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel.mdx similarity index 71% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel.mdx index fdab4654c0bc4d..3fc17b63f6acef 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel.mdx @@ -20,7 +20,7 @@ Before you start, make sure you: -1. Download `cloudflared` on your machine. Visit the [downloads](/cloudflare-one/connections/connect-networks/downloads/) page to find the right package for your OS. +1. Download `cloudflared` on your machine. Visit the [downloads](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) page to find the right package for your OS. 2. Rename the executable to `cloudflared.exe` @@ -38,7 +38,7 @@ To download and install `cloudflared`: brew install cloudflared ``` -Alternatively, you can [download the latest Darwin amd64 release](/cloudflare-one/connections/connect-networks/downloads/) directly. +Alternatively, you can [download the latest Darwin amd64 release](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) directly. @@ -75,7 +75,7 @@ pacman -Syu cloudflared **Other** -Alternatively you can download the `cloudflared` binary or the linux packages to your machine and install manually. Visit the [downloads](/cloudflare-one/connections/connect-networks/downloads/) page to find the right package for your OS. +Alternatively you can download the `cloudflared` binary or the linux packages to your machine and install manually. Visit the [downloads](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) page to find the right package for your OS. @@ -105,7 +105,7 @@ cloudflared tunnel login Running this command will: - Open a browser window and prompt you to log in to your Cloudflare account. After logging in to your account, select your hostname. -- Generate an account certificate, the [cert.pem file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#certpem), in the [default `cloudflared` directory](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#default-cloudflared-directory). +- Generate an account certificate, the [cert.pem file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#certpem), in the [default `cloudflared` directory](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#default-cloudflared-directory). ## 3. Create a tunnel and give it a name @@ -115,8 +115,8 @@ cloudflared tunnel create Running this command will: -- Create a tunnel by establishing a persistent relationship between the [name you provide](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#tunnel-name) and a [UUID](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#tunnel-uuid) for your tunnel. At this point, no connection is active within the tunnel yet. -- Generate a [tunnel credentials file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#credentials-file) in the [default `cloudflared` directory](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#certpem). +- Create a tunnel by establishing a persistent relationship between the [name you provide](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#tunnel-name) and a [UUID](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#tunnel-uuid) for your tunnel. At this point, no connection is active within the tunnel yet. +- Generate a [tunnel credentials file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#credentials-file) in the [default `cloudflared` directory](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#certpem). - Create a subdomain of `.cfargotunnel.com`. From the output of the command, take note of the tunnel's UUID and the path to your tunnel's credentials file. @@ -129,7 +129,7 @@ cloudflared tunnel list ## 4. Create a configuration file -1. In your `.cloudflared` directory, create a [`config.yml` file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/) using any text editor. This file will configure the tunnel to route traffic from a given origin to the hostname of your choice. +1. In your `.cloudflared` directory, create a [`config.yml` file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/) using any text editor. This file will configure the tunnel to route traffic from a given origin to the hostname of your choice. 2. Add the following fields to the file: @@ -159,13 +159,13 @@ warp-routing: ## 5. Start routing traffic 1. Now assign a `CNAME` record that points traffic to your tunnel subdomain: - - If you are connecting an application, route the service to a [published application](/cloudflare-one/connections/connect-networks/routing-to-tunnel/): + - If you are connecting an application, route the service to a [published application](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/): ```sh cloudflared tunnel route dns ``` - - If you are connecting a [private network](/cloudflare-one/connections/connect-networks/private-net/), route an IP address or CIDR through the tunnel: + - If you are connecting a [private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/), route an IP address or CIDR through the tunnel: ```sh cloudflared tunnel route ip add @@ -193,7 +193,7 @@ cloudflared tunnel --config /path/your-config-file.yml run :::note -Cloudflare Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS. For more information, refer to [run as a service](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/). +Cloudflare Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS. For more information, refer to [run as a service](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/). ::: @@ -205,6 +205,6 @@ Your tunnel configuration is complete! If you want to get information on the tun cloudflared tunnel info ``` -You can now [route traffic](/cloudflare-one/connections/connect-networks/routing-to-tunnel/) to your tunnel using Cloudflare DNS or [determine who can reach your tunnel](/cloudflare-one/policies/access/) with Cloudflare Access. +You can now [route traffic](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) to your tunnel using Cloudflare DNS or [determine who can reach your tunnel](/cloudflare-one/policies/access/) with Cloudflare Access. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/index.mdx similarity index 65% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/index.mdx index b261892d35e262..07490b615f393e 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/index.mdx @@ -12,7 +12,7 @@ import { DirectoryListing } from "~/components" A locally-managed tunnel is a Cloudflare Tunnel created by running `cloudflared tunnel create ` on the command line. Tunnel configuration is stored in your local [cloudflared directory](#default-cloudflared-directory). :::note -Cloudflare recommends setting up a [remotely-managed tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). Remotely-managed configurations are stored on Cloudflare, which allows you to manage the tunnel from any machine using the dashboard, API, or Terraform. +Cloudflare recommends setting up a [remotely-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). Remotely-managed configurations are stored on Cloudflare, which allows you to manage the tunnel from any machine using the dashboard, API, or Terraform. ::: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms.mdx similarity index 73% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms.mdx index a56a2acab8b39c..746c5b39e75d57 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms.mdx @@ -5,7 +5,7 @@ sidebar: order: 10 --- -This page contains terminology specific to locally-managed Cloudflare Tunnels. For general Tunnel terminology, refer to the [Get started section](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/). +This page contains terminology specific to locally-managed Cloudflare Tunnels. For general Tunnel terminology, refer to the [Get started section](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/). ## Default `cloudflared` directory @@ -18,18 +18,18 @@ This page contains terminology specific to locally-managed Cloudflare Tunnels. F ## Configuration file -This is a YAML file that functions as the operating manual for `cloudflared`. `cloudflared` will automatically look for the configuration file in the [default `cloudflared` directory](#default-cloudflared-directory), but you can store your configuration file in any directory. It is recommended to always specify the file path for your configuration file whenever you reference it. By creating a configuration file, you can have fine-grained control over how their instance of `cloudflared` will operate. This includes operations like what you want `cloudflared` to do with traffic (for example, proxy websockets to port `xxxx` or SSH to port `yyyy`), where `cloudflared` should search for authorization (credentials file, tunnel token), and what mode it should run in (for example, [`warp-routing`](/cloudflare-one/connections/connect-networks/private-net/)). In the absence of a configuration file, cloudflared will proxy outbound traffic through port `8080`. For more information on how to create, store, and structure a configuration file, refer to the [dedicated instructions](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/). +This is a YAML file that functions as the operating manual for `cloudflared`. `cloudflared` will automatically look for the configuration file in the [default `cloudflared` directory](#default-cloudflared-directory), but you can store your configuration file in any directory. It is recommended to always specify the file path for your configuration file whenever you reference it. By creating a configuration file, you can have fine-grained control over how their instance of `cloudflared` will operate. This includes operations like what you want `cloudflared` to do with traffic (for example, proxy websockets to port `xxxx` or SSH to port `yyyy`), where `cloudflared` should search for authorization (credentials file, tunnel token), and what mode it should run in (for example, [`warp-routing`](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/)). In the absence of a configuration file, cloudflared will proxy outbound traffic through port `8080`. For more information on how to create, store, and structure a configuration file, refer to the [dedicated instructions](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). ## Cert.pem -This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file uses a certificate to authenticate your instance of `cloudflared` and it is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. Refer to the [Tunnel permissions page](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions/) for more details on when this file is needed. +This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file uses a certificate to authenticate your instance of `cloudflared` and it is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. Refer to the [Tunnel permissions page](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-permissions/) for more details on when this file is needed. The `cert.pem` origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked. ## Credentials file -This file is created when you run `cloudflared tunnel create `. It stores your tunnel's credentials in JSON format, and is unique to each tunnel. This file functions as a token authenticating the tunnel it is associated with. Refer to the [Tunnel permissions page](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions/) for more details on when this file is needed. +This file is created when you run `cloudflared tunnel create `. It stores your tunnel's credentials in JSON format, and is unique to each tunnel. This file functions as a token authenticating the tunnel it is associated with. Refer to the [Tunnel permissions page](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-permissions/) for more details on when this file is needed. ## Ingress rule -Ingress rules let you specify which local services traffic should be proxied to. If a rule does not specify a path, all paths will be matched. Ingress rules can be listed in your [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/) or when running `cloudflared tunnel ingress`. +Ingress rules let you specify which local services traffic should be proxied to. If a rule does not specify a path, all paths will be matched. Ingress rules can be listed in your [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/) or when running `cloudflared tunnel ingress`. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-permissions.mdx similarity index 94% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-permissions.mdx index f5e781dcf03a09..5ed2d85bf212f1 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-permissions.mdx @@ -20,7 +20,7 @@ Refer to the table below for a comparison between the two files and the purposes | **Purpose** | Authenticates your instance of `cloudflared` against your Cloudflare account | Authenticates the tunnel it is associated with | | **Scope** | Account-wide | Tunnel-specific | | **File type** | `.pem` | `.json` | -| **Stored in** | [Default directory](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#default-cloudflared-directory) | [Default directory](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#default-cloudflared-directory) | +| **Stored in** | [Default directory](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#default-cloudflared-directory) | [Default directory](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#default-cloudflared-directory) | | **Issued when running** | `cloudflared tunnel login` | `cloudflared tunnel create ` | | **Valid for** | At least 10 years, and the service token it contains is valid until revoked | Does not expire | | **Needed to** | Manage tunnels (for example, create, route, delete and list tunnels) | Run a tunnel. Create a config file. | diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx similarity index 90% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx index e8d0cbb0b3970a..d8ad31350ef3aa 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx @@ -17,8 +17,8 @@ To view all CLI commands, refer to the CLI help text in your terminal. For examp | `cloudflared tunnel list` | Displays all active tunnels, their creation time, and associated connections. Use the `-d` flag to include deleted tunnels. | | `cloudflared tunnel create ` | Creates a tunnel, registers it with the Cloudflare edge and generates a credential file to run this tunnel. | | `cloudflared tunnel route` | Routes traffic through a tunnel. | -| `cloudflared tunnel route lb ` | Adds a tunnel as an endpoint in a [load balancer pool](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/). A new load balancer and pool will be created if necessary.
  • ``: the public-facing hostname of the load balancer, for example `lb.example.com`
  • ``: the name of the [pool](/load-balancing/pools/create-pool/#create-a-pool) that will contain the tunnel endpoint
To load balance traffic to a [published application](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/#file-structure-for-published-applications), you will also need to specify the application hostname in the [endpoint host header](/load-balancing/additional-options/override-http-host-headers/) using the dashboard or API. | -| `cloudflared tunnel route ip add ` | Adds any network route space (represented as a CIDR) to your routing table. That network space becomes reachable for requests egressing from a user's machine as long as it is using Cloudflare WARP and is enrolled in the same account that is running the tunnel chosen here. Further, those requests will be proxied to the specified tunnel, and reach an IP in the given CIDR, as long as that IP is reachable from the tunnel. To assign the IP route to a specific [Virtual Network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/), use the `--vnet` option. | +| `cloudflared tunnel route lb ` | Adds a tunnel as an endpoint in a [load balancer pool](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/). A new load balancer and pool will be created if necessary.
  • ``: the public-facing hostname of the load balancer, for example `lb.example.com`
  • ``: the name of the [pool](/load-balancing/pools/create-pool/#create-a-pool) that will contain the tunnel endpoint
To load balance traffic to a [published application](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/#file-structure-for-published-applications), you will also need to specify the application hostname in the [endpoint host header](/load-balancing/additional-options/override-http-host-headers/) using the dashboard or API. | +| `cloudflared tunnel route ip add ` | Adds any network route space (represented as a CIDR) to your routing table. That network space becomes reachable for requests egressing from a user's machine as long as it is using Cloudflare WARP and is enrolled in the same account that is running the tunnel chosen here. Further, those requests will be proxied to the specified tunnel, and reach an IP in the given CIDR, as long as that IP is reachable from the tunnel. To assign the IP route to a specific [Virtual Network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/), use the `--vnet` option. | | `cloudflared tunnel route ip show` (or `list`) | Shows your organization's private routing table. You can use additional flags to filter the results. | | `cloudflared tunnel route ip delete` | Deletes the row for a given CIDR from your routing table. That portion of your network will no longer be reachable by the WARP client. | | `cloudflared tunnel route ip get ` | Checks which row of the routing table will be used to proxy a given IP. This helps check and validate your configuration. | @@ -26,17 +26,17 @@ To view all CLI commands, refer to the CLI help text in your terminal. For examp | `cloudflared tunnel --config path/config.yaml run ` | Runs a tunnel, creating highly available connections between your server and the Cloudflare edge. You can provide name or UUID of the tunnel to run either as the last command line argument or in the configuration file using `tunnel: `. | | `cloudflared tunnel info ` | Displays details about the active connectors for a given tunnel identified by name of UUID. | | `cloudflared tunnel cleanup ` | Deletes connections for tunnels with the given UUIDs or names. This is useful if you get an error trying to delete or run a tunnel after `cloudflared` is not shut down gracefully (for example, if a `kill` command is issued). | -| `cloudflared tunnel cleanup --connector-id ` | Disconnects and deletes a [cloudflared replica](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) with the given connector ID. You can view all replicas for a tunnel by running `cloudflared tunnel info `. | +| `cloudflared tunnel cleanup --connector-id ` | Disconnects and deletes a [cloudflared replica](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) with the given connector ID. You can view all replicas for a tunnel by running `cloudflared tunnel info `. | | `cloudflared tunnel delete ` | Deletes tunnels with the given name or UUID. A tunnel cannot be deleted if it has active connections. To delete the tunnel unconditionally, use the `-f` flag. | | `cloudflared tunnel vnet add ` | Creates a Virtual Network to which IP routes can be assigned. To make this Virtual Network the default for your Zero Trust organization, use the `-d` flag. | | `cloudflared tunnel vnet delete ` | Deletes the Virtual Network with the given name or UUID. Before you can delete a Virtual Network, you must first delete all IP routes assigned to the Virtual Network. | | `cloudflared tunnel vnet list` | Displays all active Virtual Networks, the default Virtual Network, and their creation times. | -| `cloudflared tail ` | Start a session to livestream logs from a specific tunnel. For more information, refer to [Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/). | +| `cloudflared tail ` | Start a session to livestream logs from a specific tunnel. For more information, refer to [Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/). | ## Manage `cloudflared` | Command | Description | | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `cloudflared update` | Looks for a new version on the official download server. If a new version exists, it updates the agent binary and quits. Otherwise, no action is performed. This command only works if `cloudflared` was installed from GitHub binaries or from source. For more information, refer to the [update instructions](/cloudflare-one/connections/connect-networks/downloads/update-cloudflared/). | +| `cloudflared update` | Looks for a new version on the official download server. If a new version exists, it updates the agent binary and quits. Otherwise, no action is performed. This command only works if `cloudflared` was installed from GitHub binaries or from source. For more information, refer to the [update instructions](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/). | | `cloudflared version` | Prints the `cloudflared` version number and build date. | | `cloudflared help` | Shows a list of all top-level commands for `cloudflared`. | diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare.mdx similarity index 87% rename from src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare.mdx index d8cbe6fbcd0ca6..e5dda0a69985d5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare.mdx @@ -9,7 +9,7 @@ Developers can use the TryCloudflare tool to experiment with Cloudflare Tunnel w ## Use TryCloudflare -1. Follow [these instructions](/cloudflare-one/connections/connect-networks/downloads/) to install `cloudflared`. If you have an older copy, update to 2020.5.1 or later. +1. Follow [these instructions](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) to install `cloudflared`. If you have an older copy, update to 2020.5.1 or later. 2. Launch a web server that is available over localhost to `cloudflared`. 3. Run the following terminal command to start a free tunnel. @@ -43,8 +43,8 @@ TryCloudflare quick tunnels are currently not supported if a `config.yaml` confi - Quick Tunnels are subject to a hard limit on the number of concurrent requests that can be proxied at any point in time. Currently, this limit is 200 in-flight requests. If a Quick Tunnel hits this limit, the HTTP response will return a `429` status code. - Quick Tunnels do not support Server-Sent Events (SSE). -These limitations only apply to Quick Tunnels. To avoid these limitations, [sign up](https://dash.cloudflare.com/sign-up) for a Cloudflare account and [create a Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/get-started/). +These limitations only apply to Quick Tunnels. To avoid these limitations, [sign up](https://dash.cloudflare.com/sign-up) for a Cloudflare account and [create a Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/). ### Legal -Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept the terms of the [Cloudflare License](/cloudflare-one/connections/connect-networks/downloads/license/), [Terms](https://www.cloudflare.com/terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/). +Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept the terms of the [Cloudflare License](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/license/), [Terms](https://www.cloudflare.com/terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/downloads/copyrights.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/copyrights.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/downloads/copyrights.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/copyrights.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/downloads/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/index.mdx similarity index 95% rename from src/content/docs/cloudflare-one/connections/connect-networks/downloads/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/index.mdx index 4ae12bd4b00f6c..a292cd75725904 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/downloads/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/index.mdx @@ -5,7 +5,7 @@ sidebar: order: 2 --- -Cloudflare Tunnel requires the installation of a lightweight server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare. If you are [creating a tunnel through the dashboard](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/), you can simply copy-paste the installation command shown in the dashboard. +Cloudflare Tunnel requires the installation of a lightweight server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare. If you are [creating a tunnel through the dashboard](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/), you can simply copy-paste the installation command shown in the dashboard. To download and install `cloudflared` manually, use one of the following links. @@ -69,4 +69,4 @@ A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.c Cloudflare supports versions of `cloudflared` that are within one year of the most recent release. Breaking changes unrelated to feature availability may be introduced that will impact versions released more than one year ago. For example, as of January 2023 Cloudflare will support `cloudflared` version 2023.1.1 to cloudflared 2022.1.1. -To update `cloudflared`, refer to [these instructions](/cloudflare-one/connections/connect-networks/downloads/update-cloudflared/). +To update `cloudflared`, refer to [these instructions](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/downloads/license.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/license.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/downloads/license.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/license.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/downloads/update-cloudflared.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared.mdx similarity index 73% rename from src/content/docs/cloudflare-one/connections/connect-networks/downloads/update-cloudflared.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared.mdx index d1866b45100ffa..b086e0e7332a2a 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/downloads/update-cloudflared.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared.mdx @@ -7,11 +7,11 @@ sidebar: import { TabItem, Tabs, Render } from "~/components"; -Updates will cause `cloudflared` to restart which will impact traffic currently being served. You can perform zero-downtime upgrades by using Cloudflare's [Load Balancer product](/cloudflare-one/connections/connect-networks/downloads/update-cloudflared/#update-with-cloudflare-load-balancer) or by using [multiple `cloudflared` instances](/cloudflare-one/connections/connect-networks/downloads/update-cloudflared/#update-with-multiple-cloudflared-instances). +Updates will cause `cloudflared` to restart which will impact traffic currently being served. You can perform zero-downtime upgrades by using Cloudflare's [Load Balancer product](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/#update-with-cloudflare-load-balancer) or by using [multiple `cloudflared` instances](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/#update-with-multiple-cloudflared-instances). ## Update the `cloudflared` service -Refer to the following commands to update `cloudflared` for a [remotely-managed tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) created through the dashboard or a [locally-managed tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/). Locally-managed tunnels must be set up to [run as a service](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/) for the following commands to execute successfully. +Refer to the following commands to update `cloudflared` for a [remotely-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) created through the dashboard or a [locally-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/). Locally-managed tunnels must be set up to [run as a service](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/) for the following commands to execute successfully. @@ -92,7 +92,7 @@ sudo systemctl restart cloudflared.service -**If you created a remotely-managed tunnel using the [dashboard](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/):** +**If you created a remotely-managed tunnel using the [dashboard](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/):** 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels**. 2. Select your tunnel and select **Configure**. @@ -107,15 +107,15 @@ Cloudflare recommends creating remotely-managed tunnels when working with Docker ::: -**If you created a remotely or locally-managed tunnel using the [API](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api/), run the following command:** +**If you created a remotely or locally-managed tunnel using the [API](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/), run the following command:** ```sh docker run --pull always cloudflare/cloudflared:latest tunnel --no-autoupdate run --token ``` -**If you created a locally-managed tunnel using the [CLI](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/#2-authenticate-cloudflared):** +**If you created a locally-managed tunnel using the [CLI](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#2-authenticate-cloudflared):** -1. Mount your local `.cloudflared` [directory](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#default-cloudflared-directory) into the Docker container using a volume. +1. Mount your local `.cloudflared` [directory](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#default-cloudflared-directory) into the Docker container using a volume. 2. Run the following command to update `cloudflared`: @@ -139,9 +139,9 @@ If you installed `cloudflared` with a package manager, you must update it using You can update `cloudflared` without downtime by using Cloudflare's Load Balancer product with your Cloudflare Tunnel deployment. -1. Install a new instance of `cloudflared` and [create](/cloudflare-one/connections/connect-networks/get-started/) a new Tunnel. +1. Install a new instance of `cloudflared` and [create](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/) a new Tunnel. 2. Configure the instance to point traffic to the same locally-available service as your current, active instance of `cloudflared`. -3. [Add the address](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/) of the new instance of `cloudflared` into your Load Balancer pool as priority 2. +3. [Add the address](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/) of the new instance of `cloudflared` into your Load Balancer pool as priority 2. 4. Swap the priority such that the new instance is now priority 1 and monitor to confirm traffic is being served. 5. Once confirmed, you can remove the older version from the Load Balancer pool. @@ -149,9 +149,9 @@ You can update `cloudflared` without downtime by using Cloudflare's Load Balance If you are not using Cloudflare's Load Balancer, you can use multiple instances of `cloudflared` to update without the risk of downtime. -1. Install a new instance of `cloudflared` and [create](/cloudflare-one/connections/connect-networks/get-started/) a new Tunnel. +1. Install a new instance of `cloudflared` and [create](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/) a new Tunnel. 2. Configure the instance to point traffic to the same locally-available service as your current, active instance of `cloudflared`. -3. In the Cloudflare DNS dashboard, [replace](/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns/) the address of the current instance of `cloudflared` with the address of the new instance. Save the record. +3. In the Cloudflare DNS dashboard, [replace](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/) the address of the current instance of `cloudflared` with the address of the new instance. Save the record. 4. Remove the now-inactive instance of `cloudflared`. :::note[Traffic handling] diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api.mdx similarity index 97% rename from src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api.mdx index 1ad2f317e0cec5..1ba73409383769 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api.mdx @@ -73,7 +73,7 @@ Before you publish an application through your tunnel, you must: Follow these steps to publish an application to the Internet. If you are looking to connect a private resource, skip to the [Connect a network](#3b-connect-a-network) section. -1. Make a [`PUT` request](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/configurations/methods/update/) to route your [local service URL](/cloudflare-one/connections/connect-networks/routing-to-tunnel/protocols/) to a public hostname. For example, +1. Make a [`PUT` request](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/configurations/methods/update/) to route your [local service URL](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols/) to a public hostname. For example, -`cloudflared` can now route traffic to these destination IPs. To configure Zero Trust policies and connect as a user, refer to [Connect private networks](/cloudflare-one/connections/connect-networks/private-net/cloudflared/). +`cloudflared` can now route traffic to these destination IPs. To configure Zero Trust policies and connect as a user, refer to [Connect private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/). ## 4. Install and run the tunnel diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel.mdx similarity index 84% rename from src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel.mdx index d2f1ae8515e452..9c96b7352a0403 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel.mdx @@ -7,7 +7,7 @@ sidebar: import { Render } from "~/components"; -Follow this step-by-step guide to create your first [remotely-managed tunnel](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#remotely-managed-tunnel) using Zero Trust. +Follow this step-by-step guide to create your first [remotely-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#remotely-managed-tunnel) using Zero Trust. ## 1. Create a tunnel @@ -35,9 +35,9 @@ To connect a private network through your tunnel: 1. Go to the **CIDR** tab. 2. In **CIDR**, enter the private IP address or CIDR range of your service (for example, `10.0.0.1` or `10.0.0.0/8`). -`cloudflared` can now route traffic to these destination IPs. To configure Zero Trust policies and connect as a user, refer to [Connect an IP/CIDR](/cloudflare-one/connections/connect-networks/private-net/cloudflared/). +`cloudflared` can now route traffic to these destination IPs. To configure Zero Trust policies and connect as a user, refer to [Connect an IP/CIDR](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/). -If you would like to route to a private application using its hostname instead of its IP, refer to [Connect a private hostname](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname/). +If you would like to route to a private application using its hostname instead of its IP, refer to [Connect a private hostname](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/). ## 3. View your tunnel diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/get-started/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx similarity index 79% rename from src/content/docs/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx index f3954947ce325d..c904654acd0e1c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx @@ -33,12 +33,12 @@ A remotely-managed tunnel is a [tunnel](#tunnel) that was created in [Zero Trust ## Locally-managed tunnel -A locally-managed tunnel is a [tunnel](#tunnel) that was created by running `cloudflared tunnel create ` on the command line. Tunnel configuration is stored in your local [cloudflared directory](#default-cloudflared-directory). For terminology specific to locally-managed tunnels, refer to the [Locally-managed tunnel glossary](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/). +A locally-managed tunnel is a [tunnel](#tunnel) that was created by running `cloudflared tunnel create ` on the command line. Tunnel configuration is stored in your local [cloudflared directory](#default-cloudflared-directory). For terminology specific to locally-managed tunnels, refer to the [Locally-managed tunnel glossary](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/). ## Quick tunnels -Quick tunnels, when run, will generate a URL that consists of a random subdomain of the website `trycloudflare.com`, and point traffic to localhost on port `8080`. If you have a web service running at that address, users who visit the generated subdomain will be able to visit your web service through Cloudflare's network. Refer to [TryCloudflare](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/) for more information on how to run quick tunnels. +Quick tunnels, when run, will generate a URL that consists of a random subdomain of the website `trycloudflare.com`, and point traffic to localhost on port `8080`. If you have a web service running at that address, users who visit the generated subdomain will be able to visit your web service through Cloudflare's network. Refer to [TryCloudflare](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/) for more information on how to run quick tunnels. ## Virtual networks -A [virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) is a software abstraction that allows you to logically segregate resources on your private network. Virtual networks are especially useful for exposing resources which have overlapping IP routes. To connect to a resource, end users would select a virtual network in their WARP client settings before entering the destination IP. +A [virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) is a software abstraction that allows you to logically segregate resources on your private network. Virtual networks are especially useful for exposing resources which have overlapping IP routes. To connect to a resource, end users would select a virtual network in their WARP client settings before entering the destination IP. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/index.mdx similarity index 52% rename from src/content/docs/cloudflare-one/connections/connect-networks/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/index.mdx index bc022771bd6b4d..ff905ead689e9c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/index.mdx @@ -7,7 +7,7 @@ sidebar: import { Render, Stream } from "~/components"; -Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. With Tunnel, you do not send traffic to an external IP — instead, a lightweight daemon in your infrastructure (`cloudflared`) creates [outbound-only connections](/cloudflare-one/connections/connect-networks/#outbound-only-connection) to Cloudflare's global network. Cloudflare Tunnel can connect HTTP web servers, [SSH servers](/cloudflare-one/connections/connect-networks/use-cases/ssh/), [remote desktops](/cloudflare-one/connections/connect-networks/use-cases/rdp/), and other protocols safely to Cloudflare. This way, your origins can serve traffic through Cloudflare without being vulnerable to attacks that bypass Cloudflare. +Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. With Tunnel, you do not send traffic to an external IP — instead, a lightweight daemon in your infrastructure (`cloudflared`) creates [outbound-only connections](/cloudflare-one/networks/connectors/cloudflare-tunnel/#outbound-only-connection) to Cloudflare's global network. Cloudflare Tunnel can connect HTTP web servers, [SSH servers](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/), [remote desktops](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/), and other protocols safely to Cloudflare. This way, your origins can serve traffic through Cloudflare without being vulnerable to attacks that bypass Cloudflare. Refer to our [reference architecture](/reference-architecture/architectures/sase/) for details on how to implement Cloudflare Tunnel into your existing infrastructure. @@ -19,7 +19,7 @@ Refer to our [reference architecture](/reference-architecture/architectures/sase ## How it works -Cloudflared establishes [outbound connections](/cloudflare-one/connections/connect-networks/#outbound-only-connection) (tunnels) between your resources and Cloudflare's global network. Tunnels are persistent objects that route traffic to DNS records. Within the same tunnel, you can run as many 'cloudflared' processes (connectors) as needed. These processes will establish connections to Cloudflare and send traffic to the nearest Cloudflare data center. +Cloudflared establishes [outbound connections](/cloudflare-one/networks/connectors/cloudflare-tunnel/#outbound-only-connection) (tunnels) between your resources and Cloudflare's global network. Tunnels are persistent objects that route traffic to DNS records. Within the same tunnel, you can run as many 'cloudflared' processes (connectors) as needed. These processes will establish connections to Cloudflare and send traffic to the nearest Cloudflare data center. ![How an HTTP request reaches a private application connected with Cloudflare Tunnel](~/assets/images/cloudflare-one/connections/connect-apps/handshake.jpg) @@ -31,7 +31,7 @@ Once the connection is established, traffic flows in both directions over the tu ## Next steps -- Create a tunnel using the [Cloudflare dashboard](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) or [API](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api/). -- Learn more about [`cloudflared`](/cloudflare-one/connections/connect-networks/downloads/), the server-side daemon that connects your infrastructure to Cloudflare. -- Review useful [Tunnel terms](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/) to familiarize yourself with the concepts used in Tunnel documentation. -- [Troubleshoot](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/) your Tunnel by reviewing available logs and common errors. +- Create a tunnel using the [Cloudflare dashboard](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) or [API](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/). +- Learn more about [`cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/), the server-side daemon that connects your infrastructure to Cloudflare. +- Review useful [Tunnel terms](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/) to familiarize yourself with the concepts used in Tunnel documentation. +- [Troubleshoot](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/) your Tunnel by reviewing available logs and common errors. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/logs.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs.mdx similarity index 80% rename from src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/logs.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs.mdx index 84b9c1ca42e729..2a19fc410e8c2d 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/logs.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs.mdx @@ -12,7 +12,7 @@ Tunnel logs record all activity between a `cloudflared` instance and Cloudflare' ## View logs on the server -If you have access to the origin server, you can use the [`--loglevel` flag](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#loglevel) to enable logging when you start the tunnel. By default, `cloudflared` prints logs to stdout and does not store logs on the server. You can optionally use the [`--logfile` flag](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#logfile) to write your logs to a file. +If you have access to the origin server, you can use the [`--loglevel` flag](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#loglevel) to enable logging when you start the tunnel. By default, `cloudflared` prints logs to stdout and does not store logs on the server. You can optionally use the [`--logfile` flag](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#logfile) to write your logs to a file. To enable logs for a locally-managed tunnel: @@ -20,7 +20,7 @@ To enable logs for a locally-managed tunnel: cloudflared tunnel --loglevel debug --logfile cloudflared.log run ``` -To enable logs for a remotely-managed tunnel, add `--loglevel debug` and `--logfile ` to your system service as shown in [Add tunnel run parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/#update-tunnel-run-parameters). +To enable logs for a remotely-managed tunnel, add `--loglevel debug` and `--logfile ` to your system service as shown in [Add tunnel run parameters](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/#update-tunnel-run-parameters). ## View logs on your local machine @@ -69,13 +69,13 @@ cloudflared tail --level debug | Flag | Description | Allowed values | Default value | | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------- | | `--event` | Filter by the type of event / request. | `cloudflared`, `http`, `tcp`, `udp` | All events | -| `--level` | Return logs at this level and above. Works independently of the [`--loglevel`](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#loglevel) setting on the server. | `debug`, `info`, `warn`, `error`, `fatal` | `debug` | +| `--level` | Return logs at this level and above. Works independently of the [`--loglevel`](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#loglevel) setting on the server. | `debug`, `info`, `warn`, `error`, `fatal` | `debug` | | `--sampling` | Sample a fraction of the total logs. | Number from `0.0` to `1.0` | `1.0` | | | | | | #### View logs for a replica -If you are running multiple `cloudflared` instances for the same tunnel (also known as [replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/)), you must specify an individual instance to stream logs from: +If you are running multiple `cloudflared` instances for the same tunnel (also known as [replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/)), you must specify an individual instance to stream logs from: 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels** and select your tunnel. 2. Find the **Connector ID** for the `cloudflared` instance you want to view. @@ -87,4 +87,4 @@ If you are running multiple `cloudflared` instances for the same tunnel (also kn ### Performance considerations - The logging session will only be held open for one hour. All logging systems introduce some level of performance overhead, and this limit helps prevent longterm impact to your tunnel's end-to-end latencies. -- When streaming logs for a high throughput tunnel, Cloudflare intentionally prioritizes service stability over log delivery. To reduce the number of dropped logs, try [requesting fewer logs](#filter-logs). To ensure that you are seeing all logs, [view logs on the server](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/#view-logs-on-the-server) instead of streaming the logs remotely. +- When streaming logs for a high throughput tunnel, Cloudflare intentionally prioritizes service stability over log delivery. To reduce the number of dropped logs, try [requesting fewer logs](#filter-logs). To ensure that you are seeing all logs, [view logs on the server](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/#view-logs-on-the-server) instead of streaming the logs remotely. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics.mdx similarity index 95% rename from src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics.mdx index 7f373009656222..9cd270e5729e85 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics.mdx @@ -14,7 +14,7 @@ Tunnel metrics show a Cloudflare Tunnel's throughput and resource usage over tim In non-containerized environments, `cloudflared` starts the metrics server on `127.0.0.1:/metrics`, where `` is the first available port in the range `20241` to `20245`. In case of all ports being unavailable then the fallback is to bind to a random port. In containerized environments such as Docker and Kubernetes, the default address is `0.0.0.0:/metrics`. -To determine the default port being used by a `cloudflared` instance, you can check your [Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/) around the time when the tunnel started. For example: +To determine the default port being used by a `cloudflared` instance, you can check your [Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) around the time when the tunnel started. For example: ```text 2024-12-19T21:17:58Z INF Starting metrics server on 127.0.0.1:20241/metrics @@ -24,13 +24,13 @@ To determine the default port being used by a `cloudflared` instance, you can ch To serve metrics on a custom IP address and port, perform these steps on the `cloudflared` host: -1. Run the tunnel using the [--metrics](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#metrics) flag. Here is an example command for a locally-managed tunnel: +1. Run the tunnel using the [--metrics](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#metrics) flag. Here is an example command for a locally-managed tunnel: ```sh cloudflared tunnel --metrics 127.0.0.1:60123 run my-tunnel ``` - To learn how to add the `--metrics` flag to a remotely-managed tunnel, refer to [Configure a remotely-managed tunnel](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/#update-tunnel-run-parameters). + To learn how to add the `--metrics` flag to a remotely-managed tunnel, refer to [Configure a remotely-managed tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/#update-tunnel-run-parameters). :::note If you plan to fetch metrics from another machine on the local network, replace `127.0.0.1` with the internal IP of the `cloudflared` server (for example, `198.168.x.x`). To serve metrics on all available network interfaces, use `0.0.0.0`. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/notifications.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/notifications.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/monitor-tunnels/notifications.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/notifications.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr.mdx similarity index 88% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr.mdx index 216613e3b350ee..d446c7919219d5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr.mdx @@ -17,7 +17,7 @@ To connect your infrastructure with Cloudflare Tunnel: 3. In the **CIDR** tab for the tunnel, enter the IP/CIDR range that you wish to route through the tunnel (for example, `10.0.0.1` or `10.0.0.0/8`). -4. (Optional) Under **Additional settings**, select a [virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) for this tunnel route. This step is only needed if the route's IP/CIDR range overlaps with another route in your account. If you do not select a virtual network, the IP route will be assigned to the `default` network. +4. (Optional) Under **Additional settings**, select a [virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) for this tunnel route. This step is only needed if the route's IP/CIDR range overlaps with another route in your account. If you do not select a virtual network, the IP route will be assigned to the `default` network. :::note To create a new virtual network, select **Manage virtual networks**. @@ -51,7 +51,7 @@ For more information on building Gateway policies, refer to [Secure your first a End users can now reach HTTP or TCP-based services on your network by visiting any IP address in the range you have specified. -To allow users to reach the service using its private hostname instead of its IP, refer to [Private DNS](/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns/). +To allow users to reach the service using its private hostname instead of its IP, refer to [Private DNS](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/). ### Troubleshooting diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname.mdx similarity index 80% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname.mdx index 12fef290b80c63..08fb645aea052c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname.mdx @@ -59,9 +59,9 @@ Private hostname routing only works for applications connected with `cloudflared | Connector | Compatibility | Minimum version | | ------------------------------------------------------------------------------------------ | ------------- | -- | -| [cloudflared](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) | ✅ | 2025.7.0 | -| [WARP-to-WARP](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/) | ❌ | | -| [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) | ❌ | | +| [cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) | ✅ | 2025.7.0 | +| [WARP-to-WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/) | ❌ | | +| [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) | ❌ | | | [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) | ❌ | | ## Connect a private hostname @@ -78,18 +78,18 @@ To connect to private hostnames, your devices must forward the following traffic -Configuration steps vary depending on your [device on-ramp](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname/#device-connectivity): +Configuration steps vary depending on your [device on-ramp](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#device-connectivity):
-1. In [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the IPs listed above route through the WARP tunnel. For example, if you are using the default Split Tunnels Exclude configuration and your application and DNS resolver have private IPs in the range `10.0.0.0/8`, delete `100.64.0.0/10` and `10.0.0.0/8` from the Split Tunnels list. We recommend adding back the IPs that are not explicitly used by your network — refer to our [Split Tunnels calculator](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) for details. -2. In [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/), delete the top-level domain for your private hostname. This configures WARP to send the DNS query to Cloudflare Gateway for resolution. +1. In [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the IPs listed above route through the WARP tunnel. For example, if you are using the default Split Tunnels Exclude configuration and your application and DNS resolver have private IPs in the range `10.0.0.0/8`, delete `100.64.0.0/10` and `10.0.0.0/8` from the Split Tunnels list. We recommend adding back the IPs that are not explicitly used by your network — refer to our [Split Tunnels calculator](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) for details. +2. In [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/), delete the top-level domain for your private hostname. This configures WARP to send the DNS query to Cloudflare Gateway for resolution.
-1. In your [WARP Connector device profile](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/#3-route-traffic-between-warp-connector-and-cloudflare), ensure that the IPs listed above route through the WARP tunnel. -2. Depending on where you installed WARP Connector, you may also need to route those destination IPs through WARP Connector and point your DNS resolver to Cloudflare Gateway. Refer to [Route traffic from subnet to WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/#4-route-traffic-from-subnet-to-warp-connector). +1. In your [WARP Connector device profile](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/#3-route-traffic-between-warp-connector-and-cloudflare), ensure that the IPs listed above route through the WARP tunnel. +2. Depending on where you installed WARP Connector, you may also need to route those destination IPs through WARP Connector and point your DNS resolver to Cloudflare Gateway. Refer to [Route traffic from subnet to WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/#4-route-traffic-from-subnet-to-warp-connector).
@@ -136,7 +136,7 @@ To route your internal DNS resolver through Cloudflare Tunnel: Only available on Enterprise plans ::: -Gateway will automatically resolve DNS queries using your internal DNS server as long as the DNS server is behind the same Cloudflare Tunnel as your application. If your DNS server is behind a different Cloudflare Tunnel (for example, if you separated DNS traffic into its own tunnel for [high availability](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/system-requirements/#private-dns)), then you need to point Gateway to the correct tunnel and DNS server. +Gateway will automatically resolve DNS queries using your internal DNS server as long as the DNS server is behind the same Cloudflare Tunnel as your application. If your DNS server is behind a different Cloudflare Tunnel (for example, if you separated DNS traffic into its own tunnel for [high availability](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/#private-dns)), then you need to point Gateway to the correct tunnel and DNS server. 1. [Create a Gateway resolver policy](/cloudflare-one/policies/gateway/resolver-policies/#create-a-resolver-policy) that matches the private hostname for which you are establishing the route: @@ -146,7 +146,7 @@ Gateway will automatically resolve DNS queries using your internal DNS server as 2. Under **Configure custom DNS resolvers**, enter the IPv4 and/or IPv6 address of your internal DNS server. The dropdown menu will not populate until you type in the full IP address. -3. From the dropdown menu, select the `- Private` routing option and the [virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) where the DNS server is located. +3. From the dropdown menu, select the `- Private` routing option and the [virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) where the DNS server is located. ### 4. (Recommended) Filter network traffic with Gateway @@ -231,7 +231,7 @@ You can run the following tests to check if private hostname routing is properly If the DNS lookup fails, it means that WARP cannot connect to your internal DNS server through `cloudflared`. Check that you have a [tunnel route](#2-connect-the-dns-server-to-cloudflare) for the internal DNS server IP. Also, confirm that the DNS server IP [routes through the WARP tunnel](#split-tunnels). - For a general WARP-to-Tunnel troubleshooting procedure, refer to [Troubleshoot private network connectivity](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/private-networks/). + For a general WARP-to-Tunnel troubleshooting procedure, refer to [Troubleshoot private network connectivity](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/private-networks/). 2. Run a standard `nslookup` for the private hostname: @@ -248,7 +248,7 @@ You can run the following tests to check if private hostname routing is properly Address: 100.80.200.48 ``` - The query should resolve using [WARP's DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) and return a Gateway initial resolved IP. If the query fails to resolve or returns a different IP, check your [Local Domain Fallback configuration](#local-domain-fallback) and [Gateway resolver policies](#3-optional-create-a-resolver-policy). + The query should resolve using [WARP's DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) and return a Gateway initial resolved IP. If the query fails to resolve or returns a different IP, check your [Local Domain Fallback configuration](#local-domain-fallback) and [Gateway resolver policies](#3-optional-create-a-resolver-policy). 3. When you connect to the application using its private hostname, the device should make a connection to the initial resolved IP: ```sh @@ -260,5 +260,5 @@ You can run the following tests to check if private hostname routing is properly ... ``` - If the request fails, confirm that the initial resolved IP [routes through the WARP tunnel](#split-tunnels). You can also check your [tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/) to confirm that requests are routing to the application's private IP. + If the request fails, confirm that the initial resolved IP [routes through the WARP tunnel](#split-tunnels). You can also check your [tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) to confirm that requests are routing to the application's private IP. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/index.mdx similarity index 77% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/index.mdx index d1ff3a987cda3c..10299e3320c7ad 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/index.mdx @@ -13,5 +13,5 @@ On the client side, end users connect to Cloudflare's global network using the C ![Diagram displaying connections between a device, Cloudflare, and a private network.](~/assets/images/cloudflare-one/connections/private-ips-diagram.png) To enable remote access to your private network, refer to the following guides: -- [**Connect a private hostname**](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-private-hostname/): Route network traffic to an internal application using its hostname. -- [**Connect an IP/CIDR**](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/): Route traffic to an internal IP address or CIDR range. \ No newline at end of file +- [**Connect a private hostname**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/): Route network traffic to an internal application using its hostname. +- [**Connect an IP/CIDR**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/): Route traffic to an internal IP address or CIDR range. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns.mdx similarity index 74% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns.mdx index 77f3f864ab9ee5..dfc300c5d2457f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns.mdx @@ -13,26 +13,26 @@ By default, all DNS requests on the user device are resolved by Cloudflare's [pu To resolve private DNS queries: -1. [Connect your private network](/cloudflare-one/connections/connect-networks/get-started/) with Cloudflare Tunnel. +1. [Connect your private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/) with Cloudflare Tunnel. 2. Under **Networks** > **Routes**, verify that the IP address of your internal DNS resolver is included in the tunnel. :::note - Ensure that **Split Tunnels** are configured to [include traffic to private IPs and hostnames](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp). + Ensure that **Split Tunnels** are configured to [include traffic to private IPs and hostnames](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp). ::: 3. Route specific DNS queries to your internal DNS resolver using one of the following options: - - [Create a Local Domain Fallback entry](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) that points to the internal DNS resolver. For example, you can instruct the WARP client to resolve all requests for `myorg.privatecorp` through an internal resolver at `10.0.0.25` rather than attempting to resolve this publicly. + - [Create a Local Domain Fallback entry](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) that points to the internal DNS resolver. For example, you can instruct the WARP client to resolve all requests for `myorg.privatecorp` through an internal resolver at `10.0.0.25` rather than attempting to resolve this publicly. - Alternatively, [create a resolver policy](/cloudflare-one/policies/gateway/resolver-policies/#create-a-resolver-policy) that points to the internal DNS resolver. 4. [Enable the Gateway proxy](/cloudflare-one/policies/gateway/proxy/#turn-on-the-gateway-proxy) for TCP and UDP. -5. Finally, ensure that your tunnel uses QUIC as the default [transport protocol](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#protocol). This will enable `cloudflared` to proxy UDP-based traffic which is required in most cases to resolve DNS queries. +5. Finally, ensure that your tunnel uses QUIC as the default [transport protocol](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#protocol). This will enable `cloudflared` to proxy UDP-based traffic which is required in most cases to resolve DNS queries. -The WARP client will now send DNS queries to your internal DNS resolver for resolution. To learn more, refer to [How the WARP client handles DNS requests](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/#how-the-warp-client-handles-dns-requests). +The WARP client will now send DNS queries to your internal DNS resolver for resolution. To learn more, refer to [How the WARP client handles DNS requests](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/#how-the-warp-client-handles-dns-requests). ## Test the setup diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks.mdx similarity index 90% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks.mdx index 748071559f7a1f..0306bd749398ff 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks.mdx @@ -9,7 +9,7 @@ import { Details, Render, Tabs, TabItem } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -38,8 +38,8 @@ Here are a few scenarios where virtual networks may prove useful: ## Prerequisites -- [Install `cloudflared`](/cloudflare-one/connections/connect-networks/downloads/) on each private network. -- [Deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) on user devices. +- [Install `cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) on each private network. +- [Deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) on user devices. ## Create a virtual network @@ -125,13 +125,13 @@ The following example demonstrates how to add two overlapping IP routes to Cloud virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.production_vnet.id } ``` - 5. [Get the token](/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions/#get-the-tunnel-token) for each tunnel. + 5. [Get the token](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/remote-tunnel-permissions/#get-the-tunnel-token) for each tunnel. - 6. Using the tunnel tokens, run `Staging tunnel` in your staging environment and run `Production tunnel` in your production environment. Refer to [Install and run the tunnel](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api/#4-install-and-run-the-tunnel). + 6. Using the tunnel tokens, run `Staging tunnel` in your staging environment and run `Production tunnel` in your production environment. Refer to [Install and run the tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/#4-install-and-run-the-tunnel). - To route overlapping IPs over virtual networks for [locally-managed tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/): + To route overlapping IPs over virtual networks for [locally-managed tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/): 1. Create a tunnel for each private network: @@ -197,7 +197,7 @@ The following example demonstrates how to add two overlapping IP routes to Cloud We now have two overlapping IP addresses routed over `staging-vnet` and `production-vnet` respectively. - 6. Within your staging environment, create a [configuration file](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/) for `staging-tunnel`. The configuration file will be structured as follows: + 6. Within your staging environment, create a [configuration file](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/) for `staging-tunnel`. The configuration file will be structured as follows: ```txt tunnel: @@ -238,7 +238,7 @@ The following example demonstrates how to add two overlapping IP routes to Cloud - To delete a virtual network for [locally-managed tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/): + To delete a virtual network for [locally-managed tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/): 1. Delete all IP routes in the virtual network. For example, diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx new file mode 100644 index 00000000000000..4cd397491abb97 --- /dev/null +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx @@ -0,0 +1,21 @@ +--- +pcx_content_type: concept +title: Private networks +sidebar: + order: 7 +--- + +With Cloudflare Zero Trust, you can connect private networks and the services running in those networks to Cloudflare's global network. This involves installing a [connector](#connectors) on the private network, and then [setting up routes](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2b-connect-a-network) which define the IP addresses available in that environment. Unlike [published applications](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), private network routes can expose both HTTP and non-HTTP resources. + +To reach private network IPs, end users must connect their device to Cloudflare and enroll in your Zero Trust organization. The most common method is to install the [WARP client](/cloudflare-one/team-and-resources/devices/warp/) on their device, or you can onboard their network traffic to Cloudflare using our [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) or [Magic WAN](/magic-wan/zero-trust/cloudflare-tunnel/). + +Administrators can optionally set [Gateway network policies](/cloudflare-one/policies/gateway/network-policies/) to control access to services based on user identity and device posture. + +## Connectors + +Here are the different ways you can connect your private network to Cloudflare: + +- [**cloudflared**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) installs on a server in your private network to create a secure, outbound tunnel to Cloudflare. Cloudflare Tunnel using `cloudflared` only proxies traffic initiated from a user to a server. Any service or application running behind the tunnel will use the server's default routing table for server-initiated connectivity. +- [**WARP-to-WARP**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/) uses the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/) to establish peer-to-peer connectivity between two or more devices. Each device running WARP can access services on any other device running WARP via an assigned virtual IP address. +- [**WARP Connector**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) installs on a Linux server in your private network to establish site-to-site, bidirectional, and mesh networking connectivity. The WARP Connector acts as a subnet router to relay client-initiated and server-initiated traffic between all devices on a private network and Cloudflare. +- [**Magic WAN**](/magic-wan/) relies on configuring legacy networking equipment to establish anycast GRE or IPsec tunnels between an entire network location and Cloudflare. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/index.mdx similarity index 65% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/index.mdx index bfb98ca433fb08..ae81c2051e0bf5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/index.mdx @@ -13,7 +13,7 @@ import { Render, Details} from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Gateway with WARP | All plans | @@ -41,13 +41,13 @@ Cloudflare WARP Connector (beta) is a software client[^1] that enables site-to-s ![Two subnets connected with WARP Connector](~/assets/images/cloudflare-one/connections/connect-apps/warp-connector/overview.png) -As shown in the diagram, WARP Connector acts as a router for a subnet within the private network to on-ramp and off-ramp traffic through Cloudflare. All devices on the subnet can access any services connected to Cloudflare, and all devices connected to Cloudflare can access any services on the subnet. Each subnet runs a WARP Connector on a designated Linux machine (typically the [default gateway router](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/#3-route-traffic-from-subnet-to-warp-connector)), but other devices on the network do not need to install software. +As shown in the diagram, WARP Connector acts as a router for a subnet within the private network to on-ramp and off-ramp traffic through Cloudflare. All devices on the subnet can access any services connected to Cloudflare, and all devices connected to Cloudflare can access any services on the subnet. Each subnet runs a WARP Connector on a designated Linux machine (typically the [default gateway router](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-internet/#3-route-traffic-from-subnet-to-warp-connector)), but other devices on the network do not need to install software. To set up WARP Connector, refer to the guide for your use case: -- **[Site-to-Internet](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/)**: Send requests from your private network to the Internet. -- **[Site-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/)**: Send requests between two or more private networks. -- **[User-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site/)**: Allow WARP client devices to send requests to your private network. -- **Internet-to-site**: Not supported by WARP Connector. To provide clientless access to applications on your private network, set up a [Cloudflare Tunnel with `cloudflared`](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) and configure a [published application](/cloudflare-one/connections/connect-networks/routing-to-tunnel/). +- **[Site-to-Internet](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-internet/)**: Send requests from your private network to the Internet. +- **[Site-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/)**: Send requests between two or more private networks. +- **[User-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/user-to-site/)**: Allow WARP client devices to send requests to your private network. +- **Internet-to-site**: Not supported by WARP Connector. To provide clientless access to applications on your private network, set up a [Cloudflare Tunnel with `cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) and configure a [published application](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/). -[^1]: WARP Connector is an extension of the [WARP client](/cloudflare-one/connections/connect-devices/warp/). +[^1]: WARP Connector is an extension of the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-internet.mdx similarity index 96% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-internet.mdx index 0e25e1a180cdc8..ee1cfb224365f0 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-internet.mdx @@ -23,7 +23,7 @@ This guide covers how to connect a private network to the Internet using WARP Co ## Prerequisites - A Linux host [^1] on the subnet -- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). ## 1. Install a WARP Connector diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site.mdx similarity index 88% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site.mdx index ddd861388bcf66..ff77c8e82d110e 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site.mdx @@ -28,7 +28,7 @@ In this example, we will create a WARP Connector for subnet `10.0.0.0/24` and in ## Prerequisites - A Linux host [^1] on each subnet. -- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). ## 1. Install a WARP Connector @@ -48,7 +48,7 @@ In this example, we will create a WARP Connector for subnet `10.0.0.0/24` and in ::: 4. For **Tunnel**, select the name of your WARP Connector (_Subnet-10.0.0.0/24_). 5. Select **Create**. -6. In your WARP Connector device profile, [configure Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) so that traffic to your private network CIDR (`10.0.0.0/24`) routes through the WARP tunnel. For example, if you are using **Exclude** mode, delete `10.0.0.0/8` from Split Tunnels and re-add the following IPs: `10.0.1.0/24`, `10.0.2.0/23`, `10.0.4.0/22`, `10.0.8.0/21`, `10.0.16.0/20`, `10.0.32.0/19`, `10.0.64.0/18`, `10.0.128.0/17`, `10.1.0.0/16`, `10.2.0.0/15`, `10.4.0.0/14`, `10.8.0.0/13`, `10.16.0.0/12`, `10.32.0.0/11`, `10.64.0.0/10`, `10.128.0.0/9` +6. In your WARP Connector device profile, [configure Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) so that traffic to your private network CIDR (`10.0.0.0/24`) routes through the WARP tunnel. For example, if you are using **Exclude** mode, delete `10.0.0.0/8` from Split Tunnels and re-add the following IPs: `10.0.1.0/24`, `10.0.2.0/23`, `10.0.4.0/22`, `10.0.8.0/21`, `10.0.16.0/20`, `10.0.32.0/19`, `10.0.64.0/18`, `10.0.128.0/17`, `10.1.0.0/16`, `10.2.0.0/15`, `10.4.0.0/14`, `10.8.0.0/13`, `10.16.0.0/12`, `10.32.0.0/11`, `10.64.0.0/10`, `10.128.0.0/9` The WARP Connector will now forward inbound requests to devices on the subnet. @@ -67,7 +67,7 @@ The WARP Connector will now forward inbound requests to devices on the subnet. ### DNS filtering -If you would like to filter private DNS queries using Cloudflare Gateway, check [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) and ensure that the following IPs route through WARP Connector: +If you would like to filter private DNS queries using Cloudflare Gateway, check [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) and ensure that the following IPs route through WARP Connector: - Internal DNS resolver IP - Initial resolved IP CGNAT range: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/tips.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips.mdx similarity index 63% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/tips.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips.mdx index 90ba2832578f57..d77272a4fb1ba3 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/tips.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips.mdx @@ -26,11 +26,11 @@ For Amazon Web Services (AWS) deployments: ## WARP Connector with cloudflared -WARP Connector and [`cloudflared`](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) can run together on the same Linux host. This configuration is useful when you want to use WARP Connector as a gateway for your private network, while also using the `cloudflared` daemon to expose specific applications. +WARP Connector and [`cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) can run together on the same Linux host. This configuration is useful when you want to use WARP Connector as a gateway for your private network, while also using the `cloudflared` daemon to expose specific applications. -By design, WARP Connector captures all outbound traffic and routes it through Cloudflare's network. This prevents `cloudflared` from making its own [required outbound connections](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation) to Cloudflare, causing the tunnel to fail with connection timeouts. +By design, WARP Connector captures all outbound traffic and routes it through Cloudflare's network. This prevents `cloudflared` from making its own [required outbound connections](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#required-for-tunnel-operation) to Cloudflare, causing the tunnel to fail with connection timeouts. -To allow `cloudflared` to connect, use [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) to explicitly exclude the [Cloudflare Tunnel destinations](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall/) from the WARP tunnel. For example, if you are using Split Tunnels in **Exclude** mode, add the following hostnames (or their corresponding IP ranges) to your Split Tunnel exclusion list: +To allow `cloudflared` to connect, use [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) to explicitly exclude the [Cloudflare Tunnel destinations](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/) from the WARP tunnel. For example, if you are using Split Tunnels in **Exclude** mode, add the following hostnames (or their corresponding IP ranges) to your Split Tunnel exclusion list: - `region1.v2.argotunnel.com` - `region2.v2.argotunnel.com` diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/user-to-site.mdx similarity index 90% rename from src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/user-to-site.mdx index e8210b6324d227..5852697349bc3f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/user-to-site.mdx @@ -25,7 +25,7 @@ This guide covers how to connect WARP client user devices to a private network b ## Prerequisites - A Linux host [^1] on the subnet. -- For WARP Connector to connect to Cloudflare services, your firewall should allow inbound/outbound traffic for the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +- For WARP Connector to connect to Cloudflare services, your firewall should allow inbound/outbound traffic for the [WARP IP addresses, ports, and domains](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). - For WARP clients to connect to your subnet, your firewall should allow inbound traffic from the WARP CGNAT IP range: `100.96.0.0/12` ## 1. Install a WARP Connector @@ -40,7 +40,7 @@ This guide covers how to connect WARP client user devices to a private network b WARP clients and WARP Connectors are accessed using their CGNAT IP. Therefore, CGNAT IP traffic must route through Cloudflare on both the WARP Connector host and WARP client devices. -1. In your WARP Connector device profile, go to [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). +1. In your WARP Connector device profile, go to [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). 2. Ensure that `100.96.0.0/12` routes through the WARP tunnel. For example, if you are using **Exclude** mode, delete `100.64.0.0/10` from the list and re-add `100.64.0.0/11` and `100.112.0.0/12`. 3. Repeat the previous steps for all WARP client device profiles. @@ -61,7 +61,7 @@ Depending on where you installed the WARP Connector, you may need to configure o #### Add IP route to router -`100.96.0.0/12` is the default CIDR for all user devices running the [WARP client](/cloudflare-one/connections/connect-devices/warp/). On your router, add a rule that routes the destination IP `100.96.0.0/12` to the WARP Connector host machine (`10.0.0.100`). +`100.96.0.0/12` is the default CIDR for all user devices running the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). On your router, add a rule that routes the destination IP `100.96.0.0/12` to the WARP Connector host machine (`10.0.0.100`). **Network**. 2. Enable **Proxy**. 3. Enable **Warp-to-Warp**. This allows Cloudflare to route traffic to the CGNAT IP space. -4. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that traffic to `100.96.0.0/12` is going through WARP: +4. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that traffic to `100.96.0.0/12` is going through WARP: - If using **Exclude** mode, delete `100.64.0.0/10` from the list and re-add `100.64.0.0/11` and `100.112.0.0/12`. - If using **Include** mode, add `100.96.0.0/12` to your list. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns.mdx similarity index 94% rename from src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns.mdx index 4b6ab0d7e7aaab..6f219052333e4b 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns.mdx @@ -43,7 +43,7 @@ This command create a `CNAME` record that points to the tunnel subdomain, but wi :::note -To create DNS records using `cloudflared`, the [`cert.pem`](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/local-tunnel-terms/#certpem) file must be installed on your system. +To create DNS records using `cloudflared`, the [`cert.pem`](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/local-tunnel-terms/#certpem) file must be installed on your system. ::: diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/index.mdx new file mode 100644 index 00000000000000..810a9e91da3593 --- /dev/null +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/index.mdx @@ -0,0 +1,16 @@ +--- +pcx_content_type: concept +title: Published applications +sidebar: + order: 8 +--- + +Cloudflare Tunnel allows you to publish local applications to the Internet via a public hostname. For example, you can [add a published application route](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-publish-an-application) that points `docs.example.com` to `https://localhost:8080`. Anyone can now view your application by going to `docs.example.com` in their web browser. + +Cloudflare can route traffic down your Cloudflare Tunnel using a [DNS record](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/) or [Cloudflare Load Balancer](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/). You can configure either option from the Cloudflare dashboard by pointing a DNS `CNAME` record or a load balancer pool to your Cloudflare Tunnel subdomain (`.cfargotunnel.com`). You can also associate these records with your tunnel from `cloudflared` directly. + +:::note + +You do not need a paid Cloudflare Access plan to publish an application via Cloudflare Tunnel. [Access seats](/cloudflare-one/identity/users/seat-management/) are only required if you want to [secure the application using Access policies](/cloudflare-one/applications/configure-apps/self-hosted-public-app/), such as requiring users to log in via an identity provider. + +::: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/protocols.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols.mdx similarity index 50% rename from src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/protocols.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols.mdx index ad2b620c96c694..c57019d7a30924 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/protocols.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols.mdx @@ -8,18 +8,18 @@ tableOfContents: false --- -When you [add a published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application) to a Cloudflare Tunnel, you are instructing Cloudflare to proxy requests for your public hostname to a service running privately behind `cloudflared`. The table below lists the service types that can route to a public hostname. Non-HTTP services will require [installing `cloudflared` on the client](/cloudflare-one/applications/non-http/cloudflared-authentication/) for end users to connect. +When you [add a published application route](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-publish-an-application) to a Cloudflare Tunnel, you are instructing Cloudflare to proxy requests for your public hostname to a service running privately behind `cloudflared`. The table below lists the service types that can route to a public hostname. Non-HTTP services will require [installing `cloudflared` on the client](/cloudflare-one/applications/non-http/cloudflared-authentication/) for end users to connect. | Service type | Description | Example `service` value | | ------------ | ----------- | ---------- | | HTTP | Incoming requests to Cloudflare over HTTPS are proxied to the local web service via HTTP. | `http://localhost:8000` | -| HTTPS | Incoming requests to Cloudflare over HTTPS are proxied directly to the local web service. You can [disable TLS verification](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters/#notlsverify) if your origin uses self-signed certificates. | `https://localhost:8000` | +| HTTPS | Incoming requests to Cloudflare over HTTPS are proxied directly to the local web service. You can [disable TLS verification](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters/#notlsverify) if your origin uses self-signed certificates. | `https://localhost:8000` | | UNIX | Just like HTTP, but using a Unix socket instead. | `unix:/home/production/echo.sock` | -| TCP | Enables TCP streams over a Websocket connection. `cloudflared` will take the packets received from the Websocket and reach out to the origin using TCP. To [connect to the public hostname over arbitrary TCP](/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp/), the user needs to run `cloudflared access tcp`, and there are no guarantees on how long the TCP tunnel will live. For long-lived connections, we recommend using [WARP-to-Tunnel](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) instead.| `tcp://localhost:2222` | -| SSH | Enables SSH streams over a Websocket connection. `cloudflared` will take the packets received from the Websocket and reach out to the origin using SSH. To [connect to the public hostname over SSH](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-cloudflared-authentication/), the client needs to run `cloudflared access ssh`, and there are no guarantees on how long the SSH connection will last. For long-lived connections, we recommend using [WARP-to-Tunnel](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) instead. | `ssh://localhost:22` | -| RDP | Similar to TCP but for RDP streams only. For more information, refer to [Connect to RDP with client-side cloudflared](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication/). | `rdp://localhost:3389` | +| TCP | Enables TCP streams over a Websocket connection. `cloudflared` will take the packets received from the Websocket and reach out to the origin using TCP. To [connect to the public hostname over arbitrary TCP](/cloudflare-one/applications/non-http/cloudflared-authentication/arbitrary-tcp/), the user needs to run `cloudflared access tcp`, and there are no guarantees on how long the TCP tunnel will live. For long-lived connections, we recommend using [WARP-to-Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) instead.| `tcp://localhost:2222` | +| SSH | Enables SSH streams over a Websocket connection. `cloudflared` will take the packets received from the Websocket and reach out to the origin using SSH. To [connect to the public hostname over SSH](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication/), the client needs to run `cloudflared access ssh`, and there are no guarantees on how long the SSH connection will last. For long-lived connections, we recommend using [WARP-to-Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) instead. | `ssh://localhost:22` | +| RDP | Similar to TCP but for RDP streams only. For more information, refer to [Connect to RDP with client-side cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-cloudflared-authentication/). | `rdp://localhost:3389` | | UNIX + TLS | Just like HTTPS, but using a Unix socket instead. | `unix+tls:/home/production/echo.sock` | -| SMB | Similar to TCP but for SMB streams only. For more information, refer to [Connect to SMB with client-side cloudflared](/cloudflare-one/connections/connect-networks/use-cases/smb/#connect-to-smb-server-with-cloudflared-access). | `smb://localhost:445` | +| SMB | Similar to TCP but for SMB streams only. For more information, refer to [Connect to SMB with client-side cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb/#connect-to-smb-server-with-cloudflared-access). | `smb://localhost:445` | | HTTP_STATUS | Responds to all requests with the given HTTP status. | `http_status:404` | | BASTION | `cloudflared` will act like a jumphost, allowing access to any local address. | `bastion` -| HELLO_WORLD | Test server for validating your Cloudflare Tunnel connection (for [locally managed tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/#file-structure-for-published-applications) only). | `hello_world` | +| HELLO_WORLD | Test server for validating your Cloudflare Tunnel connection (for [locally managed tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/#file-structure-for-published-applications) only). | `hello_world` | diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers.mdx similarity index 84% rename from src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers.mdx index fd26cb7f2e5c2f..5c2846ea29f829 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers.mdx @@ -7,15 +7,15 @@ sidebar: import { Render, DashButton, Details } from "~/components"; -A [public load balancer](/load-balancing/load-balancers/) allows you to distribute traffic across the servers that are running your [published applications](/cloudflare-one/connections/connect-networks/routing-to-tunnel/). +A [public load balancer](/load-balancing/load-balancers/) allows you to distribute traffic across the servers that are running your [published applications](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/). -When you add a [published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application) to your Cloudflare Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created tunnel. You can add the application to a load balancer pool by using `.cfargotunnel.com` as the [endpoint address](/load-balancing/understand-basics/load-balancing-components/#endpoints) and specifying the application hostname (`app.example.com`) in the [endpoint host header](/load-balancing/additional-options/override-http-host-headers/). Load Balancer does not support directly adding `app.example.com` as an endpoint if the service is behind Cloudflare Tunnel. +When you add a [published application route](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-publish-an-application) to your Cloudflare Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created tunnel. You can add the application to a load balancer pool by using `.cfargotunnel.com` as the [endpoint address](/load-balancing/understand-basics/load-balancing-components/#endpoints) and specifying the application hostname (`app.example.com`) in the [endpoint host header](/load-balancing/additional-options/override-http-host-headers/). Load Balancer does not support directly adding `app.example.com` as an endpoint if the service is behind Cloudflare Tunnel. ## Create a public load balancer ### Prerequisites -- A Cloudflare Tunnel with a [published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application) +- A Cloudflare Tunnel with a [published application route](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-publish-an-application) ### Create a load balancer @@ -156,7 +156,7 @@ Users can now access all applications through the load balancer. Since there are When you configure a published application route via the dashboard, Cloudflare will automatically generate a `CNAME` DNS record that points the application hostname (`app1.example.com`) to the tunnel subdomain (`.cfargotunnel.com`). You can [edit these DNS records](/dns/manage-dns-records/how-to/create-dns-records/#edit-dns-records) so that they point to the load balancer hostname instead. :::note -Tunnel routes configured via the API or CLI require [manually creating DNS records](/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns/). +Tunnel routes configured via the API or CLI require [manually creating DNS records](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/). ::: Here is an example of what your DNS records will look like before and after setting up [Multiple apps per load balancer](#multiple-apps-per-load-balancer): @@ -182,7 +182,7 @@ Here is an example of what your DNS records will look like before and after sett If you have a tunnel to a port or SSH port, do not set up a [TCP monitor](/load-balancing/monitors/). Instead, set up a health check endpoint on the `cloudflared` host and create an HTTPS monitor. For example, you can use `cloudflared` to return a fixed HTTP status response: -1. In your Cloudflare Tunnel, [add a published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application) to represent the health check endpoint: +1. In your Cloudflare Tunnel, [add a published application route](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2a-publish-an-application) to represent the health check endpoint: - **Hostame**: Enter a hostname for the health check endpoint (for example, `health-check.example.com`) - **Service Type**: _HTTP_STATUS_ - **HTTP Status Code**: `200` @@ -198,7 +198,7 @@ You can now assign this monitor to your load balancer endpoint. The monitor will ### Session affinity and replicas -The load balancer does not distinguish between [replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) of the same tunnel. If you run the same tunnel UUID on two separate hosts, the load balancer treats both hosts as a single endpoint. To maintain [session affinity](/load-balancing/understand-basics/session-affinity/) between a client and a particular host, you will need to connect each host to Cloudflare using a different tunnel UUID. +The load balancer does not distinguish between [replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) of the same tunnel. If you run the same tunnel UUID on two separate hosts, the load balancer treats both hosts as a single endpoint. To maintain [session affinity](/load-balancing/understand-basics/session-affinity/) between a client and a particular host, you will need to connect each host to Cloudflare using a different tunnel UUID. ### Local connection preference @@ -206,4 +206,4 @@ If you notice traffic imbalances across endpoints in different locations, you ma When an end user sends a request to your application, Cloudflare routes their traffic using [Anycast routing](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) and their request typically goes to the nearest Cloudflare data center. Cloudflare Tunnel will prefer to serve the request using `cloudflared` connections in the same data center. This behavior can impact how connections are weighted and traffic is distributed. -If you are running [`cloudflared` replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/), switch to separate Cloudflare tunnels so that you can have more granular control over [traffic steering](/load-balancing/understand-basics/traffic-steering/). +If you are running [`cloudflared` replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/), switch to separate Cloudflare tunnels so that you can have more granular control over [traffic steering](/load-balancing/understand-basics/traffic-steering/). diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors.mdx similarity index 89% rename from src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors.mdx index 805632edae73f0..a31f9b39827753 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors.mdx @@ -7,7 +7,7 @@ sidebar: import { Tabs, TabItem, GlossaryTooltip, Render } from "~/components"; -This section covers the most common errors you might encounter when connecting resources with Cloudflare Tunnel. If you do not see your issue listed below, refer to the [troubleshooting FAQ](/cloudflare-one/faq/troubleshooting/), view your [Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/), or [contact Cloudflare Support](/support/contacting-cloudflare-support/). +This section covers the most common errors you might encounter when connecting resources with Cloudflare Tunnel. If you do not see your issue listed below, refer to the [troubleshooting FAQ](/cloudflare-one/faq/troubleshooting/), view your [Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/), or [contact Cloudflare Support](/support/contacting-cloudflare-support/). ## Tunnel status @@ -69,7 +69,7 @@ For more information, refer to the [comprehensive list](/support/troubleshooting ## I see `ERR_TOO_MANY_REDIRECTS` when attempting to connect to an Access self-hosted app. -This error occurs when `cloudflared` does not recognize the SSL/TLS certificate presented by your origin. To resolve the issue, set the [origin server name](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/origin-parameters/#originservername) parameter to the hostname on your origin certificate. Here is an example of a locally-managed tunnel configuration: +This error occurs when `cloudflared` does not recognize the SSL/TLS certificate presented by your origin. To resolve the issue, set the [origin server name](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/origin-parameters/#originservername) parameter to the hostname on your origin certificate. Here is an example of a locally-managed tunnel configuration: ```txt ingress: @@ -104,7 +104,7 @@ There are a few different possible root causes behind the `websocket: bad handsh ## My tunnel randomly disconnects. -Long-lived connections initiated through the Cloudflare Zero Trust platform, such as SSH sessions, can last up to eight hours. However, disruptions along the service path may result in more frequent disconnects. Often, these disconnects are caused by regularly scheduled maintenance events such as data center, server, or service updates and restarts. If you believe these events are not the cause of disconnects in your environment, collect the relevant [WARP logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) and [Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/) and contact Support. +Long-lived connections initiated through the Cloudflare Zero Trust platform, such as SSH sessions, can last up to eight hours. However, disruptions along the service path may result in more frequent disconnects. Often, these disconnects are caused by regularly scheduled maintenance events such as data center, server, or service updates and restarts. If you believe these events are not the cause of disconnects in your environment, collect the relevant [WARP logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/) and [Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) and contact Support. ## Tunnel connections fail with SSL error. @@ -112,7 +112,7 @@ If `cloudflared` returns error `error="remote error: tls: handshake failure"`, c ## Tunnel connections fail with `Too many open files` error. -If your [Cloudflare Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/) returns a `socket: too many open files` error, it means that `cloudflared` has exhausted the open files limit on your machine. The maximum number of open files, or file descriptors, is an operating system setting that determines how many files a process is allowed to open. To increase the open file limit, you will need to [configure ulimit settings](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/system-requirements/#ulimits) on the machine running `cloudflared`. +If your [Cloudflare Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) returns a `socket: too many open files` error, it means that `cloudflared` has exhausted the open files limit on your machine. The maximum number of open files, or file descriptors, is an operating system setting that determines how many files a process is allowed to open. To increase the open file limit, you will need to [configure ulimit settings](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/#ulimits) on the machine running `cloudflared`. ## I see `failed to sufficiently increase receive buffer size` in my cloudflared logs. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs.mdx similarity index 84% rename from src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs.mdx index a9a3ac7f9656a0..adacaa18dff316 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs.mdx @@ -36,7 +36,7 @@ These instructions apply to remotely-managed and locally-managed tunnels running cloudflared tunnel diag ``` - If multiple instances of `cloudflared` are running on the same host, specify the [metrics server IP and port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#configure-the-metrics-server-address) for the instance you want to diagnose. For example: + If multiple instances of `cloudflared` are running on the same host, specify the [metrics server IP and port](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/#configure-the-metrics-server-address) for the instance you want to diagnose. For example: ```sh cloudflared tunnel diag --metrics 127.0.0.1:20241 @@ -46,9 +46,9 @@ This command will output the status of each diagnostic task and place a `cloudfl ### Docker -`cloudflared` reads diagnostic data from the [tunnel metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/). To get diagnostic logs, the metrics server must be exposed from the Docker container and reachable from the host machine. +`cloudflared` reads diagnostic data from the [tunnel metrics server](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/). To get diagnostic logs, the metrics server must be exposed from the Docker container and reachable from the host machine. -1. Determine the [metrics server port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#default-metrics-server-address) for the `cloudflared` instance running in Docker. +1. Determine the [metrics server port](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/#default-metrics-server-address) for the `cloudflared` instance running in Docker. 2. Ensure the container is deployed with port forwarding enabled. The diagnostic feature will request information from the Docker instance using local port `20241`, therefore you should forward port `20241` to the container port obtained in Step 1: @@ -94,9 +94,9 @@ This command will output the status of each diagnostic task and place a `cloudfl ### Kubernetes -The diagnostic feature will request data from the [tunnel metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/) using ports `20241` to `20245`. You will need to use port forwarding to allow the local `cloudflared` instance to connect to the metrics server on one of these ports. +The diagnostic feature will request data from the [tunnel metrics server](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/) using ports `20241` to `20245`. You will need to use port forwarding to allow the local `cloudflared` instance to connect to the metrics server on one of these ports. -1. Determine the tunnel's [metrics server port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#default-metrics-server-address). +1. Determine the tunnel's [metrics server port](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/#default-metrics-server-address). 2. Enable port forwarding: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/private-networks.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/private-networks.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/private-networks.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/private-networks.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx similarity index 87% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx index e6cfcbd9be1eee..41c0e65732e867 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx @@ -63,7 +63,7 @@ You can configure [Gateway network policies](/cloudflare-one/policies/gateway/ne | -------------- | -------- | --------------- | ------ | | Destination IP | in | `172.31.0.0/16` | Block | -For more details on setting up the Gateway proxy, refer to [Filter network traffic with Gateway](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway). +For more details on setting up the Gateway proxy, refer to [Filter network traffic with Gateway](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway). ## 5. Set up the client @@ -71,8 +71,8 @@ gRPC clients can connect to the server by installing Cloudflare WARP on the devi To set up the gRPC client: -1. [Deploy the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) on your device in Gateway with WARP mode. -2. [Create device enrollment rules](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/) to determine which devices can enroll to your Zero Trust organization. +1. [Deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) on your device in Gateway with WARP mode. +2. [Create device enrollment rules](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/) to determine which devices can enroll to your Zero Trust organization. 3. Install gRPC on the device by following this [quick start guide](https://grpc.io/docs/languages/python/quickstart/). 4. Modify `greeter.py` to point to the private IP of your gRPC server. This is the same private IP configured in your [Cloudflare Tunnel routes](#2-connect-the-server-to-cloudflare). For example, @@ -101,4 +101,4 @@ I0000 00:00:1721771484.489711 4414247 config.cc:230] gRPC experiments enabled: c Greeter client received: Hello, you! ``` -You can view [Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/#view-logs-on-your-local-machine) to validate that requests are coming into the tunnel and reaching the gRPC server as intended. +You can view [Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/#view-logs-on-your-local-machine) to validate that requests are coming into the tunnel and reaching the gRPC server as intended. diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/index.mdx new file mode 100644 index 00000000000000..e389d2f9e21949 --- /dev/null +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/index.mdx @@ -0,0 +1,15 @@ +--- +pcx_content_type: navigation +title: Use cases +hidden: false +sidebar: + order: 4 + +--- + +Cloudflare Tunnel creates a secure, outbound-only connection between your services and Cloudflare by deploying a lightweight connector in your environment. Here is how to use tunnels with some specific services: + +* [SSH](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/) +* [RDP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/) +* [SMB](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb/) +* [gRPC](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc/) diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/index.mdx similarity index 65% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/index.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/index.mdx index 96b169ad5835bc..10c1d697c5f833 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/index.mdx @@ -12,6 +12,6 @@ With Cloudflare Zero Trust, you can make your RDP server available over the Inte Cloudflare offers three ways to secure RDP: -- [Browser-based RDP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/) -- [RDP with WARP client](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel/) -- [RDP with client-side cloudflared](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication/) \ No newline at end of file +- [Browser-based RDP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) +- [RDP with WARP client](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-warp-to-tunnel/) +- [RDP with client-side cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-cloudflared-authentication/) \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser.mdx similarity index 91% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser.mdx index 6e72b0c30da8a4..184411dc95cd7a 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser.mdx @@ -8,14 +8,14 @@ sidebar: import { Render, GlossaryTooltip, Details } from "~/components"; -Users can connect to an RDP server without installing an RDP client or the [WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device. Browser-based RDP leverages [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/), which creates a secure, outbound-only connection from your RDP server to Cloudflare's global network. Setup involves running the `cloudflared` daemon on the RDP server (or any other host machine within the private network) and routing RDP traffic over a public hostname. +Users can connect to an RDP server without installing an RDP client or the [WARP client](/cloudflare-one/team-and-resources/devices/warp/) on their device. Browser-based RDP leverages [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/), which creates a secure, outbound-only connection from your RDP server to Cloudflare's global network. Setup involves running the `cloudflared` daemon on the RDP server (or any other host machine within the private network) and routing RDP traffic over a public hostname. There are two ways for users to [reach the RDP server in their browser](#4-connect-as-a-user): - **App Launcher (recommended)**: Users can log in to the [Access App Launcher](/cloudflare-one/applications/app-launcher/) with their Cloudflare Access credentials and then initiate an RDP connection within the browser to their Windows machine. Users will authenticate to the Windows machine using their pre-configured Windows username and password. Cloudflare does not manage any credentials on the Windows server. - **Direct URL**: A user may also navigate directly to the Windows server at `https:///rdp///`, where `vnet-id` is the virtual network assigned to the Cloudflare Tunnel route. The authentication flow is the same as for the App Launcher; first users must log in to Cloudflare Access and then use their Windows credentials to authenticate to the Windows machine. -Browser-based RDP can be used in conjunction with [routing over WARP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. +Browser-based RDP can be used in conjunction with [routing over WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-warp-to-tunnel/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. ## Prerequisites @@ -163,7 +163,7 @@ To connect to a Windows machine over RDP: The App Launcher tile will launch a URL of the form `https:///rdp///`. You may also navigate directly to this URL. :::note[Virtual network ID] - `vnet-id` refers to the [virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) (VNET) that the RDP target is assigned to in your Cloudflare Tunnel configuration. If you did not specify a VNET when routing the target through Cloudflare Tunnel, the target is automatically added to the default VNET. + `vnet-id` refers to the [virtual network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) (VNET) that the RDP target is assigned to in your Cloudflare Tunnel configuration. If you did not specify a VNET when routing the target through Cloudflare Tunnel, the target is automatically added to the default VNET. To fetch a list of all VNETs and their IDs, make a `GET` request to the [List Virtual Networks](/api/resources/zero_trust/subresources/networks/subresources/virtual_networks/methods/list/) endpoint. The default VNET will have the parameter `"is_default_network": true`. ::: @@ -261,7 +261,7 @@ The login flow differs slightly when using an Microsoft Entra ID-bound username: ## Known limitations - **TLS certificate verification**: Cloudflare uses TLS to connect to the RDP target but does not verify the origin TLS certificate. -- **WARP authentication**: Since browser-based RDP traffic does not go through the WARP client, users cannot use their [WARP session identity](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/#configure-warp-sessions-in-access) to authenticate. +- **WARP authentication**: Since browser-based RDP traffic does not go through the WARP client, users cannot use their [WARP session identity](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/#configure-warp-sessions-in-access) to authenticate. - **Audio over RDP**: Users cannot use their microphone and speaker to interact with the remote machine. - **Clipboard size limit**: Data copied between the local machine and the browser-based RDP session may not exceed 500 KB. - **Clipboard controls**: Admins do not have the ability to restrict copy/paste actions between the remote machine and the user's local clipboard. diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-cloudflared-authentication.mdx similarity index 81% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-cloudflared-authentication.mdx index 747a17c3989a50..c56b5586242cde 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-cloudflared-authentication.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-cloudflared-authentication.mdx @@ -10,11 +10,11 @@ import { Render } from "~/components"; End users can connect to an RDP server without the WARP client by authenticating through `cloudflared` in their native terminal. This method requires having `cloudflared` installed on both the server machine and on the client machine, as well as an active zone on Cloudflare. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials. -Client-side `cloudflared` can be used in conjunction with [routing over WARP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel/) and [Browser-based RDP](/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. +Client-side `cloudflared` can be used in conjunction with [routing over WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-warp-to-tunnel/) and [Browser-based RDP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. ## 1. Connect the server to Cloudflare -1. Create a Cloudflare Tunnel by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). +1. Create a Cloudflare Tunnel by following our [dashboard setup guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). 2. In the **Published application routes** tab, choose a domain from the drop-down menu and specify any subdomain (for example, `rdp.example.com`). @@ -28,7 +28,7 @@ By default, anyone on the Internet can connect to the server using the hostname ## 3. Connect as a user -1. [Install `cloudflared`](/cloudflare-one/connections/connect-networks/downloads/) on the client machine. +1. [Install `cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) on the client machine. 2. Run this command to open an RDP listening port: ```sh diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-warp-to-tunnel.mdx similarity index 88% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-warp-to-tunnel.mdx index 42f177888817c7..ee58f414a1fcd5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-warp-to-tunnel.mdx @@ -8,7 +8,7 @@ sidebar: import { Render } from "~/components"; -Cloudflare WARP to Tunnel allows users to connect to RDP servers using their preferred RDP client. Cloudflare Tunnel creates a secure, outbound-only connection from your RDP server to Cloudflare's global network; this requires running the `cloudflared` daemon on the server (or any other host machine within the private network). Users install the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device and enroll in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can connect to the RDP server unless you build policies to allow or block specific users. +Cloudflare WARP to Tunnel allows users to connect to RDP servers using their preferred RDP client. Cloudflare Tunnel creates a secure, outbound-only connection from your RDP server to Cloudflare's global network; this requires running the `cloudflared` daemon on the server (or any other host machine within the private network). Users install the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/) on their device and enroll in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can connect to the RDP server unless you build policies to allow or block specific users. This example walks through how to set up an RDP server on a Google Cloud Platform (GCP) virtual machine (VM), but you can use any machine that supports RDP connections. @@ -54,7 +54,7 @@ By default, Internet Explorer will be installed and configured in [Enhanced Secu 3. In the **CIDR** tab for the tunnel, enter the private IP or CIDR address of your server. In GCP, the server IP is the **Internal IP** of the VM instance. -4. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server. +4. (Optional) [Set up Zero Trust policies](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server. ## 4. Set up the client diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb.mdx similarity index 84% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb.mdx index 0678ee72861b90..baa7350d0313e0 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb.mdx @@ -20,14 +20,14 @@ While SMB was developed for Microsoft Windows, Samba provides SMB connectivity f ## Connect to SMB server with WARP to Tunnel -You can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare's global network. This requires running the `cloudflared` daemon on the server. Users reach the service by installing the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can access the service unless you build policies to allow or block specific users. +You can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare's global network. This requires running the `cloudflared` daemon on the server. Users reach the service by installing the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/) on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can access the service unless you build policies to allow or block specific users. ### 1. Connect the server to Cloudflare 3. In the **CIDR** tab for the tunnel, enter the private IP or CIDR address of your server. -4. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server. +4. (Optional) [Set up Zero Trust policies](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server. ### 2. Set up the client @@ -69,7 +69,7 @@ The public hostname method can be implemented in conjunction with routing over W ### 1. Connect the server to Cloudflare -1. Create a Cloudflare Tunnel by following our [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). +1. Create a Cloudflare Tunnel by following our [dashboard setup guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). 2. In the **Published application routes** tab, choose a domain from the drop-down menu and specify any subdomain (for example, `smb.example.com`). @@ -83,7 +83,7 @@ By default, anyone on the Internet can connect to the server using the hostname ### 3. Connect as a user -1. [Install `cloudflared`](/cloudflare-one/connections/connect-networks/downloads/) on the client machine. +1. [Install `cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) on the client machine. 2. Run the following command to open an SMB listening port. You can specify any available port on the client machine. @@ -93,7 +93,7 @@ By default, anyone on the Internet can connect to the server using the hostname This command can be wrapped as a desktop shortcut so that end users do not need to use the command line. -3. [Open your SMB client](/cloudflare-one/connections/connect-networks/use-cases/smb/#4-connect-as-a-user) and configure the client to point to `smb://localhost:8445/sambashare`. Do not input the hostname. +3. [Open your SMB client](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/smb/#4-connect-as-a-user) and configure the client to point to `smb://localhost:8445/sambashare`. Do not input the hostname. 4. Sign in with the username and password created while setting up the server. diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/index.mdx new file mode 100644 index 00000000000000..65905d20787cf3 --- /dev/null +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/index.mdx @@ -0,0 +1,19 @@ +--- +pcx_content_type: navigation +title: SSH +hidden: false +sidebar: + order: 1 +tableOfContents: false +--- + +The Secure Shell Protocol (SSH) enables users to remotely access devices through the command line. With Cloudflare Zero Trust, you can make your SSH server available over the Internet without the risk of opening inbound ports on the server. + +Cloudflare offers four ways to secure SSH: + +- [SSH with Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) (recommended) +- [Self-managed SSH keys](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel/) +- [Browser-rendered SSH terminal](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-browser-rendering/) +- [SSH with client-side cloudflared](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication/) (legacy) + +For an overview of these connection options, refer to [non-HTTP applications](/cloudflare-one/applications/non-http/). \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-browser-rendering.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-browser-rendering.mdx similarity index 73% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-browser-rendering.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-browser-rendering.mdx index 061d2dd4f56c12..9e3bc614592929 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-browser-rendering.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-browser-rendering.mdx @@ -12,7 +12,7 @@ Cloudflare's browser-based terminal allows end users to connect to an SSH server This method requires routing SSH access to the server through a public hostname. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials. -The browser-based terminal can be used in conjunction with [routing over WARP](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/) and [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. +The browser-based terminal can be used in conjunction with [routing over WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel/) and [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. ## 1. Connect the server to Cloudflare diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-cloudflared-authentication.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication.mdx similarity index 73% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-cloudflared-authentication.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication.mdx index 2593364431ef6c..1a91cd610e6f04 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-cloudflared-authentication.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-cloudflared-authentication.mdx @@ -9,12 +9,12 @@ sidebar: import { Render } from "~/components"; :::note -Not recommended for new deployments. We recommend using [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) to connect to SSH. +Not recommended for new deployments. We recommend using [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) to connect to SSH. ::: End users can connect to an SSH server without the WARP client by authenticating through `cloudflared` in their native terminal. This method requires having `cloudflared` installed on both the server machine and on the client machine, as well as an active zone on Cloudflare. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials. -Client-side `cloudflared` can be used in conjunction with [routing over WARP](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/) and [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. +Client-side `cloudflared` can be used in conjunction with [routing over WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel/) and [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) so that there are multiple ways to connect to the server. You can reuse the same Cloudflare Tunnel when configuring each connection method. ## 1. Connect the server to Cloudflare @@ -22,7 +22,7 @@ Client-side `cloudflared` can be used in conjunction with [routing over WARP](/c ## 2. Connect as a user -1. [Install `cloudflared`](/cloudflare-one/connections/connect-networks/downloads/) on the client machine. +1. [Install `cloudflared`](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) on the client machine. 2. Make a one-time change to your SSH configuration file: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access.mdx similarity index 85% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access.mdx index 4e1af476c66dbe..5e0a148678efb5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access.mdx @@ -8,7 +8,7 @@ sidebar: import { Tabs, TabItem, Badge, Render, APIRequest } from "~/components"; -[Access for Infrastructure](/cloudflare-one/applications/non-http/infrastructure-apps/) provides granular control over how users can connect to your SSH servers. This feature uses the same deployment model as [WARP-to-Tunnel](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/) but unlocks more policy options and command logging functionality. +[Access for Infrastructure](/cloudflare-one/applications/non-http/infrastructure-apps/) provides granular control over how users can connect to your SSH servers. This feature uses the same deployment model as [WARP-to-Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel/) but unlocks more policy options and command logging functionality. @ @@ -204,7 +204,7 @@ A user may be blocked by an Access policy from reaching your server because no e :::note[Access policies and infrastructure applications] -The Access infrastructure application (created in [step 5](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#5-add-an-infrastructure-application)) is the policy container for your SSH server. Cloudflare refers to your server that you connect to with SSH as a [target](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#4-add-a-target). +The Access infrastructure application (created in [step 5](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#5-add-an-infrastructure-application)) is the policy container for your SSH server. Cloudflare refers to your server that you connect to with SSH as a [target](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#4-add-a-target). [Access policies](/cloudflare-one/policies/access/policy-management/) are the rules attached to this Access infrastructure application, determining who can connect and what UNIX usernames they can log in as on the server. Cloudflare will not create new users on the target. UNIX users must already be present on the server. @@ -218,7 +218,7 @@ As an end user, run [`warp-cli target list`](/cloudflare-one/applications/non-ht -- If the target appears in the list, confirm that the username you are attempting to connect with is shown in the output. If the username is not shown, an administrator must find the Access policy associated with the target and add that username to the Access policy. An administrator should have created an Access policy in [substep 9 of step 5: Add an infrastructure application](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#5-add-an-infrastructure-application). If the username is shown, that means the Access policy should be granting access and you should ensure that the tunnel is healthy in [step 2](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#2-check-target-machine-connection). +- If the target appears in the list, confirm that the username you are attempting to connect with is shown in the output. If the username is not shown, an administrator must find the Access policy associated with the target and add that username to the Access policy. An administrator should have created an Access policy in [substep 9 of step 5: Add an infrastructure application](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#5-add-an-infrastructure-application). If the username is shown, that means the Access policy should be granting access and you should ensure that the tunnel is healthy in [step 2](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#2-check-target-machine-connection). - If the target does not appear in the list, an administrator must audit the Access policies for the target in the Zero Trust dashboard for potential misconfiguration that may be blocking connection. @@ -238,7 +238,7 @@ You will need Cloudflare dashboard access and log view [permissions](/cloudflare 3. Review the **Decision**. If the **Decision** is `Access denied`, select the application and copy the name under App. - If the decision is `Access granted`, Access policies are not interfering with your connection attempts and your connection issue is due to the Cloudflare Tunnel ([step 2](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#2-check-target-machine-connection)), the SSH server ([step 3](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#3-confirm-user-existence-on-the-target-server)), or the `sshd_config` file ([step 4](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#4-debug-sshd_config-file-misconfiguration)). + If the decision is `Access granted`, Access policies are not interfering with your connection attempts and your connection issue is due to the Cloudflare Tunnel ([step 2](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#2-check-target-machine-connection)), the SSH server ([step 3](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#3-confirm-user-existence-on-the-target-server)), or the `sshd_config` file ([step 4](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#4-debug-sshd_config-file-misconfiguration)). 4. Go to **Access** > **Applications**. @@ -265,11 +265,11 @@ To check the status of your tunnel: 3. Copy the tunnel name. 4. Go to **Networks** > **Tunnels** and search by your tunnel name. -5. Review that the [Tunnel status](/cloudflare-one/connections/connect-networks/monitor-tunnels/notifications/#available-notifications) says `Active`, and not `Down`, `Degraded`, or `Inactive`. +5. Review that the [Tunnel status](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/notifications/#available-notifications) says `Active`, and not `Down`, `Degraded`, or `Inactive`. -For detailed steps on troubleshooting, refer to the [Troubleshooting Tunnel documentation](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/). Review the [Tunnel with Firewall documentation](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-with-firewall/#test-connectivity) to ensure your network is correctly configured to allow `cloudflared` connections. +For detailed steps on troubleshooting, refer to the [Troubleshooting Tunnel documentation](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/). Review the [Tunnel with Firewall documentation](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/#test-connectivity) to ensure your network is correctly configured to allow `cloudflared` connections. After you have verified that there are no issues with your tunnel's health, confirm the user's existence on the server in the following step. @@ -468,4 +468,4 @@ These troubleshooting steps could result in you being locked out of your SSH ser -By completing all four troubleshooting steps, you should have resolved any connection issues caused by misconfiguration of the SSH server. If issues persist, [recheck `sshd` logs](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#review-your-sshd-logs). The example [`sshd_config` shared above](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#review-your-sshd_config-file-for-misconfigurations) enables debug logging and may expose more specific issues. \ No newline at end of file +By completing all four troubleshooting steps, you should have resolved any connection issues caused by misconfiguration of the SSH server. If issues persist, [recheck `sshd` logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#review-your-sshd-logs). The example [`sshd_config` shared above](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#review-your-sshd_config-file-for-misconfigurations) enables debug logging and may expose more specific issues. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel.mdx similarity index 81% rename from src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx rename to src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel.mdx index c1c633eb70b4e4..d9a492dba0809d 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-warp-to-tunnel.mdx @@ -8,11 +8,11 @@ sidebar: import { Render } from "~/components"; -If you want to manage your own SSH keys, you can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare's global network. This requires running the `cloudflared` daemon on the server (or any other host machine within the private network). Users with SSH keys that are trusted by the SSH server can access the server by installing the [Cloudflare WARP client](/cloudflare-one/connections/connect-devices/warp/) on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can SSH to the server unless you build policies to allow or block specific users. +If you want to manage your own SSH keys, you can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare's global network. This requires running the `cloudflared` daemon on the server (or any other host machine within the private network). Users with SSH keys that are trusted by the SSH server can access the server by installing the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/) on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can SSH to the server unless you build policies to allow or block specific users. :::note -If you want to create more granular access policies, allow Cloudflare to manage SSH keys for you, or to obtain command logs, consider using [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) instead. +If you want to create more granular access policies, allow Cloudflare to manage SSH keys for you, or to obtain command logs, consider using [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) instead. ::: This example walks through how to set up an SSH server on a Google Cloud Platform (GCP) virtual machine (VM), but you can use any machine that supports SSH connections. @@ -63,7 +63,7 @@ In order to be able to establish an SSH connection, do not enable [OS Login](htt 3. In the **CIDR** tab for the tunnel, enter the private IP or CIDR address of your server. In GCP, the server IP is the **Internal IP** of the VM instance. -4. (Optional) [Set up Zero Trust policies](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server. +4. (Optional) [Set up Zero Trust policies](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#4-recommended-filter-network-traffic-with-gateway) to fine-tune access to your server. ## 4. Set up the client diff --git a/src/content/docs/cloudflare-one/networks/connectors/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/index.mdx new file mode 100644 index 00000000000000..de06470cd10751 --- /dev/null +++ b/src/content/docs/cloudflare-one/networks/connectors/index.mdx @@ -0,0 +1,13 @@ +--- +pcx_content_type: navigation +title: Connectors +sidebar: + order: 1 + group: + hideIndex: true +--- + +import { DirectoryListing } from "~/components" + + + diff --git a/src/content/docs/cloudflare-one/connections/index.mdx b/src/content/docs/cloudflare-one/networks/index.mdx similarity index 55% rename from src/content/docs/cloudflare-one/connections/index.mdx rename to src/content/docs/cloudflare-one/networks/index.mdx index 1133fabfc0a623..f8977932a6f4cf 100644 --- a/src/content/docs/cloudflare-one/connections/index.mdx +++ b/src/content/docs/cloudflare-one/networks/index.mdx @@ -1,13 +1,14 @@ --- pcx_content_type: navigation -title: Connections +title: Networks sidebar: order: 5 - + group: + hideIndex: true --- import { DirectoryListing } from "~/components" -Learn how you can connect your applications, devices, and networks to Cloudflare. +Learn how to connect your private networks to Cloudflare. diff --git a/src/content/docs/cloudflare-one/policies/access/index.mdx b/src/content/docs/cloudflare-one/policies/access/index.mdx index ba7fbe56dc93a4..0f68a3407b7db3 100644 --- a/src/content/docs/cloudflare-one/policies/access/index.mdx +++ b/src/content/docs/cloudflare-one/policies/access/index.mdx @@ -71,7 +71,7 @@ For example, some applications have an endpoint under the `/admin` route that mu | ------ | --------- | -------- | ---------- | | Bypass | Include | Everyone | `Everyone` | -As part of implementing a Zero Trust security model, Cloudflare does not recommend using Bypass to grant direct permanent access to your internal applications. To enable seamless and secure access for on-network employees, use Cloudflare Tunnel to [connect your private network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/) and have users connect through WARP. +As part of implementing a Zero Trust security model, Cloudflare does not recommend using Bypass to grant direct permanent access to your internal applications. To enable seamless and secure access for on-network employees, use Cloudflare Tunnel to [connect your private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) and have users connect through WARP. :::note @@ -154,7 +154,7 @@ Non-identity attributes are polled continuously, meaning they are-evaluated with | OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/identity/idp-integration/generic-oidc/) identity provider. | ✅ | ❌ | ✅ | | Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ | | Warp | Checks that the device is connected to WARP, including the consumer version. | ✅ | ✅ | ❌ | -| Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/connections/connect-devices/warp/). | ✅ | ✅ | ❌ | +| Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). | ✅ | ✅ | ❌ | 1 For SaaS applications, Access can only enforce policies at the time of initial sign on and when reissuing the SaaS session. Once the user has diff --git a/src/content/docs/cloudflare-one/policies/browser-isolation/index.mdx b/src/content/docs/cloudflare-one/policies/browser-isolation/index.mdx index 3ec71a27477807..b6ea7bef4d5ce4 100644 --- a/src/content/docs/cloudflare-one/policies/browser-isolation/index.mdx +++ b/src/content/docs/cloudflare-one/policies/browser-isolation/index.mdx @@ -7,7 +7,7 @@ sidebar: import { Render } from "~/components"; -Cloudflare Browser Isolation complements the [Secure Web Gateway](/cloudflare-one/policies/gateway/) and [Zero Trust Network Access](/cloudflare-one/connections/connect-networks/) solutions by executing active webpage content in a secure isolated browser. Executing active content remotely from the endpoint protects users from zero-day attacks and malware. In addition to protecting endpoints, Browser Isolation also protects users from phishing attacks by preventing user input on risky websites and controlling data transmission to sensitive web applications. You can further filter isolated traffic with Gateway [HTTP](/cloudflare-one/policies/gateway/http-policies/) and [DNS](/cloudflare-one/policies/gateway/dns-policies/) policies. +Cloudflare Browser Isolation complements the [Secure Web Gateway](/cloudflare-one/policies/gateway/) and [Zero Trust Network Access](/cloudflare-one/networks/connectors/cloudflare-tunnel/) solutions by executing active webpage content in a secure isolated browser. Executing active content remotely from the endpoint protects users from zero-day attacks and malware. In addition to protecting endpoints, Browser Isolation also protects users from phishing attacks by preventing user input on risky websites and controlling data transmission to sensitive web applications. You can further filter isolated traffic with Gateway [HTTP](/cloudflare-one/policies/gateway/http-policies/) and [DNS](/cloudflare-one/policies/gateway/dns-policies/) policies. Remote browsing is invisible to the user who continues to use their browser normally without changing their preferred browser and habits. Every open tab and window is automatically isolated. When the user closes the isolated browser, their session is automatically deleted. @@ -17,4 +17,4 @@ Available as an add-on to Zero Trust Pay-as-you-go and Enterprise plans. ## Privacy -Cloudflare Browser Isolation is a security product. In order to serve transparent isolated browsing and block web based threats our network decrypts Internet traffic using the [Cloudflare root CA](/cloudflare-one/connections/connect-devices/user-side-certificates/). Traffic logs are retained as per the [Zero Trust](/cloudflare-one/insights/logs/) documentation. +Cloudflare Browser Isolation is a security product. In order to serve transparent isolated browsing and block web based threats our network decrypts Internet traffic using the [Cloudflare root CA](/cloudflare-one/team-and-resources/devices/user-side-certificates/). Traffic logs are retained as per the [Zero Trust](/cloudflare-one/insights/logs/) documentation. diff --git a/src/content/docs/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation.mdx b/src/content/docs/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation.mdx index cba14f2a0db56e..5dc6479adcc1ad 100644 --- a/src/content/docs/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation.mdx +++ b/src/content/docs/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation.mdx @@ -81,7 +81,7 @@ Clientless Web Isolation can function without TLS decryption enabled. However, T ### Connect private networks -With Clientless Web Isolation, users can reach any internal web server you have connected through [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/). For more information, refer to [Connect private networks](/cloudflare-one/connections/connect-networks/private-net/cloudflared/). +With Clientless Web Isolation, users can reach any internal web server you have connected through [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/). For more information, refer to [Connect private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/). For example, if you added `192.168.2.1` to your tunnel, users can connect to your application through the remote browser by going to `https://.cloudflareaccess.com/browser/http://192.168.2.1`. Clientless Web Isolation also supports connecting over private ports, for example `https://.cloudflareaccess.com/browser/http://192.168.2.1:7148`. diff --git a/src/content/docs/cloudflare-one/policies/browser-isolation/setup/index.mdx b/src/content/docs/cloudflare-one/policies/browser-isolation/setup/index.mdx index 1834b9d9438514..6405087c7687a8 100644 --- a/src/content/docs/cloudflare-one/policies/browser-isolation/setup/index.mdx +++ b/src/content/docs/cloudflare-one/policies/browser-isolation/setup/index.mdx @@ -62,5 +62,5 @@ Users can see if a webpage is isolated by using one of the following methods: #### Disconnect Browser Isolation -WARP users can temporarily disable remote browsing by [disconnecting the WARP client](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch). +WARP users can temporarily disable remote browsing by [disconnecting the WARP client](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#lock-warp-switch). Once WARP is disconnected, a refresh will return the non-isolated page. diff --git a/src/content/docs/cloudflare-one/policies/browser-isolation/setup/non-identity.mdx b/src/content/docs/cloudflare-one/policies/browser-isolation/setup/non-identity.mdx index 4a6f0fb696890b..f1dec193c94cd0 100644 --- a/src/content/docs/cloudflare-one/policies/browser-isolation/setup/non-identity.mdx +++ b/src/content/docs/cloudflare-one/policies/browser-isolation/setup/non-identity.mdx @@ -5,18 +5,18 @@ sidebar: order: 5 --- -With Cloudflare Zero Trust, you can isolate HTTP traffic from on-ramps such as [proxy endpoints](/cloudflare-one/connections/connect-devices/agentless/pac-files/) or [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/). Since these on-ramps do not require users to log in to Cloudflare WARP, [identity-based policies](/cloudflare-one/policies/gateway/identity-selectors/) are not supported. +With Cloudflare Zero Trust, you can isolate HTTP traffic from on-ramps such as [proxy endpoints](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) or [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/). Since these on-ramps do not require users to log in to Cloudflare WARP, [identity-based policies](/cloudflare-one/policies/gateway/identity-selectors/) are not supported. :::note -If you want to apply Isolate policies based on user identity, you will need to either install the [WARP client](/cloudflare-one/connections/connect-devices/warp/) or manually redirect users to the [Clientless Web Isolation](/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/) URL. +If you want to apply Isolate policies based on user identity, you will need to either install the [WARP client](/cloudflare-one/team-and-resources/devices/warp/) or manually redirect users to the [Clientless Web Isolation](/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/) URL. ::: ## Set up non-identity browser isolation -1. [Install a Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on your devices. +1. [Install a Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your devices. 2. Connect your infrastructure to Gateway using one of the following on-ramps: - - Configure your browser to forward traffic to a Gateway proxy endpoint with [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/). + - Configure your browser to forward traffic to a Gateway proxy endpoint with [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/). - Connect your enterprise site router to Gateway with the [anycast GRE or IPsec tunnel on-ramp to Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/). 3. Enable non-identity browser isolation: 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Browser Isolation**. diff --git a/src/content/docs/cloudflare-one/policies/data-loss-prevention/index.mdx b/src/content/docs/cloudflare-one/policies/data-loss-prevention/index.mdx index 06b717980db70c..8ef2474a4172f9 100644 --- a/src/content/docs/cloudflare-one/policies/data-loss-prevention/index.mdx +++ b/src/content/docs/cloudflare-one/policies/data-loss-prevention/index.mdx @@ -30,7 +30,7 @@ To get started, refer to [Scan HTTP traffic with DLP](/cloudflare-one/policies/d ## Data at rest -Data Loss Prevention complements [Cloudflare CASB](/cloudflare-one/applications/casb/) to detect sensitive data stored in your SaaS applications. Unlike data in transit scans which read files sent through Cloudflare Gateway, CASB retrieves files directly via the API. Therefore, Gateway and WARP settings (such as [Do Not Inspect](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect) policies and [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) configurations) will not affect data at rest scans. +Data Loss Prevention complements [Cloudflare CASB](/cloudflare-one/applications/casb/) to detect sensitive data stored in your SaaS applications. Unlike data in transit scans which read files sent through Cloudflare Gateway, CASB retrieves files directly via the API. Therefore, Gateway and WARP settings (such as [Do Not Inspect](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect) policies and [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) configurations) will not affect data at rest scans. To get started, refer to [Scan SaaS applications with DLP](/cloudflare-one/applications/casb/casb-dlp/). diff --git a/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx b/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx index b70d28929bb35c..75bcd0e88fa740 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx @@ -89,7 +89,7 @@ Gateway automatically groups applications incompatible with TLS decryption into When managing applications with the [Application Library](/cloudflare-one/applications/app-library/), Do Not Inspect applications will appear under the corresponding application. For example, the App Library will group _Google Drive (Do Not Inspect)_ under **Google Drive**. :::note[Install Cloudflare certificate manually to allow TLS decryption] -Instead of creating a Do Not Inspect policy for an application, you may be able to configure the application to [trust a Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications). Doing so will allow the application to function without losing visibility into your traffic. +Instead of creating a Do Not Inspect policy for an application, you may be able to configure the application to [trust a Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications). Doing so will allow the application to function without losing visibility into your traffic. ::: #### TLS decryption limitations diff --git a/src/content/docs/cloudflare-one/policies/gateway/block-page.mdx b/src/content/docs/cloudflare-one/policies/gateway/block-page.mdx index 66979c68c89493..1a07c63700f436 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/block-page.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/block-page.mdx @@ -11,7 +11,7 @@ When Gateway blocks traffic with a [DNS](/cloudflare-one/policies/gateway/dns-po ## Prerequisites -In order to display the block page as the URL of the blocked domain, your organization's devices must have a [Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/) installed. Enterprise users can also [deploy their own root CA certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/). If you do not install a certificate, the block page [will not display correctly](#certificate-error). +In order to display the block page as the URL of the blocked domain, your organization's devices must have a [Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) installed. Enterprise users can also [deploy their own root CA certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/). If you do not install a certificate, the block page [will not display correctly](#certificate-error). ## Configure the block page @@ -118,7 +118,7 @@ To turn on the block page or override your global block page setting for an indi ### Certificate error -If your users receive a security risk warning in their browser when visiting a blocked page, check that you have correctly [installed a certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/) on their devices. If a certificate is not installed or the installed certificate is invalid or expired, your user's browser may: +If your users receive a security risk warning in their browser when visiting a blocked page, check that you have correctly [installed a certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) on their devices. If a certificate is not installed or the installed certificate is invalid or expired, your user's browser may: - Display an **HTTP Response Code: 526** error page, indicating an insecure upstream. - Close the connection and fail to display any pages. diff --git a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx index cd8505a5d96903..541962f070c1d7 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx @@ -482,4 +482,4 @@ Use this selector to filter based on the country where the query arrived to Gate ### Magic WAN forwarding -To apply DNS policies to queries forwarded through [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/), you can either point your organization's DNS resolver to an IPv6, DoH, or DoT endpoint or request a dedicated resolver IPv4 address. For more information, refer to [DNS resolver IPs and hostnames](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/). +To apply DNS policies to queries forwarded through [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/), you can either point your organization's DNS resolver to an IPv6, DoH, or DoT endpoint or request a dedicated resolver IPv4 address. For more information, refer to [DNS resolver IPs and hostnames](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/). diff --git a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/test-dns-filtering.mdx b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/test-dns-filtering.mdx index 4c19abfd5ab759..e0041a7d2f18f5 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/test-dns-filtering.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/test-dns-filtering.mdx @@ -11,7 +11,7 @@ This section covers how to validate your Gateway DNS configuration. ## Prerequisites -Before you start, make sure you are connected to a network that is associated with the [DNS location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) where the policy is applied. +Before you start, make sure you are connected to a network that is associated with the [DNS location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) where the policy is applied. ## Test a DNS policy @@ -115,7 +115,7 @@ Once you have configured your Gateway policy to block the category, the test dom ## Test EDNS configuration -If you [enabled EDNS client subnet](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) for your DNS location, you can validate EDNS as follows: +If you [enabled EDNS client subnet](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) for your DNS location, you can validate EDNS as follows: 1. Obtain your DNS location's DOH subdomain: diff --git a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips.mdx b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips.mdx index 0d7133f4ca410f..be97a31905e610 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips.mdx @@ -150,7 +150,7 @@ No, egress IPs are limited to a single data center. No, traffic will only egress from the data center where the egress IP is provisioned. If you have users in locations far apart, we recommend reserving multiple egress IPs across different data centers and provisioning your users to their closest data centers. -### Can I use dedicated egress IPs with traffic proxied via [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/)? +### Can I use dedicated egress IPs with traffic proxied via [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/)? Yes, your users will egress via their provisioned IP address. diff --git a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared.mdx b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared.mdx index 2f67a3a69a4dda..42faf2f65dd774 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/egress-cloudflared.mdx @@ -49,7 +49,7 @@ User traffic is on-ramped to Gateway using one of the following methods: ## 1. Connect your private network -[Connect your private network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/) to Cloudflare using `cloudflared`. For example, if you want traffic to egress from AWS, connect the private CIDR block of your AWS VPC. +[Connect your private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/) to Cloudflare using `cloudflared`. For example, if you want traffic to egress from AWS, connect the private CIDR block of your AWS VPC. ::::note Requires `cloudflared` version 2025.7.0 or later. @@ -71,7 +71,7 @@ To route a public hostname through Cloudflare Tunnel: ## 3. Route network traffic through WARP -In your WARP [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) configuration, route the following IP addresses through the WARP tunnel to Gateway. +In your WARP [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) configuration, route the following IP addresses through the WARP tunnel to Gateway. ### Initial resolved IPs @@ -88,7 +88,7 @@ To route initial resolved IPs through WARP: ### Private network IPs -Your private network's CIDR block should also route through the WARP tunnel. For a detailed configuration example, refer to [Connect a private network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp). +Your private network's CIDR block should also route through the WARP tunnel. For a detailed configuration example, refer to [Connect a private network](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp). ## 4. (Optional) Configure network policies @@ -109,4 +109,4 @@ Gateway does not currently support hostname-based filtering for traffic on non-` From a WARP device, open a browser and go to `app.bank.com`. -You can search for `app.bank.com` in your [Gateway DNS logs](/cloudflare-one/insights/logs/gateway-logs/); the **DNS response details** section should show the public resolved IPs as well as an initial resolved IP. You can also check your [Cloudflare Tunnel logs](/cloudflare-one/connections/connect-networks/monitor-tunnels/logs/) to confirm that requests are routing through the tunnel to the public resolved IPs. \ No newline at end of file +You can search for `app.bank.com` in your [Gateway DNS logs](/cloudflare-one/insights/logs/gateway-logs/); the **DNS response details** section should show the public resolved IPs as well as an initial resolved IP. You can also check your [Cloudflare Tunnel logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) to confirm that requests are routing through the tunnel to the public resolved IPs. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/host-selectors.mdx b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/host-selectors.mdx index 9f923a681c63b8..6f5d54774a4dfa 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/host-selectors.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/host-selectors.mdx @@ -9,7 +9,7 @@ import { Tabs, TabItem, Details, APIRequest } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Gateway with WARP | Enterprise | @@ -63,10 +63,10 @@ Traffic must be on-ramped to Gateway with the following methods: | On-ramp method | Compatibility | | ------------------------------------------------------------------------------------------ | ------------- | -| [WARP](/cloudflare-one/connections/connect-devices/warp/) | ✅ | -| [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/) | ✅ | +| [WARP](/cloudflare-one/team-and-resources/devices/warp/) | ✅ | +| [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) | ✅ | | [Browser Isolation](/cloudflare-one/policies/browser-isolation/) | ✅ | -| [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) | ❌ | +| [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) | ❌ | | [Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) | ❌ | Unsupported traffic will be resolved with your default Gateway settings. If you use DNS locations to send a DNS query to Gateway with IPv4, IPv6, DoT, or DoH, Gateway will not return the initial resolved IP for supported traffic nor resolve unsupported traffic. @@ -79,7 +79,7 @@ Gateway will overwrite the DNS response for all supported traffic, even if you u To configure your Zero Trust organization to use Host selectors with Egress policies: -1. Ensure you have deployed [WARP version 2025.4.929.0](/cloudflare-one/connections/connect-devices/warp/download-warp/) or later on your users' desktop devices. If you need to apply your policies to mobile devices or devices running a version of WARP prior to 2025.4.929.0, add and deploy the following key-value pair to your devices' [WARP configuration file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) (`mdm.xml` on Windows and Linux or `com.cloudflare.warp.plist` on macOS): +1. Ensure you have deployed [WARP version 2025.4.929.0](/cloudflare-one/team-and-resources/devices/warp/download-warp/) or later on your users' desktop devices. If you need to apply your policies to mobile devices or devices running a version of WARP prior to 2025.4.929.0, add and deploy the following key-value pair to your devices' [WARP configuration file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) (`mdm.xml` on Windows and Linux or `com.cloudflare.warp.plist` on macOS): ```diff lang="xml" @@ -92,11 +92,11 @@ To configure your Zero Trust organization to use Host selectors with Egress poli {/* prettier-ignore-start */} -2. In your WARP [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/), configure your [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) depending on the mode: +2. In your WARP [device profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/), configure your [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) depending on the mode: - 1. [Remove the route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel exclude list. - 2. [Add routes](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses: + 1. [Remove the route](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#remove-a-route) to the IP address `100.64.0.0/10` from your Split Tunnel exclude list. + 2. [Add routes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to exclude the following IP addresses: - `100.64.0.0/12` - `100.81.0.0/16` - `100.82.0.0/15` @@ -105,8 +105,8 @@ To configure your Zero Trust organization to use Host selectors with Egress poli - `100.96.0.0/11` - 1. Add the required [Zero Trust domains](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains) or [IP addresses](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-ip-addresses) to your Split Tunnel include list. - 2. [Add a route](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to include the IP address `100.80.0.0/16`. + 1. Add the required [Zero Trust domains](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains) or [IP addresses](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-ip-addresses) to your Split Tunnel include list. + 2. [Add a route](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route) to include the IP address `100.80.0.0/16`. diff --git a/src/content/docs/cloudflare-one/policies/gateway/global-policies.mdx b/src/content/docs/cloudflare-one/policies/gateway/global-policies.mdx index 843499b8ad8c45..5bf248fee5a919 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/global-policies.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/global-policies.mdx @@ -58,7 +58,7 @@ Gateway enforces global DNS and resolver policies before any other policies. Thi | --------------------------------------------------- | -------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------- | | Allow CF Network Error Logging L4 | `00000001-e4af-4b82-8f8c-c79c1d5d212e` | Hostname | `*.nel.cloudflare.com` | allow | Allows SNI domains for WARP registration. | | Allow CF Client | `00000001-8c3d-4e27-a01b-af8418000077` | Hostname | `*.cloudflareclient.com` and `*.fed.cloudflareclient.com` | allow | Allows Zero Trust client. | -| Allow Gateway Proxy PAC | `00000001-776e-438d-9856-987d7053762b` | Hostname | `*.cloudflare-gateway.com` and `*.fed.cloudflare-gateway.com` | allow | Allows Gateway proxy with [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/). | +| Allow Gateway Proxy PAC | `00000001-776e-438d-9856-987d7053762b` | Hostname | `*.cloudflare-gateway.com` and `*.fed.cloudflare-gateway.com` | allow | Allows Gateway proxy with [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/). | | Allow Zero Trust Services | `00000001-e1e8-421b-a0fe-895397489f28` | Hostname | `dash.teams.cloudflare.com`, `help.teams.cloudflare.com`, `blocked.teams.cloudflare.com`, `blocked.teams.fed.cloudflare.com`, `api.cloudflare.com`, `api.fed.cloudflare.com`, `cloudflarestatus.com`, `www.cloudflarestatus.com`, `one.dash.cloudflare.com`, `one.dash.fed.cloudflare.com`, `help.one.cloudflare.com`, `dash.cloudflare.com`, `dash.fed.cloudflare.com`, and `developers.cloudflare.com` | allow | Allows Cloudflare Zero Trust services. | | Allow Access Apps L4 | `00000001-daa2-41e2-8a88-698af4066951` | Hostname | `*.cloudflareaccess.com` and `*.fed.cloudflareaccess.com` | allow | Allows [Cloudflare Access](/cloudflare-one/policies/access/) applications. | | Allow HTTP requests to browser-rendered Access Apps | `00000001-1f93-4476-8f92-9aa4407d1c5f` | Hostname | `*.zero-trust-apps.cfdata.org`, `*.zero-trust-apps-staging.cfdata.org`, `*.zero-trust-apps.fed.cfdata.org`, or `*.zero-trust-apps-staging.fed.cfdata.org` | allow | Allows Cloudflare Access terminal applications [rendered in a browser](/cloudflare-one/applications/non-http/browser-rendering/#ssh-and-vnc). | diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx index d50f43a9804326..86f1c87cd58c01 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx @@ -247,7 +247,7 @@ To get the UUIDs of your device posture checks, use the [List device posture rul ## Enforce session duration -[Require users to re-authenticate](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/) after a certain amount of time has elapsed. +[Require users to re-authenticate](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/) after a certain amount of time has elapsed. ## Isolate high risk sites in remote browser @@ -365,7 +365,7 @@ Block applications if their approval status is _Unapproved_. ## Block Google services -To enable Gateway inspection for Google Drive traffic, you must [add a Cloudflare certificate to Google Drive](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#google-drive). +To enable Gateway inspection for Google Drive traffic, you must [add a Cloudflare certificate to Google Drive](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#google-drive). ### Block Google Drive downloads diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/file-sandboxing.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/file-sandboxing.mdx index db65cf12905f8c..14f964a41cb647 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/file-sandboxing.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/file-sandboxing.mdx @@ -68,7 +68,7 @@ To test if file sandboxing is working, you can create a Quarantine policy that m | Host | is | `sandbox.cloudflaredemos.com` | Quarantine | 4. In **Sandbox file types**, select _ZIP Archive (zip)_. -5. From a device [connected to your Zero Trust organization](/cloudflare-one/connections/connect-devices/), open a browser and go to the [Cloudflare Sandbox Test](https://sandbox.cloudflaredemos.com/). +5. From a device [connected to your Zero Trust organization](/cloudflare-one/team-and-resources/devices/), open a browser and go to the [Cloudflare Sandbox Test](https://sandbox.cloudflaredemos.com/). 6. Select **Download Test File**. Gateway will quarantine and scan the file, display an interstitial status page in the browser, then release the file for download. diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/granular-controls.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/granular-controls.mdx index 2f8897295ef52e..e6c10217e8cde6 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/granular-controls.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/granular-controls.mdx @@ -13,7 +13,7 @@ With Application Granular Controls, you can create [Gateway HTTP policies](/clou To use Application Granular Controls, you must: -- Install a [Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) or a [custom certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/) on your users' devices. +- Install a [Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) or a [custom certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) on your users' devices. - Turn on [TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/). - Turn on the [Gateway proxy](/cloudflare-one/policies/gateway/proxy/#turn-on-the-gateway-proxy). - (Optional) If an application uses HTTP/3, turn on the [Gateway proxy for UDP traffic](/cloudflare-one/policies/gateway/http-policies/http3/#enable-http3-inspection). diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/http3.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/http3.mdx index 6db8c30a8367a2..21d95b484a1545 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/http3.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/http3.mdx @@ -7,7 +7,7 @@ sidebar: import { Details } from "~/components"; -Gateway supports inspection of HTTP/3 traffic, which uses the QUIC protocol over UDP. HTTP/3 inspection requires a [user-side certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) to be deployed and traffic to be proxied over UDP with [TLS version 1.3](/cloudflare-one/policies/gateway/http-policies/tls-decryption/). +Gateway supports inspection of HTTP/3 traffic, which uses the QUIC protocol over UDP. HTTP/3 inspection requires a [user-side certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) to be deployed and traffic to be proxied over UDP with [TLS version 1.3](/cloudflare-one/policies/gateway/http-policies/tls-decryption/). Gateway applies HTTP policies to HTTP/3 traffic last. For more information, refer to the [order of enforcement](/cloudflare-one/policies/gateway/order-of-enforcement/#http3-traffic). diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx index 6bf55eebd825e2..f3f4a7843dc92e 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx @@ -8,7 +8,7 @@ sidebar: import { Details, InlineBadge, Render } from "~/components"; :::note -To use HTTP policies, install a [Cloudflare root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) or a [custom certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/). +To use HTTP policies, install a [Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) or a [custom certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/). ::: HTTP policies allow you to intercept all HTTP and HTTPS requests and either block, allow, or override specific elements such as websites, IP addresses, and file types. HTTP policies operate on Layer 7 for all TCP (and [optionally UDP](/cloudflare-one/policies/gateway/initial-setup/http/#1-connect-to-gateway)) traffic sent over ports 80 and 443. @@ -455,7 +455,7 @@ When combining this selector with the [Download and Upload File Types selectors] ### Destination Continent :::note -Only applies to traffic sent through the [WARP client](/cloudflare-one/connections/connect-devices/warp/set-up-warp/#gateway-with-warp-default). +Only applies to traffic sent through the [WARP client](/cloudflare-one/team-and-resources/devices/warp/set-up-warp/#gateway-with-warp-default). ::: Zero Trust instance. -3. (Optional) If you want to display a [custom block page](/cloudflare-one/policies/gateway/block-page/), [install a Cloudflare root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on your device. +3. (Optional) If you want to display a [custom block page](/cloudflare-one/policies/gateway/block-page/), [install a Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your device. ### Connect DNS locations To filter DNS requests from a location such as an office or data center: -1. [Add the location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) to your Zero Trust settings. +1. [Add the location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) to your Zero Trust settings. 2. On your router, browser, or OS, forward DNS queries to the address shown in the location setup UI. :::note diff --git a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx index 6cf0accae566fa..768ec5e150bd0b 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx @@ -23,8 +23,8 @@ For a more detailed guide to filtering HTTP requests and other traffic for your To filter HTTP requests from a device: -1. [Install the Cloudflare root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on your device. -2. [Install the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) on your device. +1. [Install the Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your device. +2. [Install the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) on your device. 3. In the WARP client Settings, log in to your organization's Zero Trust instance. 4. [Enable the Gateway proxy](/cloudflare-one/policies/gateway/proxy/#turn-on-the-gateway-proxy) for TCP. Optionally, you can enable the UDP proxy to inspect all port 443 UDP traffic. 5. To inspect HTTPS traffic, [enable TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/#turn-on-tls-decryption). diff --git a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/network.mdx b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/network.mdx index 531a83fd6580bf..116e81eb953da1 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/network.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/network.mdx @@ -22,14 +22,14 @@ For a more detailed guide to filtering network traffic and more for your organiz To filter network traffic from a device such as a laptop or phone: -1. [Install the WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) on your device. +1. [Install the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) on your device. 2. In the WARP client Settings, log in to your organization's Zero Trust instance. -3. (Optional) If you want to display a [custom block page](/cloudflare-one/policies/gateway/block-page/), [install the Cloudflare root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on your device . +3. (Optional) If you want to display a [custom block page](/cloudflare-one/policies/gateway/block-page/), [install the Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your device . 4. [Enable the Gateway proxy](/cloudflare-one/policies/gateway/proxy/#turn-on-the-gateway-proxy) for TCP. Optionally, you can enable the UDP proxy to inspect all port 443 UDP traffic. ### Connect private networks -To filter traffic from private networks, refer to the [Cloudflare Tunnel guide](/cloudflare-one/connections/connect-networks/). +To filter traffic from private networks, refer to the [Cloudflare Tunnel guide](/cloudflare-one/networks/connectors/cloudflare-tunnel/). ## 2. Verify device connectivity diff --git a/src/content/docs/cloudflare-one/policies/gateway/managed-service-providers.mdx b/src/content/docs/cloudflare-one/policies/gateway/managed-service-providers.mdx index 4b944890e76961..79c89086eb21aa 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/managed-service-providers.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/managed-service-providers.mdx @@ -28,8 +28,8 @@ The Gateway Tenant platform supports tiered and siloed account configurations. In a tiered account configuration, a top-level parent account enforces global security policies that apply to all of its child accounts. Child accounts can override or add policies as needed while still being managed by the parent account. MSPs can also configure child accounts independently from the parent account, including: - Configuring a [custom block page](/cloudflare-one/policies/gateway/block-page/) -- Generating or uploading [root certificates](/cloudflare-one/connections/connect-devices/user-side-certificates/) -- Mapping [DNS locations](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) +- Generating or uploading [root certificates](/cloudflare-one/team-and-resources/devices/user-side-certificates/) +- Mapping [DNS locations](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) - Creating [lists](/cloudflare-one/policies/gateway/lists/) Each child account is subject to the default Zero Trust [account limits](/cloudflare-one/account-limits/). diff --git a/src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx b/src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx index e3b23d64c6bd0f..51eb5ac0889cfa 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx @@ -89,7 +89,7 @@ Require devices to have certain software installed or other configuration attrib ## Enforce session duration -To require users to re-authenticate after a certain amount of time has elapsed, configure [WARP sessions](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). +To require users to re-authenticate after a certain amount of time has elapsed, configure [WARP sessions](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). ## Allow only approved traffic @@ -189,7 +189,7 @@ If your organization blocks traffic by default with a network policy and you wan ## Restrict access to private networks -Restrict access to resources which you have connected through [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/). +Restrict access to resources which you have connected through [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/). The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic. diff --git a/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx index 0ce456b9b90424..93e0d0c7db450a 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx @@ -10,7 +10,7 @@ sidebar: import { Details, InlineBadge, Render, Badge } from "~/components"; :::note -To enable this feature, download and deploy the [WARP client](/cloudflare-one/connections/connect-devices/warp/deployment/) on your devices. +To enable this feature, download and deploy the [WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) on your devices. ::: With Cloudflare Zero Trust, you can configure policies to control network-level traffic leaving your endpoints. Using network selectors like IP addresses and ports, your policies will control access to any network origin. Because Cloudflare Zero Trust [integrates with your identity provider](/cloudflare-one/identity/idp-integration/), it also gives you the ability to create identity-based network policies. This means you can now control access to non-HTTP resources on a per-user basis regardless of where they are or what device they access that resource from. @@ -121,7 +121,7 @@ API value: `audit_ssh`
:::caution -Gateway no longer supports the Audit SSH action for new policies. To log your SSH traffic, Cloudflare recommends deploying [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) for your SSH server and configuring [SSH command logs](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#ssh-command-logs). +Gateway no longer supports the Audit SSH action for new policies. To log your SSH traffic, Cloudflare recommends deploying [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) for your SSH server and configuring [SSH command logs](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#ssh-command-logs). ::: Policies with Audit SSH actions allow administrators to log SSH traffic. Gateway will detect SSH traffic over port `22`. For example, the following configuration logs SSH commands sent to a given IP address: diff --git a/src/content/docs/cloudflare-one/policies/gateway/network-policies/protocol-detection.mdx b/src/content/docs/cloudflare-one/policies/gateway/network-policies/protocol-detection.mdx index ece03325d5709e..31cde26849bf8e 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/network-policies/protocol-detection.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/network-policies/protocol-detection.mdx @@ -9,7 +9,7 @@ import { Badge, Render } from "~/components"; Gateway supports the detection, logging, and filtering of network protocols using packet attributes. -Protocol detection only applies to devices connected to Zero Trust via the WARP client in [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode. +Protocol detection only applies to devices connected to Zero Trust via the WARP client in [Gateway with WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode. ## Turn on protocol detection diff --git a/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx b/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx index 81b8c9026960e9..02a5ef9edf78ec 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx @@ -9,7 +9,7 @@ sidebar: import { Render } from "~/components"; :::note -Not recommended for new deployments. We recommend using [Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) to manage SSH sessions and log SSH commands. +Not recommended for new deployments. We recommend using [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) to manage SSH sessions and log SSH commands. ::: Cloudflare Zero Trust supports SSH proxying and command logging using Secure Web Gateway and the WARP client. @@ -18,8 +18,8 @@ You can create network policies to manage and monitor SSH access to your applica ## Prerequisites -- [Install the WARP client](/cloudflare-one/connections/connect-devices/warp/set-up-warp/) on end-user devices. -- [Install the Cloudflare root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on end-user devices. +- [Install the WARP client](/cloudflare-one/team-and-resources/devices/warp/set-up-warp/) on end-user devices. +- [Install the Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on end-user devices. ## 1. Ensure Unix usernames match user SSO identities @@ -65,7 +65,7 @@ cat /etc/ssh/sshd_config 3. Name the policy and specify the [Destination IP](/cloudflare-one/policies/gateway/network-policies/#destination-ip) for your origin server. - You can enter either a public or private IP. To use a private IP, refer to [Connect private networks](/cloudflare-one/connections/connect-networks/private-net/cloudflared/). + You can enter either a public or private IP. To use a private IP, refer to [Connect private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/). 4. Add any other conditions to your policy. If a user does not meet the criteria, they will be blocked by default. diff --git a/src/content/docs/cloudflare-one/policies/gateway/proxy.mdx b/src/content/docs/cloudflare-one/policies/gateway/proxy.mdx index 4622db3ab536c5..214ac1297350c3 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/proxy.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/proxy.mdx @@ -9,7 +9,7 @@ import { Badge, Tabs, TabItem, Render } from "~/components"; You can forward [HTTP](/cloudflare-one/policies/gateway/initial-setup/http/) and [network](/cloudflare-one/policies/gateway/initial-setup/network/) traffic to Gateway for logging and filtering. Gateway can proxy both outbound traffic and traffic directed to resources connected via a Cloudflare Tunnel, GRE tunnel, or IPsec tunnel. When a user connects to the Gateway proxy, Gateway will accept the connection and establish a new, separate connection to the origin server. -The Gateway proxy is required for filtering HTTP and network traffic via the WARP client in Gateway with WARP mode. To proxy HTTP traffic without deploying the WARP client, you can configure [PAC files](/cloudflare-one/connections/connect-devices/agentless/pac-files/) on your devices. +The Gateway proxy is required for filtering HTTP and network traffic via the WARP client in Gateway with WARP mode. To proxy HTTP traffic without deploying the WARP client, you can configure [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) on your devices. ## Proxy algorithm @@ -35,7 +35,7 @@ By default, TCP connection attempts will timeout after 30 seconds and idle conne ### UDP -The UDP proxy forwards UDP traffic such as VoIP, [internal DNS requests](/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns/), and thick client applications. +The UDP proxy forwards UDP traffic such as VoIP, [internal DNS requests](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/), and thick client applications. When the UDP proxy is enabled, Gateway will force all HTTP/3 traffic to HTTP/2 to allow inspection. Otherwise, HTTP/3 traffic will bypass inspection. For more information, refer to [HTTP/3 inspection](/cloudflare-one/policies/gateway/http-policies/http3/). diff --git a/src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx b/src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx index 032dc594d76f61..6bfdc3045548f6 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx @@ -50,7 +50,7 @@ To get started with resolving internal DNS queries with resolver policies, refer ### Local Domain Fallback -If your resolver is only reachable by a client device and not by Gateway via a Cloudflare tunnel, Magic WAN tunnel, or other public Internet connections, you should configure [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) for your device. If both Local Domain Fallback and resolver policies are configured for the same device, Cloudflare will apply your client-side Local Domain Fallback rules first. If you onboard DNS queries to Gateway with the WARP client and route them with resolver policies, the source IP of the queries will be the IP address assigned by the WARP client. +If your resolver is only reachable by a client device and not by Gateway via a Cloudflare tunnel, Magic WAN tunnel, or other public Internet connections, you should configure [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) for your device. If both Local Domain Fallback and resolver policies are configured for the same device, Cloudflare will apply your client-side Local Domain Fallback rules first. If you onboard DNS queries to Gateway with the WARP client and route them with resolver policies, the source IP of the queries will be the IP address assigned by the WARP client. @@ -62,9 +62,9 @@ You can protect your authoritative nameservers from DDoS attacks by enabling [DN ### Cloudflare Tunnel -You can configure connections to a private resolver connected to Cloudflare with [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/). To ensure `cloudflared` can route UDP traffic to your resolver, connect your tunnel via [QUIC](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#protocol). +You can configure connections to a private resolver connected to Cloudflare with [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/). To ensure `cloudflared` can route UDP traffic to your resolver, connect your tunnel via [QUIC](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/#protocol). -For more information on connecting a private DNS resolver to Cloudflare with Cloudflare Tunnel, refer to [Private DNS](/cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns/). +For more information on connecting a private DNS resolver to Cloudflare with Cloudflare Tunnel, refer to [Private DNS](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/). ### Magic WAN @@ -76,10 +76,10 @@ Resolver policies can route queries for resolution from the following DNS endpoi - IPv4 - IPv6 -- [DNS over HTTPS (DoH)](/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https/) -- [DNS over TLS (DoT)](/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-tls/) +- [DNS over HTTPS (DoH)](/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-https/) +- [DNS over TLS (DoT)](/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-tls/) - DNS queries generated by Cloudflare [Browser Isolation](/cloudflare-one/policies/browser-isolation/) and [Clientless Web Isolation](/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/) -- DNS queries generated by [proxy endpoints](/cloudflare-one/connections/connect-devices/agentless/pac-files/) +- DNS queries generated by [proxy endpoints](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) Gateway will filter, resolve, and log your queries regardless of endpoint. diff --git a/src/content/docs/cloudflare-one/roles-permissions.mdx b/src/content/docs/cloudflare-one/roles-permissions.mdx index 272bae618842b1..12bad3a6c62301 100644 --- a/src/content/docs/cloudflare-one/roles-permissions.mdx +++ b/src/content/docs/cloudflare-one/roles-permissions.mdx @@ -28,7 +28,7 @@ Only Super Administrators will be able to assign or remove the following roles f [^1]: The **Cloudflare Zero Trust** role grants administrator access to all Zero Trust products including Access, Gateway, WARP, Tunnel, Browser Isolation, CASB, DLP, DEX, and Email Security. -[^2]: Users with the **Cloudflare Zero Trust DNS Locations Write** role can view all DNS locations for an organization but can only create and edit [secure DNS locations](/cloudflare-one/connections/connect-devices/agentless/dns/locations/#secure-dns-locations). +[^2]: Users with the **Cloudflare Zero Trust DNS Locations Write** role can view all DNS locations for an organization but can only create and edit [secure DNS locations](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/#secure-dns-locations). ### Cloudflare Zero Trust PII diff --git a/src/content/docs/cloudflare-one/setup.mdx b/src/content/docs/cloudflare-one/setup.mdx index bd787f333b180f..0c5898a842b100 100644 --- a/src/content/docs/cloudflare-one/setup.mdx +++ b/src/content/docs/cloudflare-one/setup.mdx @@ -30,11 +30,11 @@ If you want to enable security features such as Browser Isolation, HTTP filterin 1. **Set up a login method.** Configure [One-time PIN](/cloudflare-one/identity/one-time-pin/) or connect a [third-party identity provider](/cloudflare-one/identity/idp-integration/) in Zero Trust. This is the login method your users will utilize when authenticating to add a new device to your Zero Trust setup. -2. **Next, define [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/)**. Create device enrollment rules to define which users in your organization should be able to connect devices to your organization's Zero Trust setup. As you create your rule, you will be asked to select which login method you would like users to authenticate with. +2. **Next, define [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/)**. Create device enrollment rules to define which users in your organization should be able to connect devices to your organization's Zero Trust setup. As you create your rule, you will be asked to select which login method you would like users to authenticate with. -3. **Install the [Cloudflare root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on your devices.** Advanced security features including HTTP traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all your devices, these steps will need to be performed on each new device that is to be subject to HTTP filtering. +3. **Install the [Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your devices.** Advanced security features including HTTP traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all your devices, these steps will need to be performed on each new device that is to be subject to HTTP filtering. -4. **[Download](/cloudflare-one/connections/connect-devices/warp/download-warp/) and deploy the WARP client to your devices**. Choose one of the [different ways](/cloudflare-one/connections/connect-devices/warp/deployment/) to deploy the WARP client, depending on what works best for your organization. +4. **[Download](/cloudflare-one/team-and-resources/devices/warp/download-warp/) and deploy the WARP client to your devices**. Choose one of the [different ways](/cloudflare-one/team-and-resources/devices/warp/deployment/) to deploy the WARP client, depending on what works best for your organization. 5. **Log in to your organization's Cloudflare Zero Trust instance from your devices**. On your device, go to the Settings section in the WARP client and insert your organization's team name. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-https.mdx similarity index 97% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-https.mdx index ebbaf101feb09a..07f6711bbb6139 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-https.mdx @@ -7,7 +7,7 @@ sidebar: import { Details, GlossaryTooltip, Render } from "~/components"; -With Cloudflare Gateway, you can filter DNS over HTTPS (DoH) requests by [DNS location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) or by user without needing to install the WARP client on your devices. +With Cloudflare Gateway, you can filter DNS over HTTPS (DoH) requests by [DNS location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) or by user without needing to install the WARP client on your devices. Location-based policies require that you send DNS requests to a [location-specific DoH endpoint](#filter-doh-requests-by-location), while identity-based policies require that requests include a [user-specific DoH token](#filter-doh-requests-by-user). @@ -29,7 +29,7 @@ Browsers can be configured to use any DNS over HTTPS (DoH) endpoint. If you choo -Your DNS queries will now be sent to Gateway for filtering. To filter these requests, build a DNS policy using the [**DNS Location**](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) selector. +Your DNS queries will now be sent to Gateway for filtering. To filter these requests, build a DNS policy using the [**DNS Location**](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) selector. ### Configure operating system for DoH diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-tls.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-tls.mdx similarity index 93% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-tls.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-tls.mdx index c365c19af18a78..ae01c53e94f1b1 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-tls.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-tls.mdx @@ -16,7 +16,7 @@ Cloudflare supports DoT on standard port `853` over TLS 1.2 and TLS 1.3 in compl Each Gateway DNS location has a unique DoT hostname. DNS locations and corresponding DoT hostnames have policies associated with them. 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **DNS locations**. -2. [Add a new location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/) or select an existing location from the list. +2. [Add a new location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) or select an existing location from the list. 3. Under **DoT endpoint**, copy the value in **DoT addresses**. The DoT hostname contains your unique location name. For example, if the DoT hostname is `9y65g5srsm.cloudflare-gateway.com`, the location name is `9y65g5srsm`. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/locations/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/locations/index.mdx similarity index 77% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/locations/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/locations/index.mdx index beb84f8776f1d1..c8870a56d8f6f2 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/locations/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/dns/locations/index.mdx @@ -21,13 +21,13 @@ You can now apply [DNS policies](/cloudflare-one/policies/gateway/dns-policies/) ### IPv4 and IPv6 DNS -Cloudflare will prefill the [**Source IPv4 Address**](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#source-ip) based on the network you are on. Additionally, Enterprise users can use [dedicated DNS resolver IP addresses](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#dns-resolver-ip) assigned to their account or [resolver IP addresses they provide (BYOIP)](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip). +Cloudflare will prefill the [**Source IPv4 Address**](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/#source-ip) based on the network you are on. Additionally, Enterprise users can use [dedicated DNS resolver IP addresses](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/#dns-resolver-ip) assigned to their account or [resolver IP addresses they provide (BYOIP)](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip). You do not need to configure the IPv4 DNS endpoint if: - Your network only uses IPv6. - Your users will send all DNS requests from this location using [DNS over HTTPS](#dns-over-https-doh) via a browser. -- You will deploy the [WARP client](/cloudflare-one/connections/connect-devices/warp/). +- You will deploy the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). :::note[Your IPv4 address is taken error] When you try to configure a DNS location over IPv4, Gateway may display a **Your source IPv4 address is taken** error. This may mean someone else in the same network configured Gateway before you did. If your network supports IPv6, you can still use Gateway's DNS filtering by sending DNS queries over IPv6. You can also use the DNS over HTTPS hostname to send queries using a DNS over HTTPS client. @@ -39,19 +39,19 @@ If you think someone else is wrongfully using this IPv4 address, [contact Cloudf -For more information, refer to [DNS over TLS](/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-tls/). +For more information, refer to [DNS over TLS](/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-tls/). ### DNS over HTTPS (DoH) -Gateway requires a DoH endpoint for default DNS locations. For more information, refer to [DNS over HTTPS](/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https/). +Gateway requires a DoH endpoint for default DNS locations. For more information, refer to [DNS over HTTPS](/cloudflare-one/team-and-resources/devices/agentless/dns/dns-over-https/). ## Secure DNS locations Secure DNS locations provide additional protection against malicious domains for use in services such as [protective DNS (PDNS)](/reference-architecture/diagrams/sase/gateway-for-protective-dns/). For a DNS location to be considered secure, Gateway requires that: -- Your IPv4 and IPv6 endpoints use your [BYOIP addresses](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip) (if any). +- Your IPv4 and IPv6 endpoints use your [BYOIP addresses](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip) (if any). - [Source network filtering](/cloudflare-one/policies/gateway/network-policies/) is configured for your IPv4, IPv6, and DoT endpoints. - Source network filtering or token authentication are configured for your DoH endpoints. - Any enabled endpoints for a DNS location meet security permissions. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/index.mdx similarity index 82% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/index.mdx index 0d2f77d28efca5..a950db15a30527 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/index.mdx @@ -7,8 +7,8 @@ sidebar: If you are unable to install the WARP client on your devices (for example, Windows Server does not support the WARP client), you can use agentless options to enable a subset of Zero Trust features. -- **[Gateway DNS policies](/cloudflare-one/connections/connect-devices/agentless/dns/)** -- **[Gateway HTTP policies](/cloudflare-one/connections/connect-devices/agentless/pac-files/)** without user identity and device posture +- **[Gateway DNS policies](/cloudflare-one/team-and-resources/devices/agentless/dns/)** +- **[Gateway HTTP policies](/cloudflare-one/team-and-resources/devices/agentless/pac-files/)** without user identity and device posture - **[Access policies](/cloudflare-one/policies/access/)** without device posture for [web applications](/cloudflare-one/applications/configure-apps/) and for [browser-rendered](/cloudflare-one/applications/non-http/browser-rendering/) SSH, RDP, and VNC connections - **[Remote Browser Isolation](/cloudflare-one/policies/browser-isolation/)** via an [Access policy](/cloudflare-one/policies/access/isolate-application/), [prefixed URLs](/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/), or a [non-identity on-ramp](/cloudflare-one/policies/browser-isolation/setup/non-identity/) - **[Cloud Access Security Broker (CASB)](/cloudflare-one/applications/casb/)** diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/pac-files.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/pac-files.mdx similarity index 98% rename from src/content/docs/cloudflare-one/connections/connect-devices/agentless/pac-files.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/agentless/pac-files.mdx index 465e622f769c53..a86431558358e0 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/agentless/pac-files.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/agentless/pac-files.mdx @@ -25,7 +25,7 @@ When end users visit a website, their browser will send the request to a Cloudfl ## Prerequisites -Install a [Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) on your device. +Install a [Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your device. ## 1. Generate a proxy endpoint diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/index.mdx similarity index 91% rename from src/content/docs/cloudflare-one/connections/connect-devices/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/index.mdx index 3d12a4aff7aa03..e3feed0898cb44 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/index.mdx @@ -1,6 +1,6 @@ --- pcx_content_type: navigation -title: Connect devices +title: Devices sidebar: order: 4 --- diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment.mdx similarity index 70% rename from src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment.mdx index 121b61c6b1a197..29306e0dd09452 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment.mdx @@ -11,7 +11,7 @@ import { Details, Render } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -27,32 +27,32 @@ import { Details, Render } from "~/components"; * Only supported on Debian-based systems.
-The [WARP client](/cloudflare-one/connections/connect-devices/warp/) can automatically install a Cloudflare certificate or [custom root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/) on Windows, macOS, and Debian/Ubuntu Linux devices. On mobile devices and Red Hat-based systems, you will need to [install the certificate manually](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/). +The [WARP client](/cloudflare-one/team-and-resources/devices/warp/) can automatically install a Cloudflare certificate or [custom root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) on Windows, macOS, and Debian/Ubuntu Linux devices. On mobile devices and Red Hat-based systems, you will need to [install the certificate manually](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). The certificate is required if you want to [apply HTTP policies to encrypted websites](/cloudflare-one/policies/gateway/http-policies/tls-decryption/), display custom [block pages](/cloudflare-one/policies/gateway/block-page/), and more. ## Install a certificate using WARP :::caution[Out of date certificates] -WARP versions prior to 2024.12.554.0 will only install the certificate set to **In-Use** and automatically remove any other WARP-installed certificates from your users' devices. To ensure your users' devices have all of your available certificates installed, [update WARP](/cloudflare-one/connections/connect-devices/warp/download-warp/update-warp/#how-to-update-warp). +WARP versions prior to 2024.12.554.0 will only install the certificate set to **In-Use** and automatically remove any other WARP-installed certificates from your users' devices. To ensure your users' devices have all of your available certificates installed, [update WARP](/cloudflare-one/team-and-resources/devices/warp/download-warp/update-warp/#how-to-update-warp). ::: To configure WARP to install a root certificate on your organization's devices: -1. (Optional) [Upload](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/) a custom root certificate to Cloudflare. +1. (Optional) [Upload](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) a custom root certificate to Cloudflare. 2. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**. -3. Turn on [**Install CA to system certificate store**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#install-ca-to-system-certificate-store). -4. [Install](/cloudflare-one/connections/connect-devices/warp/download-warp/) the WARP client on the device. -5. [Enroll the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) in your Zero Trust organization. +3. Turn on [**Install CA to system certificate store**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#install-ca-to-system-certificate-store). +4. [Install](/cloudflare-one/team-and-resources/devices/warp/download-warp/) the WARP client on the device. +5. [Enroll the device](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) in your Zero Trust organization. 6. (Optional) If the device is running macOS Big Sur or newer, [manually trust the certificate](#manually-trust-the-certificate). -WARP will now download any [certificates set to **Available**](/cloudflare-one/connections/connect-devices/user-side-certificates/#activate-a-root-certificate). After download, WARP will add the certificates to the device's system certificate store in `installed_certs/.pem` and append the contents to the `installed_cert.pem` file. If you have any scripts using `installed_cert.pem`, Cloudflare recommends you set them to use the individual files in the `installed_certs/` directory instead. `installed_certs.pem` will be deprecated by 2025-06-31. +WARP will now download any [certificates set to **Available**](/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). After download, WARP will add the certificates to the device's system certificate store in `installed_certs/.pem` and append the contents to the `installed_cert.pem` file. If you have any scripts using `installed_cert.pem`, Cloudflare recommends you set them to use the individual files in the `installed_certs/` directory instead. `installed_certs.pem` will be deprecated by 2025-06-31. :::note ::: -WARP does not install certificates to individual applications. You will need to [manually add certificates](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications) to applications that rely on their own certificate store instead of the system certificate store. +WARP does not install certificates to individual applications. You will need to [manually add certificates](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications) to applications that rely on their own certificate store instead of the system certificate store. ## Access the installed certificate @@ -121,6 +121,6 @@ The WARP client will also place the certificate in `/var/lib/cloudflare-warp/ins ## Uninstall the certificate -If the certificate was installed by the WARP client, it is automatically removed when you turn on another certificate for inspection in Zero Trust, turn off **Install CA to system certificate store**, or [uninstall WARP](/cloudflare-one/connections/connect-devices/warp/remove-warp/). WARP does not remove certificates that were installed manually (for example, certificates added to third-party applications). +If the certificate was installed by the WARP client, it is automatically removed when you turn on another certificate for inspection in Zero Trust, turn off **Install CA to system certificate store**, or [uninstall WARP](/cloudflare-one/team-and-resources/devices/warp/remove-warp/). WARP does not remove certificates that were installed manually (for example, certificates added to third-party applications). To manually remove the certificate, refer to the instructions supplied by your operating system or the third-party application. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate.mdx similarity index 86% rename from src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate.mdx index 926ed6d906508b..45210c7e166891 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate.mdx @@ -14,7 +14,7 @@ import { Render, Tabs, TabItem, APIRequest } from "~/components"; Only available on Enterprise plans. ::: -Enterprise customers who do not wish to install a [Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/) have the option to upload their own root certificate to Cloudflare. This feature is sometimes referred to as Bring Your Own Public Key Infrastructure (BYOPKI). Gateway will use your uploaded certificate to encrypt all sessions between the end user and Gateway, enabling all HTTPS inspection features that previously required a Cloudflare certificate. You can upload multiple certificates to your account, but only one can be active at any given time. You also need to upload a private key to intercept domains with JIT certificates and to enable the [block page](/cloudflare-one/policies/gateway/block-page/). +Enterprise customers who do not wish to install a [Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) have the option to upload their own root certificate to Cloudflare. This feature is sometimes referred to as Bring Your Own Public Key Infrastructure (BYOPKI). Gateway will use your uploaded certificate to encrypt all sessions between the end user and Gateway, enabling all HTTPS inspection features that previously required a Cloudflare certificate. You can upload multiple certificates to your account, but only one can be active at any given time. You also need to upload a private key to intercept domains with JIT certificates and to enable the [block page](/cloudflare-one/policies/gateway/block-page/). You can upload up to five custom root certificates. If your organization requires more than five certificates, contact your account team. @@ -144,7 +144,7 @@ openssl x509 -in .pem -text } ``` -4. (Optional) Verify the certificate is installed on your user's devices either [with WARP](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/) or [manually](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/). +4. (Optional) Verify the certificate is installed on your user's devices either [with WARP](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) or [manually](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). 5. Use the [Patch Zero Trust account configuration endpoint](/api/resources/zero_trust/subresources/gateway/subresources/configurations/methods/edit/) to turn on the certificate for use in inspection. For example: @@ -173,7 +173,7 @@ When you upload a private key to Zero Trust, Cloudflare encrypts the key and sto ## Use a custom root certificate -To use a custom root certificate you generated and uploaded to Cloudflare, refer to [Activate a root certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/#activate-a-root-certificate). +To use a custom root certificate you generated and uploaded to Cloudflare, refer to [Activate a root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). ## Troubleshoot HTTP errors diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/index.mdx similarity index 95% rename from src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/index.mdx index 8479f1fd253fc0..eea98ef484297e 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/index.mdx @@ -9,7 +9,7 @@ import { Tabs, TabItem, APIRequest } from "~/components"; Advanced security features such as [HTTPS traffic inspection](/cloudflare-one/policies/gateway/http-policies/tls-decryption/), [Data Loss Prevention](/cloudflare-one/policies/data-loss-prevention/), [anti-virus scanning](/cloudflare-one/policies/gateway/http-policies/antivirus-scanning/), [Access for Infrastructure](/cloudflare-one/applications/non-http/infrastructure-apps/), and [Browser Isolation](/cloudflare-one/policies/browser-isolation/) require users to install and trust a root certificate on their device. You can either install the certificate provided by Cloudflare (default option), or generate your own custom certificate and upload it to Cloudflare. -Zero Trust [generates a unique root CA](#generate-a-cloudflare-root-certificate) for each account and deploys it across the Cloudflare global network. Alternatively, Enterprise users can upload and deploy their own [custom certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/). +Zero Trust [generates a unique root CA](#generate-a-cloudflare-root-certificate) for each account and deploys it across the Cloudflare global network. Alternatively, Enterprise users can upload and deploy their own [custom certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/). :::caution[Default certificate expired on 2025-02-02] The default Cloudflare certificate expired on 2025-02-02 at 16:05 UTC. @@ -86,7 +86,7 @@ Send a `POST` request to the [Activate a Zero Trust certificate](/api/resources/ -The status of the certificate will change to **Pending** while it deploys. Once the status of your certificate is **Available**, you can install it on your user's devices either [with WARP](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/) or [manually](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/). +The status of the certificate will change to **Pending** while it deploys. Once the status of your certificate is **Available**, you can install it on your user's devices either [with WARP](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) or [manually](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). Once you deploy and install your certificate, you can turn it on for use in inspection: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx similarity index 96% rename from src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx index 31a5abe24bf375..b073bad6b27f9f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx @@ -14,9 +14,9 @@ import { Details, Render, TabItem, Tabs } from "~/components"; This procedure is only required to enable specific Cloudflare Zero Trust features, and should only be done at the direction of your IT department. This procedure is not required to enable the WARP client for consumers. ::: -If your device does not support [certificate installation via WARP](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/), you can manually install a Cloudflare certificate. You must add the certificate to both the [system keychain](#add-the-certificate-to-operating-systems) and to [individual application stores](#add-the-certificate-to-applications). These steps must be performed on each new device that is to be subject to HTTP filtering. +If your device does not support [certificate installation via WARP](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/), you can manually install a Cloudflare certificate. You must add the certificate to both the [system keychain](#add-the-certificate-to-operating-systems) and to [individual application stores](#add-the-certificate-to-applications). These steps must be performed on each new device that is to be subject to HTTP filtering. -Zero Trust will only inspect traffic using installed certificates set to [**Available** and **In-Use**](/cloudflare-one/connections/connect-devices/user-side-certificates/#activate-a-root-certificate). +Zero Trust will only inspect traffic using installed certificates set to [**Available** and **In-Use**](/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). ## Download the Cloudflare root certificate @@ -24,14 +24,14 @@ Zero Trust will only inspect traffic using installed certificates set to [**Avai You can only download Cloudflare-generated certificates from the Zero Trust dashboard or with WARP. ::: -First, [generate](/cloudflare-one/connections/connect-devices/user-side-certificates/#generate-a-cloudflare-root-certificate) and download a Cloudflare certificate. The certificate is available in both `.pem` and `.crt` file format. Certain applications require the certificate to be in a specific file type, so ensure you download the most appropriate file for your use case. +First, [generate](/cloudflare-one/team-and-resources/devices/user-side-certificates/#generate-a-cloudflare-root-certificate) and download a Cloudflare certificate. The certificate is available in both `.pem` and `.crt` file format. Certain applications require the certificate to be in a specific file type, so ensure you download the most appropriate file for your use case. 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Resources**. 2. In **Certificates**, select **Manage**. 3. Select the certificate you want to download. 4. Depending on which format you want, choose **Download .pem** and/or **Download .crt**. -Alternatively, you can download and install a certificate [using WARP](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/#install-a-certificate-using-warp). WARP will add the certificates to the device's system certificate store in `installed_certs/.pem`. +Alternatively, you can download and install a certificate [using WARP](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/#install-a-certificate-using-warp). WARP will add the certificates to the device's system certificate store in `installed_certs/.pem`. ### Verify the downloaded certificate @@ -338,7 +338,7 @@ For information on installing a Cloudflare certificate for organizations, refer ### Mobile device management (MDM) software -Zero Trust integrates with several [mobile device management (MDM) software partners](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/) to deploy WARP across devices. +Zero Trust integrates with several [mobile device management (MDM) software partners](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/) to deploy WARP across devices. #### Microsoft Intune diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx similarity index 94% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx index c9b7af6b9851b2..ef4bad1e9ff82b 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx @@ -17,7 +17,7 @@ import { Render, TabItem, Tabs, APIRequest } from "~/components"; 2. In the **Profile settings** card, select **Create profile**. This will make a copy of the **Default** profile. 3. Enter any name for the profile. 4. Create rules to define the devices that will use this profile. Learn more about the available [Selectors](#selectors), [Operators](/cloudflare-one/policies/gateway/network-policies/#comparison-operators), and [Values](/cloudflare-one/policies/gateway/network-policies/#value). -5. Configure [WARP settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-settings) for these devices. +5. Configure [WARP settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-settings) for these devices. :::note @@ -134,7 +134,7 @@ The device profile UUID is shown in the `Profile ID` field. ## Selectors -You can configure device profiles to match against the following selectors, or criteria. Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP). +You can configure device profiles to match against the following selectors, or criteria. Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP). ### User email @@ -196,7 +196,7 @@ Apply a device profile based on the [OS version](/cloudflare-one/identity/device ### Managed network -Apply a device profile based on the [managed network](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/) that the device is connected to. +Apply a device profile based on the [managed network](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/) that the device is connected to. | UI name | API example | | --------------- | ------------------------------ | @@ -210,7 +210,7 @@ Apply a device profile based on an attribute name and value from a [SAML IdP](/c ### Service token -Apply a device profile based on the [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token) used to enroll the device. +Apply a device profile based on the [service token](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#check-for-service-token) used to enroll the device. | UI name | API example | | ------------- | ------------------------------------------------------------------------- | diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/index.mdx new file mode 100644 index 00000000000000..95e787f6a9a2cf --- /dev/null +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/index.mdx @@ -0,0 +1,18 @@ +--- +pcx_content_type: navigation +title: Configure WARP +sidebar: + order: 7 + +--- + +import { DirectoryListing } from "~/components" + +You can configure WARP client settings to work alongside existing infrastructure and provide users with differential access to resources. + +:::note[Managed deployments] + +If you are deploying [WARP with device management software](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/), we recommend only supplying `organization` in your [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) and managing all other settings via the dashboard. Any settings you configure on the dashboard will be overridden by the local policy deployed by your management software. To ensure dashboard settings are applied as intended, remove the corresponding parameters from your managed deployment configuration. +::: + + diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks.mdx similarity index 90% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks.mdx index b414b88a71b966..4b82bd4b7a8874 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks.mdx @@ -9,7 +9,7 @@ import { Details, Render, TabItem, Tabs } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -24,7 +24,7 @@ import { Details, Render, TabItem, Tabs } from "~/components";
-Cloudflare WARP allows you to selectively apply specific [device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) and WARP client settings when a device connects to a secure network location, such as an office. WARP identifies these managed networks by detecting a TLS endpoint you set up on the network. +Cloudflare WARP allows you to selectively apply specific [device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) and WARP client settings when a device connects to a secure network location, such as an office. WARP identifies these managed networks by detecting a TLS endpoint you set up on the network. On this page, you will learn how to: @@ -247,7 +247,7 @@ SHA256 Fingerprint=DD4F4806C57A5BBAF1AA5B080F0541DA75DB468D0A1FE731310149500CCD8 WARP will automatically exclude the TLS endpoint from all device profiles if it is specified as a private IP address. This exclusion prevents remote users from accessing the endpoint through the WARP tunnel on any port. If the TLS endpoint is specified as a hostname instead of a private IP, WARP will not automatically exclude it. -If a device profile uses [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) in **Include** mode, ensure that the Split Tunnel entries do not contain the TLS endpoint IP address; otherwise, the entire IP range will be excluded from the WARP tunnel. +If a device profile uses [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) in **Include** mode, ensure that the Split Tunnel entries do not contain the TLS endpoint IP address; otherwise, the entire IP range will be excluded from the WARP tunnel. ## 4. Configure device profile @@ -255,7 +255,7 @@ If a device profile uses [Split Tunnels](/cloudflare-one/connections/connect-dev 1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**. -2. Under **Profile settings**, create a new [settings profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) or edit an existing profile. +2. Under **Profile settings**, create a new [settings profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) or edit an existing profile. 3. To apply this profile whenever a device connects to your network, add the following rule: @@ -300,6 +300,6 @@ To check if the WARP client detects the network location: ## Related resources -- [Device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) - How to create and manage the device profiles you apply via managed networks. -- [WARP settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/) - Defines how WARP behaves and what users can do. -- [WARP troubleshooting guide](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/) - Troubleshoot common WARP issues. +- [Device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) - How to create and manage the device profiles you apply via managed networks. +- [WARP settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/) - Defines how WARP behaves and what users can do. +- [WARP troubleshooting guide](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/) - Troubleshoot common WARP issues. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/index.mdx similarity index 70% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/index.mdx index aee3ee96d4c004..9528bbb949fab1 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/index.mdx @@ -13,12 +13,12 @@ Cloudflare recommends Enterprise users configure [Gateway resolver policies](/cl Additionally, there are three options you can configure to exclude traffic from WARP: -- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/): Use Local Domain Fallback to instruct the WARP client to proxy DNS requests for a specified domain to a resolver that is not Cloudflare Gateway. This is useful when you have private hostnames that would not otherwise resolve on the public Internet. +- [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/): Use Local Domain Fallback to instruct the WARP client to proxy DNS requests for a specified domain to a resolver that is not Cloudflare Gateway. This is useful when you have private hostnames that would not otherwise resolve on the public Internet. :::caution Gateway will not encrypt, monitor, or apply DNS policies to DNS queries to domain names entered in Local Domain Fallback. ::: -- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude mode: Use Exclude mode to instruct the WARP client to ignore traffic to a specified set of IP addresses or domains. Any traffic that is destined to an IP address or domain defined in the Split Tunnels Exclude configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you want the majority of your traffic encrypted and processed by Gateway, but need to exclude certain routes due to app compatibility, or if you need WARP to run alongside a VPN. -- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Include mode: Use Include mode to instruct the WARP client to only handle traffic to a specified set of IP addresses or domains. Any traffic that is not included by an IP address or domain defined in the Split Tunnel Include configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you only want specific traffic processed by Gateway, such as when using Tunnels for a specific resource. +- [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude mode: Use Exclude mode to instruct the WARP client to ignore traffic to a specified set of IP addresses or domains. Any traffic that is destined to an IP address or domain defined in the Split Tunnels Exclude configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you want the majority of your traffic encrypted and processed by Gateway, but need to exclude certain routes due to app compatibility, or if you need WARP to run alongside a VPN. +- [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Include mode: Use Include mode to instruct the WARP client to only handle traffic to a specified set of IP addresses or domains. Any traffic that is not included by an IP address or domain defined in the Split Tunnel Include configuration will be ignored by the WARP client and handled by the local machine. Use this mode when you only want specific traffic processed by Gateway, such as when using Tunnels for a specific resource. :::caution Gateway will not encrypt, manage, or monitor traffic excluded from WARP by a Split Tunnel configuration. ::: @@ -60,13 +60,13 @@ flowchart TD #### Terms mentioned #### On-ramps (how traffic gets onto Cloudflare) - On-ramp -- [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/) -- [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) +- [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) +- [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) - [Magic WAN](/magic-wan/) #### Routing features (how queries are handled) -- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) -- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) +- [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) +- [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) - [Gateway Resolver Policies](/cloudflare-one/policies/gateway/resolver-policies/) #### Resolvers (where queries are resolved) diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains.mdx similarity index 78% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains.mdx index 15c8283620a740..c8d84ad9879601 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains.mdx @@ -35,15 +35,15 @@ On this page, you will see a list of domains excluded from Gateway. You can [add :::caution -Local Domain Fallback configuration only impacts where DNS requests get resolved, not the flow of traffic destined to those domains. If you want to prevent traffic from being sent to a specific domain or IP address, you must add those domains or IPs to your [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) configuration. +Local Domain Fallback configuration only impacts where DNS requests get resolved, not the flow of traffic destined to those domains. If you want to prevent traffic from being sent to a specific domain or IP address, you must add those domains or IPs to your [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) configuration. ::: To view the fallback domains applied to a device, you can: - In [Zero Trust](https://one.dash.cloudflare.com/), go to **My Team** > **Devices** > find the target device and the **Last active device profile** > follow the [steps above](#view-domains). -- (Desktop only) Run `warp-cli settings` in the terminal of the target device and review the [fallback domains](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#fallback-domains) section of the output. -- (Desktop only) Collect [WARP diagnostic logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for the device and review the [fallback domain](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#fallback-domains) section in `warp_settings.txt`. +- (Desktop only) Run `warp-cli settings` in the terminal of the target device and review the [fallback domains](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#fallback-domains) section of the output. +- (Desktop only) Collect [WARP diagnostic logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/) for the device and review the [fallback domain](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#fallback-domains) section in `warp_settings.txt`. ### Add a domain @@ -63,5 +63,5 @@ By default, Warp sends [reverse DNS queries](https://www.cloudflare.com/learning ## Related resources -- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) - Control which traffic goes through WARP by including or excluding specific IPs or domains. -- [WARP with firewall](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/) - Learn which IPs, domains, and ports to allow so users can deploy and connect WARP successfully behind a firewall. +- [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) - Control which traffic goes through WARP by including or excluding specific IPs or domains. +- [WARP with firewall](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/) - Learn which IPs, domains, and ports to allow so users can deploy and connect WARP successfully behind a firewall. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx similarity index 77% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx index e76961aa0f5b36..3f4bacc1514481 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx @@ -19,22 +19,22 @@ import { Render } from "~/components"; ### When to use Split Tunnels -Use Split Tunnels when you need to bypass Gateway entirely for a site or allow traffic through the [firewall that WARP creates](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall). Common scenarios include: +Use Split Tunnels when you need to bypass Gateway entirely for a site or allow traffic through the [firewall that WARP creates](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall). Common scenarios include: -- Connect to a third-party application which requires the actual IP address of the end-user device (for example, [Microsoft 365](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic)). +- Connect to a third-party application which requires the actual IP address of the end-user device (for example, [Microsoft 365](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic)). - Optimize voice and video. -- Connect to a [third-party VPN](/cloudflare-one/connections/connect-devices/warp/deployment/vpn/) endpoint. +- Connect to a [third-party VPN](/cloudflare-one/team-and-resources/devices/warp/deployment/vpn/) endpoint. ### When not to use Split Tunnels Do not exclude a site from Split Tunnels if you want to see the traffic in your Gateway logs. In particular, we do not recommend using Split Tunnels to: -- Solve connectivity issues with a specific website. For configuration guidance, refer to our [troubleshooting guide](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#cannot-connect-to-a-specific-app-or-website). +- Solve connectivity issues with a specific website. For configuration guidance, refer to our [troubleshooting guide](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/#cannot-connect-to-a-specific-app-or-website). - Solve performance issues with a specific website. Since Cloudflare operates within 50 milliseconds of 95% of the Internet-connected population, it is usually faster to send traffic through us. If you are encountering a performance-related issue, it is best to first explore your Gateway policies or reach out to Support. ## Routes for Split Tunnels Include mode -Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/identity/devices/) and [WARP session durations](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function. +Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/identity/devices/) and [WARP session durations](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function. ### Cloudflare Zero Trust domains @@ -49,14 +49,14 @@ If you are using Split Tunnels in Include mode, you must include the following d #### Block page -If you are using Split Tunnels in Include mode and have [DNS policies](/cloudflare-one/policies/gateway/dns-policies/) with the [block page](/cloudflare-one/policies/gateway/block-page/) enabled, you must include the IPs that blocked domains will resolve to. Unless you are using a [dedicated or BYOIP resolver IP](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#dns-resolver-ip) the block page will resolve to: +If you are using Split Tunnels in Include mode and have [DNS policies](/cloudflare-one/policies/gateway/dns-policies/) with the [block page](/cloudflare-one/policies/gateway/block-page/) enabled, you must include the IPs that blocked domains will resolve to. Unless you are using a [dedicated or BYOIP resolver IP](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/dns-resolver-ips/#dns-resolver-ip) the block page will resolve to: - `162.159.36.12` - `162.159.46.12` #### Team domain -In [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) WARP mode, you cannot [add domains](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains) to Split Tunnels. If you are using Split Tunnels in Include mode, you must include the IPs that resolve to `.cloudflareaccess.com` instead: +In [Secure Web Gateway without DNS filtering](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) WARP mode, you cannot [add domains](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#cloudflare-zero-trust-domains) to Split Tunnels. If you are using Split Tunnels in Include mode, you must include the IPs that resolve to `.cloudflareaccess.com` instead: - `104.19.194.29` - `104.19.195.29` @@ -100,7 +100,7 @@ Removing default Split Tunnel entries may cause users to lose Internet connectiv ::: 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**. -2. Under **Device settings**, locate the [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) you would like to modify and select **Configure**. +2. Under **Device settings**, locate the [device profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) you would like to modify and select **Configure**. 3. Under **Split Tunnels**, select **Manage**. 4. Find the IP address or hostname in the list and select **Delete**. @@ -110,5 +110,5 @@ If you need to revert to the default Split Tunnel entries recommended by Cloudfl ## Related resources -- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) - Resolve selected domains via local DNS instead of Cloudflare Gateway. -- [WARP with firewall](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/) - Learn which IPs, domains, and ports to allow so users can deploy and connect WARP successfully behind a firewall. +- [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) - Resolve selected domains via local DNS instead of Cloudflare Gateway. +- [WARP with firewall](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/) - Learn which IPs, domains, and ports to allow so users can deploy and connect WARP successfully behind a firewall. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture.mdx similarity index 88% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture.mdx index a1cb0c5fe2f072..7eb2ba91e891a2 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture.mdx @@ -8,9 +8,9 @@ sidebar: import { TabItem, Tabs } from "~/components"; -This guide explains how the Cloudflare WARP client interacts with a device's operating system to route traffic in [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode. +This guide explains how the Cloudflare WARP client interacts with a device's operating system to route traffic in [Gateway with WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode. -In [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode, the IP traffic information does not apply. In [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) mode, the DNS traffic information does not apply. +In [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode, the IP traffic information does not apply. In [Secure Web Gateway without DNS filtering](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) mode, the DNS traffic information does not apply. ## WARP traffic flow @@ -18,7 +18,7 @@ The WARP client allows organizations to have granular control over the applicati | Connection | Protocol | Purpose | | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- | -| WARP tunnel ([via WireGuard or MASQUE](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-tunnel-protocol)) | UDP | Send IP packets to Gateway for network policy enforcement, HTTP policy enforcement, and private network access. | +| WARP tunnel ([via WireGuard or MASQUE](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol)) | UDP | Send IP packets to Gateway for network policy enforcement, HTTP policy enforcement, and private network access. | | [DoH](https://www.cloudflare.com/learning/dns/dns-over-tls/) | HTTPS | Send DNS requests to Gateway for DNS policy enforcement. The DoH connection is maintained inside of the WARP tunnel. | | Device orchestration | HTTPS | Perform user registration, check device posture, apply WARP profile settings. | @@ -47,7 +47,7 @@ D --- dns-->G N --> O[(Application)] ``` -Your [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) configuration determines what IP traffic is sent down the WARP tunnel. Your [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) configuration determines which DNS requests are sent to Gateway via DoH. Traffic to the [device orchestration API](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#client-orchestration-api) endpoint does not obey Split Tunnel rules since the connection always operates outside of the WARP tunnel. +Your [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) configuration determines what IP traffic is sent down the WARP tunnel. Your [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) configuration determines which DNS requests are sent to Gateway via DoH. Traffic to the [device orchestration API](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#client-orchestration-api) endpoint does not obey Split Tunnel rules since the connection always operates outside of the WARP tunnel. Next, you will learn how WARP configures your operating system to apply your Local Domain Fallback and Split Tunnel routing rules. Implementation details differ between desktop and mobile clients. @@ -74,7 +74,7 @@ Browsers with DoH configured will bypass the local DNS proxy. You may need to di Based on your Local Domain Fallback configuration, WARP will either forward the request to Gateway for DNS policy enforcement or forward the request to your private DNS resolver. - Requests to Gateway are sent over our [DoH connection](#overview) inside the WARP tunnel. -- Requests to your private DNS resolver are sent either inside or outside of the tunnel depending on your Split Tunnel configuration. For more information, refer to [How the WARP client handles DNS requests](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/#how-the-warp-client-handles-dns-requests). +- Requests to your private DNS resolver are sent either inside or outside of the tunnel depending on your Split Tunnel configuration. For more information, refer to [How the WARP client handles DNS requests](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/#how-the-warp-client-handles-dns-requests). ```mermaid flowchart LR @@ -180,7 +180,7 @@ S -- No --> U["Virtual interface
(172.16.0.2)"] --> G[Cloudflare Gateway] #### Virtual interface -Virtual interfaces allow the operating system to logically subdivide a physical interface, such as a network interface controller (NIC), into separate interfaces for the purposes of routing IP traffic. WARP's virtual interface is what maintains the WireGuard/MASQUE connection between the device and Cloudflare. By default, its IP address is hardcoded as `172.16.0.2`. You can use [**Override local interface IP**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#override-local-interface-ip) to assign unique IPs per device. +Virtual interfaces allow the operating system to logically subdivide a physical interface, such as a network interface controller (NIC), into separate interfaces for the purposes of routing IP traffic. WARP's virtual interface is what maintains the WireGuard/MASQUE connection between the device and Cloudflare. By default, its IP address is hardcoded as `172.16.0.2`. You can use [**Override local interface IP**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#override-local-interface-ip) to assign unique IPs per device. To view a list of all network interfaces on the operating system: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx similarity index 90% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx index a43e756e217f37..59fb2399cf626e 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx @@ -39,11 +39,11 @@ Using the API, enable client certificate provisioning for [your zone](/fundament 1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**. -2. Under **Profile settings** card, choose a [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) and select **Configure**. +2. Under **Profile settings** card, choose a [device profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) and select **Configure**. 3. For **Service mode**, select **Device Information Only**. -4. [Enroll your device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) into your Zero Trust organization. +4. [Enroll your device](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) into your Zero Trust organization. When enrolled in Device Information Only mode, the WARP client will automatically generate a client certificate and install the certificate on the device. This certificate is necessary to confirm the source of outgoing traffic. @@ -128,4 +128,4 @@ Device Information Only mode is now enabled on the device. To start enforcing de ## Limitations -Device Information mode is not compatible with the [Windows pre-login](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/) feature. The user must be logged into Windows because WARP needs to [install a certificate](#3-optional-verify-the-client-certificate) in the user store. \ No newline at end of file +Device Information mode is not compatible with the [Windows pre-login](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin/) feature. The user must be logged into Windows because WARP needs to [install a certificate](#3-optional-verify-the-client-certificate) in the user store. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx similarity index 69% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx index 0f24ca216ce69a..6d0e1c97329e2c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx @@ -33,9 +33,9 @@ Secure Web Gateway without DNS filtering mode (sometimes referred to as tunnel-o :::note -- Secure Web Gateway without DNS filtering mode disables all features that rely on WARP for DNS resolution, including [domain-based split tunneling](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels) and [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/). +- Secure Web Gateway without DNS filtering mode disables all features that rely on WARP for DNS resolution, including [domain-based split tunneling](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels) and [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/). - Only available on Windows, Linux, and macOS. -- Secure Web Gateway without DNS filtering mode has a known limitation concerning [DNS servers with IPv6 addresses](/cloudflare-one/connections/connect-devices/warp/troubleshooting/known-limitations/#ipv6-dns-resolution-in-secure-web-gateway-without-dns-filtering-mode). +- Secure Web Gateway without DNS filtering mode has a known limitation concerning [DNS servers with IPv6 addresses](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/known-limitations/#ipv6-dns-resolution-in-secure-web-gateway-without-dns-filtering-mode). ::: @@ -50,13 +50,13 @@ Proxy mode is best suited for organizations that want to filter traffic directed ### Limitations - Proxy mode can only be used by applications/operating systems that support SOCKS5/HTTPS proxy communication. -- Requires the MASQUE [device tunnel protocol](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-tunnel-protocol). Wireguard is not supported. +- Requires the MASQUE [device tunnel protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol). Wireguard is not supported. - Only available on Windows, Linux, and macOS. - Proxy mode has a timeout limit of 10 seconds for requests. If a request goes above the 10 second limit, Cloudflare will drop the connection. ## Device Information Only -This mode is best suited for organizations that only want to enforce [WARP client device posture checks](/cloudflare-one/identity/devices/warp-client-checks/) for zones in your account. DNS, Network and HTTP traffic is handled by the default mechanisms on your devices. To setup Device Information Only mode, refer to the [dedicated page](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only/). +This mode is best suited for organizations that only want to enforce [WARP client device posture checks](/cloudflare-one/identity/devices/warp-client-checks/) for zones in your account. DNS, Network and HTTP traffic is handled by the default mechanisms on your devices. To setup Device Information Only mode, refer to the [dedicated page](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only/). | DNS filtering | Network filtering | HTTP filtering | Features enabled | | ------------- | ----------------- | -------------- | --------------------------------------------------------------------------- | @@ -68,12 +68,12 @@ Each WARP mode offers a different set of Zero Trust features. | WARP Mode | DNS Filtering | Network Filtering | HTTP Filtering | Service mode (displayed in `warp-cli settings`) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ----------------- | -------------- | ----------------------------------------------- | -| [**Gateway with WARP (default)**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) | ✅ | ✅ | ✅ | `WarpWithDnsOverHttps` | -| [**Gateway with DoH**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh) | ✅ | ❌ | ❌ | `DnsOverHttps` | -| [**Secure Web Gateway without DNS filtering**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) | ❌ | ✅ | ✅ | `TunnelOnly` | -| [**Proxy mode**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#proxy-mode) | ❌ | ❌ | ✅ | `WarpProxy on port 40000` | -| [**Device Information Only**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#device-information-only) | ❌ | ❌ | ❌ | `PostureOnly` | +| [**Gateway with WARP (default)**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) | ✅ | ✅ | ✅ | `WarpWithDnsOverHttps` | +| [**Gateway with DoH**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) | ✅ | ❌ | ❌ | `DnsOverHttps` | +| [**Secure Web Gateway without DNS filtering**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) | ❌ | ✅ | ✅ | `TunnelOnly` | +| [**Proxy mode**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#proxy-mode) | ❌ | ❌ | ✅ | `WarpProxy on port 40000` | +| [**Device Information Only**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#device-information-only) | ❌ | ❌ | ❌ | `PostureOnly` | ## Related resources -- [Connectivity status](/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare. +- [Connectivity status](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions.mdx similarity index 85% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions.mdx index 6afad2a6a920e2..a4efeb7ea40d46 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions.mdx @@ -59,10 +59,10 @@ If the user has an active browser session with the IdP, WARP will use the existi ## Limitations -- **Only one user per device** — If a device is already registered with User A, User B will not be able to log in on that device through the re-authentication flow. To switch the device registration to a different user, User A must first log out from Zero Trust (if [Allow device to leave organization](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) is enabled), or an admin can revoke the registration from **My Team** > **Devices**. User B can then properly [enroll](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/). +- **Only one user per device** — If a device is already registered with User A, User B will not be able to log in on that device through the re-authentication flow. To switch the device registration to a different user, User A must first log out from Zero Trust (if [Allow device to leave organization](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) is enabled), or an admin can revoke the registration from **My Team** > **Devices**. User B can then properly [enroll](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). - **Active connections are not terminated** — Active sessions such as SSH and RDP will remain connected beyond the timeout limit. - **Binding Cookie is not supported** - WARP authentication will not work for Access applications that have the [Binding Cookie](/cloudflare-one/identity/authorization-cookie/#binding-cookie) enabled. ## Related resources -- [Connectivity status](/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare. +- [Connectivity status](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/captive-portals.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/captive-portals.mdx similarity index 55% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/captive-portals.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/captive-portals.mdx index c2c069d2ba5122..0a6228ed69ed29 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/captive-portals.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/captive-portals.mdx @@ -7,7 +7,7 @@ sidebar: import { Details, Badge, Render } from "~/components"; -Captive portals are used by public Wi-Fi networks (such as airports, coffee shops, and hotels) to make a user agree to their Terms of Service or provide payment before allowing access to the Internet. When a user connects to the Wi-Fi, the captive portal blocks all HTTPS traffic until the user completes a captive portal login flow in their browser. This prevents the WARP client from connecting to Cloudflare. At the same time, WARP creates [firewall rules](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic) on the device to send all traffic to Cloudflare. The user is therefore unable to access the captive portal login screen unless they temporarily disable WARP. +Captive portals are used by public Wi-Fi networks (such as airports, coffee shops, and hotels) to make a user agree to their Terms of Service or provide payment before allowing access to the Internet. When a user connects to the Wi-Fi, the captive portal blocks all HTTPS traffic until the user completes a captive portal login flow in their browser. This prevents the WARP client from connecting to Cloudflare. At the same time, WARP creates [firewall rules](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic) on the device to send all traffic to Cloudflare. The user is therefore unable to access the captive portal login screen unless they temporarily disable WARP. ## Allow users to connect to captive portals @@ -15,13 +15,13 @@ To allow users to connect through a captive portal, administrators can configure ### No user interaction required -- Enable [Captive portal detection](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#captive-portal-detection). This allows WARP to temporarily turn off when it detects a captive portal on the network. For more details, refer to [how captive portal detection works](#how-captive-portal-detection-works) and its [limitations](#limitations). -- Set [Device tunnel protocol](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-tunnel-protocol) to **MASQUE**. When using MASQUE, WARP traffic will look like standard HTTPS traffic and is therefore less likely to be blocked by captive portals. +- Enable [Captive portal detection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#captive-portal-detection). This allows WARP to temporarily turn off when it detects a captive portal on the network. For more details, refer to [how captive portal detection works](#how-captive-portal-detection-works) and its [limitations](#limitations). +- Set [Device tunnel protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol) to **MASQUE**. When using MASQUE, WARP traffic will look like standard HTTPS traffic and is therefore less likely to be blocked by captive portals. ### User interaction required -- Enable [Lock WARP switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) and enable [Admin override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override). Users can contact the IT administrator for a one-time code that allows them to manually turn off WARP and connect to a portal. -- For employees who travel, disable [Lock WARP switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) and set an [Auto connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect) duration. This allows the user to manually turn off WARP without contacting IT. +- Enable [Lock WARP switch](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#lock-warp-switch) and enable [Admin override](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#admin-override). Users can contact the IT administrator for a one-time code that allows them to manually turn off WARP and connect to a portal. +- For employees who travel, disable [Lock WARP switch](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#lock-warp-switch) and set an [Auto connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect) duration. This allows the user to manually turn off WARP without contacting IT. ## How captive portal detection works @@ -29,27 +29,27 @@ If WARP cannot establish a connection to Cloudflare, it will: 1. Start the captive portal timer. -2. Send a series of requests to the [Cloudflare captive portal URLs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#captive-portal) and other OS and browser-specific captive portal URLs. These requests are sent outside of the WARP tunnel. +2. Send a series of requests to the [Cloudflare captive portal URLs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#captive-portal) and other OS and browser-specific captive portal URLs. These requests are sent outside of the WARP tunnel. -3. If a request is intercepted, WARP assumes the network is behind a captive portal and fully opens the [system firewall](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic). While the firewall is open, all device traffic will bypass WARP. +3. If a request is intercepted, WARP assumes the network is behind a captive portal and fully opens the [system firewall](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic). While the firewall is open, all device traffic will bypass WARP. 4. Re-enable the firewall after the user successfully connects to the portal or after the timeout period expires. ## Limitations - Due to [how captive portal detection works](#how-captive-portal-detection-works), it may be possible for an employee to spoof a captive portal in order to turn off WARP. -- Some captive portals, particularly those on airlines, may be slow to respond and exceed the captive portal detection timeout. Users will likely see a [CF_CAPTIVE_PORTAL_TIMED_OUT](/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors/#cf_captive_portal_timed_out) error when they try to connect. For context on the steps leading up to these errors, refer to [Connectivity status](/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status/). +- Some captive portals, particularly those on airlines, may be slow to respond and exceed the captive portal detection timeout. Users will likely see a [CF_CAPTIVE_PORTAL_TIMED_OUT](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors/#cf_captive_portal_timed_out) error when they try to connect. For context on the steps leading up to these errors, refer to [Connectivity status](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status/). - WARP may not be able to detect multi-stage captive portals, which redirect the user to different networks during the login process. Users will need to manually turn off WARP to get through the captive portal. - Some public Wi-Fi networks are incompatible with running WARP: - - Captive portals that intercept all DNS traffic will block WARP's [DoH connection](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#overview). Users will likely see a [CF_NO_NETWORK](/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors/#cf_no_network) error after they login to the captive portal. - - Captive portals that only allow HTTPS traffic will block WARP's [Wireguard UDP connection](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#overview). Users will likely see a [CF_HAPPY_EYEBALLS_MITM_FAILURE](/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors/#cf_happy_eyeballs_mitm_failure) error after they login to the captive portal. + - Captive portals that intercept all DNS traffic will block WARP's [DoH connection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#overview). Users will likely see a [CF_NO_NETWORK](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors/#cf_no_network) error after they login to the captive portal. + - Captive portals that only allow HTTPS traffic will block WARP's [Wireguard UDP connection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#overview). Users will likely see a [CF_HAPPY_EYEBALLS_MITM_FAILURE](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors/#cf_happy_eyeballs_mitm_failure) error after they login to the captive portal. ## Get captive portal logs
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -81,4 +81,4 @@ Once the diagnostic finishes running, WARP will place a `warp-captive-portal-dia ## Related resources -- [Connectivity status](/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare. +- [Connectivity status](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status/) - Learn about the status messages displayed by the WARP client during its connection process, and understand each stage as WARP establishes a secure tunnel to Cloudflare. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx similarity index 79% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx index ea4d0b71af3787..9ce1cbe156dc98 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx @@ -17,7 +17,7 @@ import { WARP settings define the WARP client modes and permissions available to end users. - [Global settings](#global-settings) apply to all devices enrolled in your Zero Trust organization. -- [Device settings](#device-settings) may vary across devices depending on which [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) is applied. +- [Device settings](#device-settings) may vary across devices depending on which [device profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) is applied. :::note @@ -78,7 +78,7 @@ The user can now toggle the WARP switch or use the `warp-cli connect` command. T
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Gateway with WARP, Proxy mode | All plans | @@ -93,21 +93,21 @@ The user can now toggle the WARP switch or use the `warp-cli connect` command. T
-When `Enabled`, the WARP client will [automatically install](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/) your organization's root certificate on the device. +When `Enabled`, the WARP client will [automatically install](/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) your organization's root certificate on the device. ### Override local interface IP
-| Operating Systems | [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| Operating Systems | [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | --------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Windows, macOS, Linux | Gateway with WARP, Secure Web Gateway without DNS Filtering | All plans |
-Overrides the default IP address of WARP's [virtual network interface](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic) such that each device has its own unique local interface IP. +Overrides the default IP address of WARP's [virtual network interface](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic) such that each device has its own unique local interface IP. -This setting is primarily used as a prerequisite for [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) and [MASQUE](#device-tunnel-protocol). You can also use it when the default IP conflicts with other local services on your network. +This setting is primarily used as a prerequisite for [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) and [MASQUE](#device-tunnel-protocol). You can also use it when the default IP conflicts with other local services on your network. **Value:** @@ -121,7 +121,7 @@ The CGNAT IP assigned to a WARP device is permanent until the device unregisters
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -140,7 +140,7 @@ The CGNAT IP assigned to a WARP device is permanent until the device unregisters Requires the [Super Administrator](/cloudflare-one/roles-permissions/) role. ::: -Global WARP override allows administrators to fail open WARP in case of an incident occurring in your environment, independent from incidents or outages affecting Cloudflare's services. When you turn on **Global WARP override**, Cloudflare will disconnect all Windows, macOS, and Linux WARP clients that are connected to your Zero Trust organization. This includes end user devices, [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) hosts, and [WARP-to-WARP](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/) devices. End users will receive a notification on their device and the WARP client will display [`Admin directed disconnect`](/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors/#admin-directed-disconnect). +Global WARP override allows administrators to fail open WARP in case of an incident occurring in your environment, independent from incidents or outages affecting Cloudflare's services. When you turn on **Global WARP override**, Cloudflare will disconnect all Windows, macOS, and Linux WARP clients that are connected to your Zero Trust organization. This includes end user devices, [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) hosts, and [WARP-to-WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/) devices. End users will receive a notification on their device and the WARP client will display [`Admin directed disconnect`](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors/#admin-directed-disconnect). [Auto connect](#auto-connect) and [Lock WARP switch](#lock-warp-switch) will not apply while the global override is on. Additionally, the global override will clear any existing [Admin override](#admin-override) codes. The only way for users to reconnect during a global override is by using a new [Admin override](#admin-override) code. For example, you may want to provide IT staff with a code so that they can test resolution of the incident that led to the global disconnect. @@ -154,25 +154,25 @@ To resume normal operations, turn off **Global WARP override**. The WARP client When `Enabled`, the WARP client will automatically turn off when it detects a captive portal, and it will automatically turn back on after the **Timeout** duration. -Since captive portal implementations vary, WARP may not detect all captive portals. For more information, refer to [Captive portal detection](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/captive-portals/). +Since captive portal implementations vary, WARP may not detect all captive portals. For more information, refer to [Captive portal detection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/captive-portals/). ### Mode switch
-| Operating Systems | [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| Operating Systems | [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All systems | Any mode | All plans |
-When `Enabled`, users have the option to switch between [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode and [Gateway with DoH mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh). This feature does not support switching between any other modes. +When `Enabled`, users have the option to switch between [Gateway with WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode and [Gateway with DoH mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh). This feature does not support switching between any other modes. ### Device tunnel protocol
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -191,8 +191,8 @@ Configures the protocol used to route IP traffic from the device to Cloudflare G **Value**: -- **WireGuard**: Establishes a [WireGuard](https://www.wireguard.com/) connection to Cloudflare. The WARP client will encrypt traffic using a non-FIPs compliant cipher suite, `TLS_CHACHA20_POLY1305_SHA256`. When switching from MASQUE to WireGuard, users may lose Internet connectivity if their Wi-Fi network blocks the [ports and IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) required for WireGuard to function. -- **MASQUE**: (default) Establishes an HTTP/3 connection to Cloudflare. The WARP client will encrypt traffic using TLS 1.3 and a [FIPS 140-2](https://csrc.nist.gov/pubs/fips/140-2/upd2/final) compliant cipher suite, `TLS_AES_256_GCM_SHA384`. [Override local interface IP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#override-local-interface-ip) is enabled by default for devices with MASQUE enabled. +- **WireGuard**: Establishes a [WireGuard](https://www.wireguard.com/) connection to Cloudflare. The WARP client will encrypt traffic using a non-FIPs compliant cipher suite, `TLS_CHACHA20_POLY1305_SHA256`. When switching from MASQUE to WireGuard, users may lose Internet connectivity if their Wi-Fi network blocks the [ports and IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip) required for WireGuard to function. +- **MASQUE**: (default) Establishes an HTTP/3 connection to Cloudflare. The WARP client will encrypt traffic using TLS 1.3 and a [FIPS 140-2](https://csrc.nist.gov/pubs/fips/140-2/upd2/final) compliant cipher suite, `TLS_AES_256_GCM_SHA384`. [Override local interface IP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#override-local-interface-ip) is enabled by default for devices with MASQUE enabled. For more details on WireGuard versus MASQUE, refer to our [blog post](https://blog.cloudflare.com/zero-trust-warp-with-a-masque). @@ -200,7 +200,7 @@ For more details on WireGuard versus MASQUE, refer to our [blog post](https://bl
-| Operating Systems | [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| Operating Systems | [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All systems | Any mode | All plans | @@ -219,13 +219,13 @@ On MDM deployments, you must also include the `auto_connect` parameter with at l -When `Enabled`, users can log out from your Zero Trust organization by selecting **Logout from Zero Trust** in the WARP client UI. The **Logout from Zero Trust** button is only available for devices that were [enrolled manually](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/). Devices that enrolled using an MDM file are always prevented from leaving your Zero Trust organization. +When `Enabled`, users can log out from your Zero Trust organization by selecting **Logout from Zero Trust** in the WARP client UI. The **Logout from Zero Trust** button is only available for devices that were [enrolled manually](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). Devices that enrolled using an MDM file are always prevented from leaving your Zero Trust organization. ### Allow updates
-| Operating Systems | [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| Operating Systems | [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | --------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | macOS, Windows, Linux | Any mode | All plans | @@ -259,34 +259,34 @@ When `Enabled`, the **Send Feedback** button in the WARP client appears and will -Allows you to choose the operational mode of the client. Refer to [WARP Modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes) for a detailed description of each mode. +Allows you to choose the operational mode of the client. Refer to [WARP Modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes) for a detailed description of each mode. ### Local Domain Fallback
-| Operating Systems | [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| Operating Systems | [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All systems | Gateway with WARP, Gateway with DoH | All plans |
-Configures the WARP client to redirect DNS requests to a private DNS resolver. For more information, refer to our [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) documentation. +Configures the WARP client to redirect DNS requests to a private DNS resolver. For more information, refer to our [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) documentation. ### Split Tunnels -Configures the WARP client to exclude or include traffic to specific IP addresses or domains. For more information, refer to our [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) documentation. +Configures the WARP client to exclude or include traffic to specific IP addresses or domains. For more information, refer to our [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) documentation. ### Directly route Microsoft 365 traffic -Creates [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude entries for all [Microsoft 365 IP addresses specified by Microsoft](https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service). To use this setting, **Split Tunnels** must be set to **Exclude IPs and domains**. Once enabled, all Microsoft 365 network traffic will bypass WARP and Gateway. +Creates [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude entries for all [Microsoft 365 IP addresses specified by Microsoft](https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service). To use this setting, **Split Tunnels** must be set to **Exclude IPs and domains**. Once enabled, all Microsoft 365 network traffic will bypass WARP and Gateway. :::note -Microsoft has recently made changes to the IPs used by their applications (such as Microsoft Teams). Until Microsoft updates their [IP address and URL web service](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service?view=o365-worldwide), you will need to manually add the following IPs to your [Split Tunnels Exclude list](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route): +Microsoft has recently made changes to the IPs used by their applications (such as Microsoft Teams). Until Microsoft updates their [IP address and URL web service](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service?view=o365-worldwide), you will need to manually add the following IPs to your [Split Tunnels Exclude list](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route): - `24.24.24.24/32` - `52.120.0.0/14` ::: @@ -295,7 +295,7 @@ Microsoft has recently made changes to the IPs used by their applications (such
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -366,7 +366,7 @@ To turn on local network access in the WARP client:
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -383,13 +383,13 @@ To turn on local network access in the WARP client: When `Enabled`, the operating system will register WARP's [local interface IP](#override-local-interface-ip) (CGNAT IP or `172.16.0.2`) with your on-premise DNS server when the DNS server is reachable. -If you use on-premise DNS infrastructure (such as Active Directory), we recommend turning this setting on for remote [device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) and turning it off for [managed network](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/) device profiles. In this configuration, remote devices will register their WARP interface IP, while on-premise devices will only register their local DHCP address. This allows the on-premise DNS server to resolve device hostnames no matter where the device is located. +If you use on-premise DNS infrastructure (such as Active Directory), we recommend turning this setting on for remote [device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) and turning it off for [managed network](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/) device profiles. In this configuration, remote devices will register their WARP interface IP, while on-premise devices will only register their local DHCP address. This allows the on-premise DNS server to resolve device hostnames no matter where the device is located. ### SCCM VPN boundary support
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -404,7 +404,7 @@ If you use on-premise DNS infrastructure (such as Active Directory), we recommen
-Microsoft's [System Center Configuration Manager](https://learn.microsoft.com/en-us/intune/configmgr/) (SCCM) is used to manage software on Windows devices based on the [boundary group](https://learn.microsoft.com/en-us/intune/configmgr/core/servers/deploy/configure/define-site-boundaries-and-boundary-groups), or network location, to which they belong. You can assign WARP clients to a SCCM boundary group based on their [managed network](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/) and other device profile attributes. When **SCCM VPN Boundary Support** is turned on, the WARP client will modify the description field on its [virtual network interface](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic). This allows you to define a VPN boundary group that matches on the network interface description. +Microsoft's [System Center Configuration Manager](https://learn.microsoft.com/en-us/intune/configmgr/) (SCCM) is used to manage software on Windows devices based on the [boundary group](https://learn.microsoft.com/en-us/intune/configmgr/core/servers/deploy/configure/define-site-boundaries-and-boundary-groups), or network location, to which they belong. You can assign WARP clients to a SCCM boundary group based on their [managed network](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/) and other device profile attributes. When **SCCM VPN Boundary Support** is turned on, the WARP client will modify the description field on its [virtual network interface](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic). This allows you to define a VPN boundary group that matches on the network interface description. **Value:** @@ -418,9 +418,9 @@ Assume you want to push software updates from a cloud based [distribution point] 1. In Zero Trust: - a. Turn on **SCCM VPN Boundary Support** for remote [device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/). + a. Turn on **SCCM VPN Boundary Support** for remote [device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/). - b. Turn off **SCCM VPN Boundary Support** for [on-prem device profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/#4-configure-device-profile). + b. Turn off **SCCM VPN Boundary Support** for [on-prem device profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/#4-configure-device-profile). c. (Optional) Verify device settings: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx similarity index 71% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx index 80d2910a5b5f26..ae9274ac6959c5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx @@ -13,7 +13,7 @@ Device enrollment permissions determine which users can connect new devices to y -Users can now [enroll their device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) by logging in to your identity provider. To prevent users from logging out of your organization after they enroll, disable [Allow devices to leave organization](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) in your WARP client settings. +Users can now [enroll their device](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) by logging in to your identity provider. To prevent users from logging out of your organization after they enroll, disable [Allow devices to leave organization](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) in your WARP client settings. ## Example policies @@ -33,4 +33,4 @@ Enterprise customers can enforce [mutual TLS authentication](/cloudflare-one/ide -When users [log in to your Zero Trust organization](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) from the WARP client, their device must present a valid client certificate in order to connect. +When users [log in to your Zero Trust organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) from the WARP client, their device must present a valid client certificate in order to connect. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/firewall.mdx similarity index 75% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/firewall.mdx index e3d720f1a2b11d..2d62ba01ed2523 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/firewall.mdx @@ -26,10 +26,10 @@ The WARP client connects to Cloudflare via a standard HTTPS connection outside t ## DoH IP :::note -Only required for [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode. +Only required for [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode. ::: -In [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode, the WARP client sends DNS requests to Gateway over an HTTPS connection. For DNS to work correctly, you must allow `.cloudflare-gateway.com` which will lookup the following IPs: +In [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode, the WARP client sends DNS requests to Gateway over an HTTPS connection. For DNS to work correctly, you must allow `.cloudflare-gateway.com` which will lookup the following IPs: - IPv4 DoH Addresses: `162.159.36.1` and `162.159.46.1` - IPv6 DoH Addresses: `2606:4700:4700::1111` and `2606:4700:4700::1001` @@ -44,18 +44,18 @@ In [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure ### Android devices -If you are deploying the Cloudflare One Agent on Android/ChromeOS, you must also add `cloudflare-dns.com` to your firewall exception list. On Android/ChromeOS devices, WARP uses `cloudflare-dns.com` to resolve domains on your [Split Tunnel list](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels). +If you are deploying the Cloudflare One Agent on Android/ChromeOS, you must also add `cloudflare-dns.com` to your firewall exception list. On Android/ChromeOS devices, WARP uses `cloudflare-dns.com` to resolve domains on your [Split Tunnel list](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#domain-based-split-tunnels). ## Client authentication endpoint -When you [log in to your Zero Trust organization](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/), you will have to complete the authentication steps required by your organization in the browser window that opens. To perform these operations, you must allow the following domains: +When you [log in to your Zero Trust organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/), you will have to complete the authentication steps required by your organization in the browser window that opens. To perform these operations, you must allow the following domains: - The IdP used to authenticate to Cloudflare Zero Trust - `.cloudflareaccess.com` ## WARP ingress IP -WARP connects to the following IP addresses, depending on which [tunnel protocol](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-tunnel-protocol) is configured for your device (WireGuard or MASQUE). All network traffic from your device to Cloudflare goes through these IPs and ports over UDP. +WARP connects to the following IP addresses, depending on which [tunnel protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol) is configured for your device (WireGuard or MASQUE). All network traffic from your device to Cloudflare goes through these IPs and ports over UDP. ### WireGuard @@ -79,7 +79,7 @@ WARP connects to the following IP addresses, depending on which [tunnel protocol :::note -Before you [log in to your Zero Trust organization](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/), you may see the IPv4 range `162.159.192.0/24`. This IP is used for consumer WARP services ([1.1.1.1 w/ WARP](/warp-client/)) and is not required for Zero Trust deployments. +Before you [log in to your Zero Trust organization](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/), you may see the IPv4 range `162.159.192.0/24`. This IP is used for consumer WARP services ([1.1.1.1 w/ WARP](/warp-client/)) and is not required for Zero Trust deployments. ::: ## Captive portal @@ -101,7 +101,7 @@ As part of establishing the WARP connection, the client runs connectivity checks The client connects to the following destinations to verify general Internet connectivity outside of the WARP tunnel. Make sure that these IPs and domains are on your firewall allowlist. -- `engage.cloudflareclient.com`: The client will always send requests directly to an IP in the [WARP ingress IPv4 or IPv6 range](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) (or to your [`override_warp_endpoint`](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint) if set). Requests will not use a proxy server, even if one is configured for the system. +- `engage.cloudflareclient.com`: The client will always send requests directly to an IP in the [WARP ingress IPv4 or IPv6 range](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip) (or to your [`override_warp_endpoint`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint) if set). Requests will not use a proxy server, even if one is configured for the system. - `162.159.197.3` - `2606:4700:102::3` @@ -136,7 +136,7 @@ The WARP client reports connectivity issues to our NEL endpoint via `a.nel.cloud ## Latency statistics (optional) -The WARP client generates ICMP traffic to the [WARP ingress IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) when running tunnel latency tests. This is not technically required to operate but will result in errors in our logs if not excluded properly. +The WARP client generates ICMP traffic to the [WARP ingress IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip) when running tunnel latency tests. This is not technically required to operate but will result in errors in our logs if not excluded properly. ## Time synchronization (optional) @@ -188,5 +188,5 @@ To use the network connectivity tests built into the WARP GUI, you will need to ## Related resources -- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) - Resolve selected domains via local DNS instead of Cloudflare Gateway. -- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) - Control which traffic goes through WARP by including or excluding specific IPs or domains. +- [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) - Resolve selected domains via local DNS instead of Cloudflare Gateway. +- [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) - Control which traffic goes through WARP by including or excluding specific IPs or domains. diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/index.mdx new file mode 100644 index 00000000000000..7fb25e3c6068eb --- /dev/null +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/index.mdx @@ -0,0 +1,16 @@ +--- +pcx_content_type: navigation +title: Deploy WARP +sidebar: + order: 5 +head: + - tag: title + content: Deploy WARP to your organization + +--- + +Depending on how your organization is structured, you can deploy WARP in one of two ways: + +* [Manual deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) — If you are a small organization, asking your users to download the client themselves and type in the required settings is the ideal way to get started with WARP. + +* [Managed deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) — Bigger organizations with MDM tools like Intune or JAMF can deploy WARP to their entire fleet of devices from a single operation. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment.mdx similarity index 91% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment.mdx index 0466688ee190ed..4d8d0e1fafb219 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment.mdx @@ -11,7 +11,7 @@ If you plan to direct your users to manually download and configure the WARP cli ## Prerequisites -- [Set device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/) to specify which users can connect. +- [Set device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/) to specify which users can connect. - ## Windows, macOS, and Linux @@ -65,7 +65,7 @@ If you get a `401` error, then the token has expired. Generate a new one by refr
-7. If you did not configure WARP to [auto-connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect), manually turn on WARP: +7. If you did not configure WARP to [auto-connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect), manually turn on WARP: ```sh warp-cli connect @@ -115,7 +115,7 @@ cf1app://oneapp.cloudflare.com/team?name= To enroll a device using a login URL: -1. [Download](/cloudflare-one/connections/connect-devices/warp/download-warp/) and install the Cloudflare One Agent app. +1. [Download](/cloudflare-one/team-and-resources/devices/warp/download-warp/) and install the Cloudflare One Agent app. 2. Go to the [login URL](#generate-a-login-url) provided by your account administrator. To use a QR code, open the QR scanner app on your device and scan the QR code. The Cloudflare One Agent app will open and start the onboarding flow. @@ -140,7 +140,7 @@ To enroll a device using a login URL: e. In the **Connection request** popup window, select **OK**. -4. If you did not enable [auto-connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect), manually turn on the switch to **Connected**. +4. If you did not enable [auto-connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect), manually turn on the switch to **Connected**. The device is now protected by your organization's Zero Trust policies. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/index.mdx similarity index 80% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/index.mdx index a800741ddd1374..2dffea85d55250 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/index.mdx @@ -9,7 +9,7 @@ import { Render } from "~/components"; -This page provides generic instructions for an automated deployment. If you want to deploy the WARP client manually, refer to the [instructions for manual deployment](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/). +This page provides generic instructions for an automated deployment. If you want to deploy the WARP client manually, refer to the [instructions for manual deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). :::caution @@ -19,7 +19,7 @@ This page provides generic instructions for an automated deployment. If you want ## Prerequisites -- Refer to the [Download page](/cloudflare-one/connections/connect-devices/warp/download-warp/#windows) to review system requirements and download the installer for your operating system. +- Refer to the [Download page](/cloudflare-one/team-and-resources/devices/warp/download-warp/#windows) to review system requirements and download the installer for your operating system. - ## Windows @@ -50,7 +50,7 @@ The WARP MSI installer supports the following [public properties](https://learn. - `SUPPORT_URL` - `SWITCH_LOCKED` -Refer to [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a description of each property. +Refer to [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for a description of each property. ### Uninstall WARP @@ -115,7 +115,7 @@ If you do not wish to use a management tool, you can manually place an `mdm.xml` 1. [Download](/cloudflare-one/static/mdm/com.cloudflare.warp.plist) an example `com.cloudflare.warp.plist` file. -2. Modify the file with your desired [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/). +2. Modify the file with your desired [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/). #### `mobileconfig` file @@ -123,11 +123,11 @@ If you do not wish to use a management tool, you can manually place an `mdm.xml` 2. Run `uuidgen` from your macOS Terminal. This will generate a value for `PayloadUUID`, which you can use to replace the default value used for `PayloadUUID`. -3. Modify the file with your desired [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/). +3. Modify the file with your desired [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/). ### Place an unmanaged `mdm.xml` file -You can configure [WARP deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) on macOS by manually placing an `mdm.xml` file in `/Library/Application Support/Cloudflare`. This deployment method is an alternative to pushing a `plist` or `mobileconfig` using an MDM tool. +You can configure [WARP deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) on macOS by manually placing an `mdm.xml` file in `/Library/Application Support/Cloudflare`. This deployment method is an alternative to pushing a `plist` or `mobileconfig` using an MDM tool. The format of `/Library/Application Support/Cloudflare/mdm.xml` is as follows: @@ -149,7 +149,7 @@ The WARP client for Linux allows for an automated install via the presence of an ``` -Refer to [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a list of accepted arguments. +Refer to [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for a list of accepted arguments. To learn how to automate WARP deployment on headless servers, refer to our [tutorial](/cloudflare-one/tutorials/warp-on-headless-linux/). @@ -157,7 +157,7 @@ To learn how to automate WARP deployment on headless servers, refer to our [tuto :::note[Migrate from 1.1.1.1] -The legacy iOS client, [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration/). +The legacy iOS client, [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration/). ::: The Cloudflare WARP iOS client, known in the App Store as [Cloudflare One Agent](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492), allows for an automated install via tools like Jamf, Intune, or SimpleMDM. @@ -179,13 +179,13 @@ To proceed with the installation, here is an example of the XML code you will ne ``` -Refer to [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument. +Refer to [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument. ## Android / ChromeOS :::note[Migrate from 1.1.1.1] -The legacy Android client, [1.1.1.1 + WARP: Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration/). +The legacy Android client, [1.1.1.1 + WARP: Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration/). ::: The Cloudflare WARP Android client, known in the Google Play store as [Cloudflare One Agent](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent), allows for an automated install via tools like Intune, Google Endpoint Manager, and others. @@ -221,4 +221,4 @@ If your MDM tool does not support XML, you may need to convert the XML to JSON. } ``` -Refer to [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a description of each value. +Refer to [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for a description of each value. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx similarity index 78% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx index 7e0feaad89c9c5..7151825bd84e1b 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx @@ -35,7 +35,7 @@ This field is used to enforce DNS policies when deploying the client in DoH-only ### `gateway_unique_id` -Instructs the client to direct all DNS queries to a specific [Gateway DNS location](/cloudflare-one/connections/connect-devices/agentless/dns/locations/). This value is only necessary if deploying without a [team name](#organization) or in an organization with multiple DNS locations. If you do not supply a DoH subdomain, we will automatically use the default Gateway DNS location for your organization. +Instructs the client to direct all DNS queries to a specific [Gateway DNS location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/). This value is only necessary if deploying without a [team name](#organization) or in an organization with multiple DNS locations. If you do not supply a DoH subdomain, we will automatically use the default Gateway DNS location for your organization. **Value Type:** `string` @@ -64,7 +64,7 @@ Example configuration: ``` :::note -The service token must have _Service Auth_ [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token). Allow permissions will not work for service tokens. +The service token must have _Service Auth_ [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#check-for-service-token). Allow permissions will not work for service tokens. ::: ### `auth_client_secret` @@ -95,7 +95,7 @@ This parameter replaces the old `enabled` property, which can no longer be used ### `display_name` -Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with [multiple organizations](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations/). Required if the `organization` parameter is specified within a [`configs` array](#configs). +Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with [multiple organizations](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/switch-organizations/). Required if the `organization` parameter is specified within a [`configs` array](#configs). **Value Type:** `string` @@ -105,7 +105,7 @@ Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
| All plans | @@ -142,7 +142,7 @@ Controls the visibility of the onboarding screens that ask the user to review th ### `override_api_endpoint` -Overrides the [IP address](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#client-orchestration-api) used by the WARP client to communicate with the client orchestration API. If you set this parameter, be sure to update your organization's firewall to ensure the new IP is allowed through. +Overrides the [IP address](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#client-orchestration-api) used by the WARP client to communicate with the client orchestration API. If you set this parameter, be sure to update your organization's firewall to ensure the new IP is allowed through. This functionality is intended for use with a Cloudflare China local network partner or any other third-party network partner that can maintain the integrity of network traffic. Most IT admins should not set this setting as it will redirect all API traffic to a new IP. @@ -160,7 +160,7 @@ Only supported in Gateway with DoH mode.[^1] [^1]: Gateway with WARP is supported in client version 2025.2.664.0 and below. In version 2025.4.589.1 and above, this parameter does not apply to Gateway with WARP because all DoH traffic goes inside of the WARP tunnel. -Overrides the [IP address](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#doh-ip) used by the WARP client to resolve DNS queries via DNS over HTTPS (DoH). If you set this parameter, be sure to update your organization's firewall to ensure the new IP is allowed through. +Overrides the [IP address](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#doh-ip) used by the WARP client to resolve DNS queries via DNS over HTTPS (DoH). If you set this parameter, be sure to update your organization's firewall to ensure the new IP is allowed through. This functionality is intended for use with a Cloudflare China local network partner or any other third-party network partner that can maintain the integrity of network traffic. Most IT admins should not set this setting as it will redirect all DoH traffic to a new IP. @@ -172,7 +172,7 @@ The string must be a valid IPv4 or IPv6 address, otherwise the WARP client will ### `override_warp_endpoint` -Overrides the [IP address and UDP port](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) used by the WARP client to send traffic to Cloudflare's edge. If you set this parameter, be sure to update your organization's firewall to ensure the new IP is allowed through. +Overrides the [IP address and UDP port](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip) used by the WARP client to send traffic to Cloudflare's edge. If you set this parameter, be sure to update your organization's firewall to ensure the new IP is allowed through. This functionality is intended for use with a Cloudflare China local network partner or any other third-party network partner that can maintain the integrity of network traffic. Most IT admins should not set this setting as it will redirect all WARP traffic to a new IP. @@ -190,18 +190,18 @@ Allows you to choose the operational mode of the client. **Value:** -* `warp` — (default) [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default). -* `1dot1` — [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh). -* `proxy` — [Proxy mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#proxy-mode). Use the `proxy_port` parameter to specify the localhost SOCKS proxy port (between `0`-`66535`). For example, +* `warp` — (default) [Gateway with WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default). +* `1dot1` — [Gateway with DoH](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh). +* `proxy` — [Proxy mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#proxy-mode). Use the `proxy_port` parameter to specify the localhost SOCKS proxy port (between `0`-`66535`). For example, ```xml service_mode proxy proxy_port 44444 ``` -* `postureonly` — [Device Information Only](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#device-information-only). +* `postureonly` — [Device Information Only](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#device-information-only). -The service mode [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) is not currently supported as a value and must be configured in Zero Trust. +The service mode [Secure Web Gateway without DNS filtering](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) is not currently supported as a value and must be configured in Zero Trust. ### `support_url` @@ -251,7 +251,7 @@ Top-level parameters determine how WARP manages device registrations. ### `configs` -Allows a user to [switch between Zero Trust organizations](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations/) in the WARP client GUI. The `configs` array is also required when using another [top-level parameter](#top-level-parameters) such as `multi_user` or `pre_login`, even if only one organization is specified. +Allows a user to [switch between Zero Trust organizations](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/switch-organizations/) in the WARP client GUI. The `configs` array is also required when using another [top-level parameter](#top-level-parameters) such as `multi_user` or `pre_login`, even if only one organization is specified. **Value Type:** `array` @@ -266,11 +266,11 @@ Enables multiple user registrations on a Windows device. **Value:** * `false` — (default) Only one WARP registration is stored per device. After a user logs in to WARP, their settings and identity will apply to all traffic from the device. -* `true` — Each Windows user has their own WARP registration. For more information, refer to [Multiple users on a Windows device](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/). +* `true` — Each Windows user has their own WARP registration. For more information, refer to [Multiple users on a Windows device](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser/). ### `pre_login` -Allows WARP to connect with a service token before a user completes the initial Windows login. For more information, refer to [Connect WARP before Windows login](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/). +Allows WARP to connect with a service token before a user completes the initial Windows login. For more information, refer to [Connect WARP before Windows login](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin/). ## Per-app VPN parameters (Android) diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/fleet.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/fleet.mdx similarity index 87% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/fleet.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/fleet.mdx index 83271d81f49770..eeed35f9190df1 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/fleet.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/fleet.mdx @@ -14,7 +14,7 @@ This guide covers how to deploy the Cloudflare WARP client using [Fleet](https:/ ### 1. Create a custom MDM file 1. [Download](/cloudflare-one/static/mdm/CloudflareWARP.mobileconfig) an example `.mobileconfig` file. -2. Modify the file with your desired [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/). +2. Modify the file with your desired [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/). ### 2. Upload MDM file to Fleet @@ -31,7 +31,7 @@ The defined hosts will immediately receive the deployment profile, but WARP is n ### 3. Download WARP package for macOS -Visit the [Download page](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) to review system requirements and download the installer for your operating system. +Visit the [Download page](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos) to review system requirements and download the installer for your operating system. ### 4. Upload WARP package to Fleet @@ -65,7 +65,7 @@ To uninstall the Fleet-deployed WARP client: ### 1. Download WARP package for Windows -Visit the [Download page](/cloudflare-one/connections/connect-devices/warp/download-warp/#windows) to review system requirements and download the installer for your operating system. +Visit the [Download page](/cloudflare-one/team-and-resources/devices/warp/download-warp/#windows) to review system requirements and download the installer for your operating system. ### 2. Upload WARP package to Fleet @@ -97,7 +97,7 @@ Exit $installProcess.ExitCode } ``` -Refer to [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument. +Refer to [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument. ### 3. Install WARP with Fleet @@ -121,7 +121,7 @@ To uninstall the Fleet-deployed WARP client: ## Linux -Fleet allows you to [execute custom scripts](https://fleetdm.com/guides/scripts) on Linux hosts. The following example script creates an [MDM file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#linux) and installs WARP on an Ubuntu 22.04 host: +Fleet allows you to [execute custom scripts](https://fleetdm.com/guides/scripts) on Linux hosts. The following example script creates an [MDM file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#linux) and installs WARP on an Ubuntu 22.04 host: ```sh #!/bin/sh diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/hexnode.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/hexnode.mdx similarity index 97% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/hexnode.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/hexnode.mdx index 91d7fea866bcb1..48da1bd14c4a0a 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/hexnode.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/hexnode.mdx @@ -52,7 +52,7 @@ import { Render } from "~/components"; ## macOS -1. [Download](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) the Cloudflare WARP client for macOS. +1. [Download](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos) the Cloudflare WARP client for macOS. 2. On your Hexnode console, go to **Apps** > **Add Apps** > **Enterprise App**. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/index.mdx similarity index 83% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/index.mdx index 84067968197eea..bd1bdc7c009591 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/index.mdx @@ -16,4 +16,4 @@ This is a list of Technology Partners Cloudflare Zero Trust works with: -If you do not see your management software listed above, we can almost certainly still work with it. Refer to our [instructions for managed deployments](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to understand what configuration files are required. +If you do not see your management software listed above, we can almost certainly still work with it. Refer to our [instructions for managed deployments](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) to understand what configuration files are required. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx similarity index 91% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx index 028bf2441ff6fd..27012438f3b733 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx @@ -15,7 +15,7 @@ This guide covers how to deploy the Cloudflare WARP client using Microsoft Intun To deploy WARP on Windows using Intune: -1. [Download the `Cloudflare_WARP_.msi` installer](/cloudflare-one/connections/connect-devices/warp/download-warp/#windows). +1. [Download the `Cloudflare_WARP_.msi` installer](/cloudflare-one/team-and-resources/devices/warp/download-warp/#windows). 2. Log in to your Microsoft Intune account. 3. Go to **Apps** > **All Apps** > **Add**. 4. In **App type**, select _Line-of-business app_ from the drop-down menu. Select **Select**. @@ -28,7 +28,7 @@ To deploy WARP on Windows using Intune: ```txt /qn ORGANIZATION="your-team-name" SUPPORT_URL="http://support.example.com" ``` - Refer to [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument. You can change these parameters at any time by pushing a new [MDM file](#update-mdm-parameters). + Refer to [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument. You can change these parameters at any time by pushing a new [MDM file](#update-mdm-parameters). 10. Select **Next**. 11. Add the users or groups who require Cloudflare WARP and select **Next**. 12. Review your configuration and select **Create**. @@ -37,7 +37,7 @@ Intune is now configured to deploy the WARP client. ### Update MDM parameters -You can use Intune to update [MDM parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for the WARP client. On Windows, these parameters are stored on the local device in `C:\ProgramData\Cloudflare\mdm.xml`. +You can use Intune to update [MDM parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) for the WARP client. On Windows, these parameters are stored on the local device in `C:\ProgramData\Cloudflare\mdm.xml`. To push a new `mdm.xml` file using Intune: @@ -46,7 +46,7 @@ To push a new `mdm.xml` file using Intune: 3. Select the **Platform scripts** tab and select **Add**. 4. Select **Windows 10 and later**. 5. Enter a name for the script (for example, `Deploy Cloudflare mdm.xml`). -6. In **PowerShell script**, upload the following `.ps1` file. Be sure to modify the XML content with your desired [parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/). +6. In **PowerShell script**, upload the following `.ps1` file. Be sure to modify the XML content with your desired [parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/). ```powershell title="mdm-template.ps1" # Define the path to the file @@ -130,13 +130,13 @@ Deploy configuration profiles (steps 1, 2, and 3) before the WARP application (s ### 1. Upload user-side certificate -You must deploy a [user-side certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) so that devices managed by Intune can establish trust with Cloudflare when their traffic is inspected. +You must deploy a [user-side certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) so that devices managed by Intune can establish trust with Cloudflare when their traffic is inspected. 1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). 2. Go to **Settings** > **Resources** > under **Certificates**, select **Manage**. -3. Find your [certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/) and select the three dotted icon next to it > select **Download .crt**. +3. Find your [certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) and select the three dotted icon next to it > select **Download .crt**. 4. In the [Microsoft Intune admin center](https://intune.microsoft.com), go to **Devices** > select **macOS**. @@ -254,7 +254,7 @@ This step allows WARP to install without user interaction. By completing this st 3. Update your organization's string (`YOUR_TEAM_NAME_HERE`) with your [team name](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name). -4. Modify the file with your desired [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/). +4. Modify the file with your desired [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/). ```xml @@ -298,7 +298,7 @@ Complete Step 4 at least one hour after steps 1, 2, and 3 so clients have enough 2. Go to **Settings** > **Resources** > find macOS under **Download the WARP client** > select **Download release**. - You will be taken to the WARP documentation on [stable releases for macOS](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) and download a `.pkg` file. + You will be taken to the WARP documentation on [stable releases for macOS](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos) and download a `.pkg` file. :::note[Repeat this step to update WARP when a new release is available] Every time WARP releases a new version, you must repeat this process and get a new `.pkg` file for the new WARP version. @@ -311,7 +311,7 @@ Complete Step 4 at least one hour after steps 1, 2, and 3 so clients have enough 6. In **App information**, select the `.pkg` file you downloaded and input required details. Enter `Cloudflare` as the Publisher. -7. In **Requirements**, refer to the OS versions listed in [stable releases for macOS](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) and find what matches for you. +7. In **Requirements**, refer to the OS versions listed in [stable releases for macOS](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos) and find what matches for you. 8. In **Detection rules**, note that the WARP package will have filled in the App bundle ID and App version. @@ -323,9 +323,9 @@ By completing this step, you deliver the WARP client to targeted macOS devices, ## iOS -Refer to the [generic instructions for iOS](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#ios). +Refer to the [generic instructions for iOS](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#ios). -Intune allows you to insert [predefined variables](https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#tokens-used-in-the-property-list) into the XML configuration file. For example, you can set the [`unique_client_id`](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#unique_client_id) key to `{{deviceid}}` for a [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid/) deployment. +Intune allows you to insert [predefined variables](https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#tokens-used-in-the-property-list) into the XML configuration file. For example, you can set the [`unique_client_id`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#unique_client_id) key to `{{deviceid}}` for a [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid/) deployment. ### Per-app VPN for iOS @@ -333,7 +333,7 @@ Intune allows you to insert [predefined variables](https://learn.microsoft.com/e Per-app VPN is supported on Cloudflare One Agent version `1.8` or greater for iOS. ::: -Before proceeding with per-app VPN configuration, you must make sure [Auto connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect) is disabled in Zero Trust. To disable Auto connect: +Before proceeding with per-app VPN configuration, you must make sure [Auto connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect) is disabled in Zero Trust. To disable Auto connect: 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**. 2. Under **Device Settings**, select your device profile and select **Edit**. @@ -398,7 +398,7 @@ To deploy WARP on Android devices: 8. For **Platform**, select _Android Enterprise_. 9. Choose your desired **Profile Type**. 10. For **Targeted app**, select **Cloudflare One Agent**. Select **Next**. -11. For **Configuration settings format**, select _Enter JSON data_. Enter your desired [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) in the `managedProperty` field. For example: +11. For **Configuration settings format**, select _Enter JSON data_. Enter your desired [deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/) in the `managedProperty` field. For example: ```json { @@ -582,7 +582,7 @@ To configure your Cloudflare One Agent app policy: } ``` - Refer to [Per-app VPN parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#per-app-vpn-parameters-android) to learn more about the MDM parameters introduced to support the per-app VPN for Android devices. + Refer to [Per-app VPN parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#per-app-vpn-parameters-android) to learn more about the MDM parameters introduced to support the per-app VPN for Android devices. 3. After you have configured the deployment parameters, click **Next**. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/jamf.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/jamf.mdx similarity index 90% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/jamf.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/jamf.mdx index ceef05b9241694..38f03169b746ea 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/jamf.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/jamf.mdx @@ -13,9 +13,9 @@ import { Render } from "~/components"; ### Prerequisites -- [Download the `Cloudflare_WARP.pkg` file](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) +- [Download the `Cloudflare_WARP.pkg` file](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos) -- [Create a `plist` file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#create-plist-file) +- [Create a `plist` file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#create-plist-file) ### 1. Upload the WARP package @@ -55,7 +55,7 @@ The Cloudflare One Agent allows for an automated install via Jamf. ### Prerequisites -Create an [XML file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#ios) with your custom deployment preferences. +Create an [XML file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#ios) with your custom deployment preferences. ### Configure Jamf for iOS @@ -78,7 +78,7 @@ Jamf is now configured to deploy the Cloudflare One Agent. Per-app VPN is supported on Cloudflare One Agent version `1.8` or greater for iOS. ::: -Before proceeding with per-app VPN configuration, you must make sure [Auto connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect) is disabled in Zero Trust. To disable Auto connect: +Before proceeding with per-app VPN configuration, you must make sure [Auto connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect) is disabled in Zero Trust. To disable Auto connect: 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **WARP Client**. 2. Under **Device Settings**, select your device profile and select **Edit**. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/jumpcloud.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/jumpcloud.mdx similarity index 95% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/jumpcloud.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/jumpcloud.mdx index 522f876445c0ac..7dd3671c77ed5c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/jumpcloud.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/jumpcloud.mdx @@ -55,7 +55,7 @@ Verify that Cloudflare WARP was installed by selecting the app and viewing the * 4. In the **Software Description** field, enter a unique display name. -5. In the **Software Package URL**, enter the URL location of the `Cloudflare_WARP_.pkg` file. If you do not already have the installer package, [download it here](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos). +5. In the **Software Package URL**, enter the URL location of the `Cloudflare_WARP_.pkg` file. If you do not already have the installer package, [download it here](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos). 6. Select the device(s) you want to deploy the app to: - **Single device**: Go to the **Devices** tab and select the target device. To select all devices, select the checkbox next to **Type**. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/kandji.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/kandji.mdx similarity index 99% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/kandji.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/kandji.mdx index 5abae268925969..158812857116f0 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/kandji.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/kandji.mdx @@ -48,7 +48,7 @@ For the simplest deployment, Kandji has created a downloadable configuration pro 6. In the **Install Details** section, select **Installer Package**. - 7. Under **Installer Package**, upload the `Cloudflare_WARP_.pkg` file. If you do not already have the installer package, [download it here](/cloudflare-one/connections/connect-devices/warp/download-warp/#macos). + 7. Under **Installer Package**, upload the `Cloudflare_WARP_.pkg` file. If you do not already have the installer package, [download it here](/cloudflare-one/team-and-resources/devices/warp/download-warp/#macos). 8. Select **Save**. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/protocol-handler.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/protocol-handler.mdx similarity index 87% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/protocol-handler.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/protocol-handler.mdx index 3cf3d49d27709d..54fddf2d7ea64f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/protocol-handler.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/protocol-handler.mdx @@ -20,14 +20,14 @@ During the default WARP enrollment process, end users typically need to complete This guide covers how to eliminate steps 1, 2 and 4 from your WARP deployment. :::note[Service token authentication] -If you are looking to eliminate all user interaction, you can [enroll devices using service tokens](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token). Because users are not required to log in to an identity provider, identity-based policies and logging will not be available on these devices. +If you are looking to eliminate all user interaction, you can [enroll devices using service tokens](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#check-for-service-token). Because users are not required to log in to an identity provider, identity-based policies and logging will not be available on these devices. ::: On iOS and Android / ChromeOS, end users will still be asked questions required by their platform such as accepting notifications or installing the VPN Profile. ## Turn off onboarding screens -To skip the Terms and Conditions screens that are usually presented to users, set the [`onboarding` parameter](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to `false` in your [MDM deployment file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/). Here is an example `mdm.xml` file: +To skip the Terms and Conditions screens that are usually presented to users, set the [`onboarding` parameter](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) to `false` in your [MDM deployment file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/). Here is an example `mdm.xml` file: ```xml @@ -40,7 +40,7 @@ To skip the Terms and Conditions screens that are usually presented to users, se ## Turn on Instant Auth -If you are only using one identity provider for device enrollment, turn on **Instant Auth** in your [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions). This allow users to skip the Cloudflare Access login page and go directly to your SSO login event. +If you are only using one identity provider for device enrollment, turn on **Instant Auth** in your [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions). This allow users to skip the Cloudflare Access login page and go directly to your SSO login event. ## Allow browser to launch WARP @@ -70,12 +70,12 @@ To add the registry key manually: Be sure to replace `` with your actual Zero Trust team name. -Instead of using the Registry Editor, the registry key can also be created using a Group Policy Object (GPO), PowerShell script, or with an MDM such as [Intune](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune/#update-mdm-parameters). +Instead of using the Registry Editor, the registry key can also be created using a Group Policy Object (GPO), PowerShell script, or with an MDM such as [Intune](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune/#update-mdm-parameters). -On macOS, you can configure `AutoLaunchProtocolsFromOrigins` by deploying a property list (plist) file for the browser. The exact instructions will vary depending on your [MDM](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/). The general procedure is as follows: +On macOS, you can configure `AutoLaunchProtocolsFromOrigins` by deploying a property list (plist) file for the browser. The exact instructions will vary depending on your [MDM](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/). The general procedure is as follows: 1. Create a new plist file with the following name (case sensitive): - Google Chrome: `com.google.Chrome.plist` diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/switch-organizations.mdx similarity index 73% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/switch-organizations.mdx index f73eb9fa7cc16b..4d866f4219dd8b 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/switch-organizations.mdx @@ -9,7 +9,7 @@ import { Details, Render, TabItem, Tabs } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -24,15 +24,15 @@ import { Details, Render, TabItem, Tabs } from "~/components";
-In Cloudflare WARP, users can switch between multiple Zero Trust organizations (or other [MDM parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/)) that administrators specify in an MDM file. Common use cases include: +In Cloudflare WARP, users can switch between multiple Zero Trust organizations (or other [MDM parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/)) that administrators specify in an MDM file. Common use cases include: - Allow IT security staff to switch between test and production environments. - Allow Managed Service Providers to support multiple customer accounts. -- Allow users to switch between the default WARP ingress IPs and the [Cloudflare China ingress IPs](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint). +- Allow users to switch between the default WARP ingress IPs and the [Cloudflare China ingress IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint). ## MDM file format -To enable multiple organizations, administrators need to modify their [MDM file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to take an array of configurations. Each configuration must include a `display_name` parameter that will be visible to users in the WARP client GUI. Because display names are listed in the same order as they appear in the MDM file, we recommend putting the most used configurations at the top of the file. When a user opens the WARP client for the first time, they will be prompted to log into the first configuration in the list. +To enable multiple organizations, administrators need to modify their [MDM file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) to take an array of configurations. Each configuration must include a `display_name` parameter that will be visible to users in the WARP client GUI. Because display names are listed in the same order as they appear in the MDM file, we recommend putting the most used configurations at the top of the file. When a user opens the WARP client for the first time, they will be prompted to log into the first configuration in the list. An MDM file supports a maximum of 25 configurations. The following example includes three configurations. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser.mdx similarity index 83% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser.mdx index 8aa72d8e80609c..0ab28f8e46a29f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser.mdx @@ -9,7 +9,7 @@ import { Details, Render } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | All modes | All plans | @@ -32,7 +32,7 @@ If a user enables **Log DNS queries** in the WARP GUI (or runs `warp-cli dns log ## Enable multi-user mode -To enable multi-user support on Windows, [deploy an MDM file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#windows) onto the device with the `multi_user` key set to `true`. For example: +To enable multi-user support on Windows, [deploy an MDM file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#windows) onto the device with the `multi_user` key set to `true`. For example: ```xml @@ -50,7 +50,7 @@ To enable multi-user support on Windows, [deploy an MDM file](/cloudflare-one/co ``` -To use multi-user mode alongside the [Windows pre-login](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/) and [Switch between Zero Trust organizations](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations/) options: +To use multi-user mode alongside the [Windows pre-login](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin/) and [Switch between Zero Trust organizations](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/switch-organizations/) options: ```xml @@ -114,7 +114,7 @@ flowchart TB Requires [multi-user mode](#enable-multi-user-mode). ::: -[Fast user switching](https://learn.microsoft.com/windows/win32/shell/fast-user-switching) is a Windows feature that allows users to switch accounts without logging out. With fast user switching, multiple users may be logged in to the device and generating network traffic. The WARP client will attribute all traffic to the user who has the [interactive windows station](http://techcommunity.microsoft.com/blog/askperf/sessions-desktops-and-windows-stations/372473). For example, if user A is logged in and fast user switches to user B, traffic from both accounts will appear to come from user B. This is because user B is now actively using the Windows desktop GUI. Now assume that user B logs out and there is no [pre-login registration](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/); WARP will continue to attribute traffic to user B until user A logs back in to the Windows desktop. +[Fast user switching](https://learn.microsoft.com/windows/win32/shell/fast-user-switching) is a Windows feature that allows users to switch accounts without logging out. With fast user switching, multiple users may be logged in to the device and generating network traffic. The WARP client will attribute all traffic to the user who has the [interactive windows station](http://techcommunity.microsoft.com/blog/askperf/sessions-desktops-and-windows-stations/372473). For example, if user A is logged in and fast user switches to user B, traffic from both accounts will appear to come from user B. This is because user B is now actively using the Windows desktop GUI. Now assume that user B logs out and there is no [pre-login registration](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin/); WARP will continue to attribute traffic to user B until user A logs back in to the Windows desktop. -To accurately attribute network traffic to specific users, Cloudflare recommends disabling fast user switching or at the very least configuring a [pre-login registration](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/). +To accurately attribute network traffic to specific users, Cloudflare recommends disabling fast user switching or at the very least configuring a [pre-login registration](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin/). diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin.mdx similarity index 71% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin.mdx index 3fad42c4ab0ef5..1afd09f42fb5be 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-prelogin.mdx @@ -9,7 +9,7 @@ import { Details, Render } from "~/components";
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | |
  • Gateway with WARP
  • Gateway with DoH
  • Secure Web Gateway without DNS filtering
  • Proxy mode
| All plans | @@ -28,7 +28,7 @@ With Cloudflare Zero Trust, you can use an on-premise Active Directory (or simil ## Prerequisites -- Active Directory resources are [connected to Cloudflare](/cloudflare-one/connections/connect-networks/private-net/). +- Active Directory resources are [connected to Cloudflare](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/). ## 1. Create a service token @@ -36,7 +36,7 @@ With Cloudflare Zero Trust, you can use an on-premise Active Directory (or simil ## 2. Create a device enrollment policy -In your [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions), create the following policy: +In your [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions), create the following policy: | Rule Action | Rule type | Selector | Value | | ------------ | --------- | ------------- | -------------- | @@ -44,7 +44,7 @@ In your [device enrollment permissions](/cloudflare-one/connections/connect-devi ## 2. (Optional) Restrict access during pre-login -Devices enrolled via a service token are identified by the email address `non_identity@.cloudflareaccess.com`. Using this email address, you can apply specific [device profile settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) and [Gateway network policies](/cloudflare-one/policies/gateway/network-policies/) during the pre-login state. For example, you could provide access to only those resources necessary to complete the Windows login and/or device management activities. +Devices enrolled via a service token are identified by the email address `non_identity@.cloudflareaccess.com`. Using this email address, you can apply specific [device profile settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) and [Gateway network policies](/cloudflare-one/policies/gateway/network-policies/) during the pre-login state. For example, you could provide access to only those resources necessary to complete the Windows login and/or device management activities.
@@ -71,7 +71,7 @@ Devices enrolled via a service token are identified by the email address `non_id ## 3. Configure the MDM file -To enable the Windows pre-login feature, an MDM file in the following format must be [deployed](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#windows) on the device. In the following example, the `pre_login` key allows the device to connect using the service token, while `configs` contains your default Zero Trust configuration. +To enable the Windows pre-login feature, an MDM file in the following format must be [deployed](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#windows) on the device. In the following example, the `pre_login` key allows the device to connect using the service token, while `configs` contains your default Zero Trust configuration. ```xml @@ -100,6 +100,6 @@ WARP will apply the pre-login configuration when no other WARP registration exis After the user logs into Windows, WARP will automatically switch to the default MDM configuration and prompt the user to authenticate with the IdP. Once authenticated, WARP registers and connects with the user identity. The **My Team** > **Devices** page will now show a new device associated with the user's email. -If [multi-user mode](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is turned off, this user registration will be used for any subsequent connections, including before the next Windows user login. Deleting the user registration would cause WARP to switch back to the pre-login configuration as soon as the user logs out of Windows. +If [multi-user mode](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser/) is turned off, this user registration will be used for any subsequent connections, including before the next Windows user login. Deleting the user registration would cause WARP to switch back to the pre-login configuration as soon as the user logs out of Windows. -To learn how the pre-login configuration works with [multi-user mode](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/), refer to the [WARP registration flowchart](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/#warp-registration-logic). +To learn how the pre-login configuration works with [multi-user mode](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser/), refer to the [WARP registration flowchart](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/windows-multiuser/#warp-registration-logic). diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/vpn.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/vpn.mdx similarity index 66% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/vpn.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/vpn.mdx index 94b65f66cc9513..1b3421213e015a 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/vpn.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/vpn.mdx @@ -10,14 +10,14 @@ import { Render } from "~/components"; The Cloudflare WARP client can run alongside most legacy third-party VPNs. Because the WARP client and third-party VPN client both enforce firewall, routing, and DNS rules on your local device, the two products will compete with each other for control over IP and DNS traffic. To ensure compatibility make sure that: - IP traffic is split tunneled between WARP and the VPN. All VPN traffic must bypass WARP and vice versa. -- The VPN bypasses/allows/excludes all domains, IPs, and ports listed in [WARP with firewall](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +- The VPN bypasses/allows/excludes all domains, IPs, and ports listed in [WARP with firewall](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). - DNS resolution is handled by either WARP or the VPN. You must disable DNS filtering in one of the two products. -For the most stable and consistent connection, we recommend connecting your [private network or individual applications](/cloudflare-one/connections/connect-networks/private-net/) to Cloudflare instead of using a legacy VPN. However, until you can migrate, the following guidelines will help get your Zero Trust deployment up and running. +For the most stable and consistent connection, we recommend connecting your [private network or individual applications](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) to Cloudflare instead of using a legacy VPN. However, until you can migrate, the following guidelines will help get your Zero Trust deployment up and running. ## Gateway with WARP -In [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode, WARP must be allowed to capture and route all DNS traffic on the device. You can use [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) to send DNS requests to a server behind your third-party VPN or firewall, but the request must first go through WARP's local DNS proxy. Refer to [WARP architecture](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/) for more information about this requirement. +In [Gateway with WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode, WARP must be allowed to capture and route all DNS traffic on the device. You can use [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) to send DNS requests to a server behind your third-party VPN or firewall, but the request must first go through WARP's local DNS proxy. Refer to [WARP architecture](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/) for more information about this requirement. If you cannot disable DNS on your VPN, switch to [Secure Web Gateway without DNS filtering](#secure-web-gateway-without-dns-filtering) mode to disable DNS in WARP. @@ -33,7 +33,7 @@ Perform these steps in your third-party VPN software. Refer to your VPN's docume -3. (Optional) In [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/), add the domains that you want to resolve using your VPN's private DNS servers. For example, +3. (Optional) In [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/), add the domains that you want to resolve using your VPN's private DNS servers. For example, | Domain | DNS Servers | | ------------------------ | -------------------------------- | | `internal.wiki.intranet` | `172.31.26.130`, `172.31.23.120` | @@ -42,7 +42,7 @@ You can now [test](#test-the-configuration) if WARP runs alongside the VPN. ## Secure Web Gateway without DNS filtering -In [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) mode, WARP does not perform any DNS functions on the device. Therefore, all you need to do is split tunnel your IP traffic. +In [Secure Web Gateway without DNS filtering](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) mode, WARP does not perform any DNS functions on the device. Therefore, all you need to do is split tunnel your IP traffic. ### 1. Configure the VPN diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/beta-releases.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/beta-releases.mdx similarity index 79% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/beta-releases.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/beta-releases.mdx index 3c03b5ab9e3df0..7d66a03e5fd6bf 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/beta-releases.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/beta-releases.mdx @@ -8,7 +8,7 @@ sidebar: import { Render, Details, LinkButton, WARPReleases } from "~/components"; -Cloudflare tests new WARP features and improvements in an unstable beta release before adding them to the [stable release](/cloudflare-one/connections/connect-devices/warp/download-warp/). Beta releases are not recommended for production environments. To get early access to new features, download the latest beta client from the links below. +Cloudflare tests new WARP features and improvements in an unstable beta release before adding them to the [stable release](/cloudflare-one/team-and-resources/devices/warp/download-warp/). Beta releases are not recommended for production environments. To get early access to new features, download the latest beta client from the links below. ## Windows diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration.mdx similarity index 86% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration.mdx index 9366cd8aa2e598..d7e937407169df 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration.mdx @@ -41,12 +41,12 @@ If you downloaded and installed the 1.1.1.1 app manually, here are the recommend This prevents certificate pinning issues when performing the Android migration. -3. Follow [these instructions](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/#ios-android-and-chromeos) to install and enroll the Cloudflare One Agent. +3. Follow [these instructions](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/#ios-android-and-chromeos) to install and enroll the Cloudflare One Agent. 1. Update the **1.1.1.1** app to version 6.22 or above. The update ensures that 1.1.1.1 can [co-exist](#what-to-do-with-the-old-app) with the new Cloudflare One Agent app. -2. [Download](/cloudflare-one/connections/connect-devices/warp/download-warp/#ios) the **Cloudflare One Agent** app. +2. [Download](/cloudflare-one/team-and-resources/devices/warp/download-warp/#ios) the **Cloudflare One Agent** app. 3. Launch the Cloudflare One Agent app. All settings from 1.1.1.1 will automatically migrate over to the Cloudflare One Agent. The user does not need to reauthenticate. @@ -63,11 +63,11 @@ To access your company's resources, you must use the Cloudflare One Agent app. You can use the 1.1.1.1 app for personal browsing. When connected to 1.1.1.1 w/ WARP, your traffic will be encrypted and privately routed via Cloudflare's network, and your employer will not be able to see any of your browsing activity. To learn more about consumer WARP services, refer to [WARP client](/warp-client/). -If you do not wish to use the old 1.1.1.1 app for personal browsing, you may [uninstall](/cloudflare-one/connections/connect-devices/warp/remove-warp/#ios-and-android) it. +If you do not wish to use the old 1.1.1.1 app for personal browsing, you may [uninstall](/cloudflare-one/team-and-resources/devices/warp/remove-warp/#ios-and-android) it. ### Migrate managed deployments -If you deployed the 1.1.1.1 app with an [MDM provider](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/), perform the migration as follows: +If you deployed the 1.1.1.1 app with an [MDM provider](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/), perform the migration as follows: @@ -75,13 +75,13 @@ If you deployed the 1.1.1.1 app with an [MDM provider](/cloudflare-one/connectio 2. Add the **Cloudflare One Agent** app from the Google Play store. Its application ID is `com.cloudflare.cloudflareoneagent`. -3. Copy your [MDM deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#android--chromeos) for the **1.1.1.1** app. +3. Copy your [MDM deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#android--chromeos) for the **1.1.1.1** app. 4. Paste the MDM deployment parameters into the **Cloudflare One Agent** app configuration. Make sure that you do not accidentally overwrite the application ID (`com.cloudflare.cloudflareoneagent`). 5. Using your MDM tool, install the **Cloudflare One Agent** on your devices. -6. On Android, the user will need to [re-authenticate](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/#ios-android-and-chromeos) to the new application, following the same onboarding steps they went through initially. +6. On Android, the user will need to [re-authenticate](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/#ios-android-and-chromeos) to the new application, following the same onboarding steps they went through initially. @@ -89,7 +89,7 @@ If you deployed the 1.1.1.1 app with an [MDM provider](/cloudflare-one/connectio 2. Add the **Cloudflare One Agent** app from the App store. Its application ID is `com.cloudflare.cloudflareoneagent`. -3. Copy your [MDM deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#ios) for the **1.1.1.1** app. +3. Copy your [MDM deployment parameters](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#ios) for the **1.1.1.1** app. 4. Paste the MDM deployment parameters into the **Cloudflare One Agent** app configuration. Make sure that you do not accidentally overwrite the application ID (`com.cloudflare.cloudflareoneagent`). diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/index.mdx similarity index 89% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/index.mdx index 1210b2492836d6..7979dbadcdd4d1 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/index.mdx @@ -12,7 +12,7 @@ import { Render, Details, LinkButton, WARPReleases } from "~/components"; This page contains the stable WARP client releases currently supported by Cloudflare. We recommend using stable releases for production environments. You can download stable releases from the links below after checking requirements. -Cloudflare also offers an unstable beta release track with the latest features and improvements. To preview new features before they are available in a stable release, refer to the [beta release page](/cloudflare-one/connections/connect-devices/warp/download-warp/beta-releases/). +Cloudflare also offers an unstable beta release track with the latest features and improvements. To preview new features before they are available in a stable release, refer to the [beta release page](/cloudflare-one/team-and-resources/devices/warp/download-warp/beta-releases/). ## Windows @@ -54,7 +54,7 @@ Cloudflare also offers an unstable beta release track with the latest features a :::note[Migrate from 1.1.1.1] -The legacy iOS client, [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration/). +The legacy iOS client, [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration/). ::: @@ -68,7 +68,7 @@ The legacy iOS client, [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/ :::note[Migrate from 1.1.1.1] -The legacy Android client, [1.1.1.1 + WARP: Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/connections/connect-devices/warp/download-warp/cloudflare-one-agent-migration/). +The legacy Android client, [1.1.1.1 + WARP: Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone), has been replaced by the Cloudflare One Agent. Learn more in our [migration guide](/cloudflare-one/team-and-resources/devices/warp/download-warp/cloudflare-one-agent-migration/). ::: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/update-warp.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/update-warp.mdx similarity index 76% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/update-warp.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/update-warp.mdx index 73dece5b762e2c..0d664d6228ff1d 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/download-warp/update-warp.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/download-warp/update-warp.mdx @@ -18,7 +18,7 @@ We also recognize that there is a cost associated for a business to go through a Cloudflare does not operate on a major-release upgrade cycle; all releases for the WARP client are incremental. With this in mind, you should choose which releases make the most sense for your business. -Cloudflare publishes release notes for WARP on the [Downloads page](/cloudflare-one/connections/connect-devices/warp/download-warp/) and in the [WARP changelog](/cloudflare-one/changelog/warp/). You can look at the release notes to determine whether there is an explicit reason for updating to the latest release. +Cloudflare publishes release notes for WARP on the [Downloads page](/cloudflare-one/team-and-resources/devices/warp/download-warp/) and in the [WARP changelog](/cloudflare-one/changelog/warp/). You can look at the release notes to determine whether there is an explicit reason for updating to the latest release. ### Support lifecycle @@ -30,11 +30,11 @@ Cloudflare supports WARP client versions for at least one year from release. Aft #### Managed devices -JAMF, Intune, and other MDM tools perform software updates by installing a new binary file. If you deployed WARP using a [device management tool](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/), the update procedure will look exactly the same as your initial installation. To update WARP, simply push the [latest binary file](/cloudflare-one/connections/connect-devices/warp/download-warp/) with the same deployment parameters. End users will not be signed out of their client, and they will not have to manually engage with the update. +JAMF, Intune, and other MDM tools perform software updates by installing a new binary file. If you deployed WARP using a [device management tool](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/), the update procedure will look exactly the same as your initial installation. To update WARP, simply push the [latest binary file](/cloudflare-one/team-and-resources/devices/warp/download-warp/) with the same deployment parameters. End users will not be signed out of their client, and they will not have to manually engage with the update. #### Unmanaged devices -If your users have local administration rights on their device, you can allow them to update WARP on their own via the WARP GUI. [**Allow updates**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-updates) is usually disabled on managed devices, as it can introduce version consistency control issues if WARP versions are centrally managed by IT. +If your users have local administration rights on their device, you can allow them to update WARP on their own via the WARP GUI. [**Allow updates**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-updates) is usually disabled on managed devices, as it can introduce version consistency control issues if WARP versions are centrally managed by IT. ### iOS, Android, and ChromeOS diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx similarity index 70% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx index 37499783783bef..db40d449a38717 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx @@ -20,10 +20,10 @@ WARP is a device client that builds proxy tunnels using either Wireguard or MASQ The WARP client consists of: -- Graphical User Interface (GUI): Control panel that allows end users to view WARP's [status](/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status/) and perform actions such as turning WARP on or off. +- Graphical User Interface (GUI): Control panel that allows end users to view WARP's [status](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status/) and perform actions such as turning WARP on or off. - WARP daemon (or service): Core background component responsible for establishing secure tunnels (using WireGuard or MASQUE) and handling all WARP functionality on your device. -For more information on how the WARP client routes traffic, refer to the [WARP architecture page](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/) and watch the video below. +For more information on how the WARP client routes traffic, refer to the [WARP architecture page](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/) and watch the video below. DoH subdomain to that location, which you can add when deploying the WARP client to your devices. +The WARP client will direct DoH queries to a default DNS endpoint when enrolled to your Zero Trust organization. If you need to direct these queries to a separate DNS endpoint, [add a DNS location](/cloudflare-one/team-and-resources/devices/agentless/dns/locations/) to Gateway. Gateway will assign a DoH subdomain to that location, which you can add when deploying the WARP client to your devices. ### 5. Download and deploy the WARP client to your devices. -Choose one of the [different ways](/cloudflare-one/connections/connect-devices/warp/deployment/) to deploy the WARP client, depending on what works best for your organization. +Choose one of the [different ways](/cloudflare-one/team-and-resources/devices/warp/deployment/) to deploy the WARP client, depending on what works best for your organization. Next, create [DNS policies](/cloudflare-one/policies/gateway/dns-policies/) to control how DNS queries from your devices get resolved. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors.mdx similarity index 67% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors.mdx index 1276f8821ecbe9..8924dba62912a4 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors.mdx @@ -8,7 +8,7 @@ sidebar: import { Details } from "~/components" -This page lists the error codes that can appear in the WARP client GUI. If you do not see your error below, refer to [common issues](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/) or [contact Cloudflare Support](/support/contacting-cloudflare-support/). +This page lists the error codes that can appear in the WARP client GUI. If you do not see your error below, refer to [common issues](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/) or [contact Cloudflare Support](/support/contacting-cloudflare-support/).
@@ -25,15 +25,15 @@ This page lists the error codes that can appear in the WARP client GUI. If you d ### Cause -[Captive portal detection](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#captive-portal-detection) is turned on and one of the following issues occurred: +[Captive portal detection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#captive-portal-detection) is turned on and one of the following issues occurred: * The user did not complete the captive portal login process within the time limit set by WARP. * The captive portal redirected the user to a flow that is not yet supported by the captive portal detection feature. ### Resolution -1. Increase the [captive portal timeout](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#captive-portal-detection) to allow users more time to login. -2. If this does not resolve the issue, allow users to manually [turn off WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch). We recommend setting an [auto connect](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#auto-connect) value so that the client turns itself back on after a few minutes. +1. Increase the [captive portal timeout](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#captive-portal-detection) to allow users more time to login. +2. If this does not resolve the issue, allow users to manually [turn off WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#lock-warp-switch). We recommend setting an [auto connect](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#auto-connect) value so that the client turns itself back on after a few minutes. ## CF\_CONNECTIVITY\_FAILURE\_UNKNOWN @@ -45,12 +45,12 @@ This page lists the error codes that can appear in the WARP client GUI. If you d ### Cause -The initial [connectivity check](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#connectivity-checks) failed for an unknown reason. Refer to [Unable to connect WARP](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#unable-to-connect-warp) for the most common reasons why this error occurs. +The initial [connectivity check](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#connectivity-checks) failed for an unknown reason. Refer to [Unable to connect WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/#unable-to-connect-warp) for the most common reasons why this error occurs. ### Resolution -1. Retrieve [WARP debug logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for the device. -2. Follow the troubleshooting steps in [Unable to connect WARP](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#unable-to-connect-warp). +1. Retrieve [WARP debug logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/) for the device. +2. Follow the troubleshooting steps in [Unable to connect WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/#unable-to-connect-warp). ## CF\_DNS\_LOOKUP\_FAILURE @@ -62,24 +62,24 @@ The initial [connectivity check](/cloudflare-one/connections/connect-devices/war ### Cause -WARP was unable to resolve hostnames via its [local DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic). +WARP was unable to resolve hostnames via its [local DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic). ### Resolution 1. Verify that the network the user is on has DNS connectivity. 2. Verify that DNS resolution works when WARP is disabled. 3. Ensure that no third-party tools are interfering with WARP for control of DNS. -4. Ensure that no third-party tools are [performing TLS decryption](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#a-third-party-security-product-is-interfering-with-gateway) on traffic to the [WARP IP addresses](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +4. Ensure that no third-party tools are [performing TLS decryption](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/#a-third-party-security-product-is-interfering-with-gateway) on traffic to the [WARP IP addresses](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). ## CF\_DNS\_PROXY\_FAILURE ### Symptoms -* Unable to connect WARP in a [mode that enables DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/). +* Unable to connect WARP in a [mode that enables DNS filtering](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/). ### Cause -A third-party process (usually a third-party DNS software) is bound to port `53`, which is used by WARP's [local DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) to perform DNS resolution. The name of third-party process will appear in the GUI error message. +A third-party process (usually a third-party DNS software) is bound to port `53`, which is used by WARP's [local DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) to perform DNS resolution. The name of third-party process will appear in the GUI error message. On macOS, you may see `mDNSResponder` instead of the specific application name -- `mDNSResponder` is a macOS system process that handles DNS requests on behalf of other processes. There is no known way to determine which process caused `mDNSResponder` to bind to port `53`, but the most common culprits are virtual machine software (for example, Docker and VMware Workstation) and the macOS Internet Sharing feature. @@ -104,7 +104,7 @@ Below is a non-exhaustive list of third-party software that are known to cause `
-2. Alternatively, switch WARP to [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) mode. +2. Alternatively, switch WARP to [Secure Web Gateway without DNS filtering](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) mode. ## CF\_FAILED\_READ\_SYSTEM\_DNS\_CONFIG @@ -119,7 +119,7 @@ WARP could not read the system DNS configuration, most likely because it contain ### Resolution -On macOS and Linux, validate that `/etc/resolv.conf` is [formatted correctly](https://man7.org/linux/man-pages/man5/resolv.conf.5.html) and check for [invalid characters](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#maclinux-the-devices-etcresolvconf-file-has-an-invalid-character). +On macOS and Linux, validate that `/etc/resolv.conf` is [formatted correctly](https://man7.org/linux/man-pages/man5/resolv.conf.5.html) and check for [invalid characters](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/#maclinux-the-devices-etcresolvconf-file-has-an-invalid-character). On Windows, validate that the registry entry `HKLM\System\CurrentControlSet\Services\TCPIP\Parameters\SearchList` contains only valid search domains. Examples of invalid entries include IP addresses and domains that start with a period (such as `.local`). @@ -131,7 +131,7 @@ On Windows, validate that the registry entry `HKLM\System\CurrentControlSet\Serv ### Cause -The device failed to present a [valid mTLS certificate](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-mtls-certificate) during device enrollment. +The device failed to present a [valid mTLS certificate](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/#check-for-mtls-certificate) during device enrollment. ### Resolution @@ -150,7 +150,7 @@ A router, firewall, antivirus software, or other third-party security product is ### Resolution -1. Configure the third-party security product to allow the [WARP ingress IPs and ports](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip). +1. Configure the third-party security product to allow the [WARP ingress IPs and ports](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#warp-ingress-ip). 2. Ensure that your Internet router is working properly and try rebooting the router. 3. Check that the device is not revoked by going to **My team** > **Devices**. @@ -164,12 +164,12 @@ A router, firewall, antivirus software, or other third-party security product is ### Cause -The [connectivity check](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#connectivity-checks) inside of the WARP tunnel has failed. +The [connectivity check](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#connectivity-checks) inside of the WARP tunnel has failed. ### Resolution -1. Check for the presence of third-party HTTP filtering software (AV, DLP, or firewall) that could be intercepting traffic to the [WARP IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall). -2. In the third-party software, bypass inspection for all IP traffic going through WARP. To find out what traffic routes through the WARP tunnel, refer to [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). +1. Check for the presence of third-party HTTP filtering software (AV, DLP, or firewall) that could be intercepting traffic to the [WARP IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall). +2. In the third-party software, bypass inspection for all IP traffic going through WARP. To find out what traffic routes through the WARP tunnel, refer to [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). ## CF\_INSUFFICIENT\_DISK @@ -184,7 +184,7 @@ The hard drive is full or has incorrect permissions for WARP to write data. ### Resolution -1. Ensure that your device meets the [HD space requirements](/cloudflare-one/connections/connect-devices/warp/download-warp/) for WARP. +1. Ensure that your device meets the [HD space requirements](/cloudflare-one/team-and-resources/devices/warp/download-warp/) for WARP. 2. Check for disk permissions that may prevent WARP from using disk space. 3. Empty trash or remove large files. @@ -216,7 +216,7 @@ The device does not have enough memory to run WARP. ### Resolution -1. Ensure that your device meets the [minimum memory requirements](/cloudflare-one/connections/connect-devices/warp/download-warp/) for WARP. +1. Ensure that your device meets the [minimum memory requirements](/cloudflare-one/team-and-resources/devices/warp/download-warp/) for WARP. 2. List all running processes to check memory usage. ## CF\_LOCAL\_POLICY\_FILE\_FAILED\_TO\_PARSE @@ -231,9 +231,9 @@ The WARP client was deployed on the device using an invalid MDM configuration fi ### Resolution -1. Review the [managed deployment guide](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) for your operating system. +1. Review the [managed deployment guide](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/) for your operating system. 2. Locate the MDM configuration file on your device. -3. Ensure that the file is formatted correctly and only contains [accepted arguments](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/). +3. Ensure that the file is formatted correctly and only contains [accepted arguments](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/). ## CF\_NO\_NETWORK @@ -272,7 +272,7 @@ The device is not authenticated to a Zero Trust organization because: 2. Select the gear icon and go to **Preferences** > **Account**. 3. Select **Re-Authenticate Session**. 4. Complete the authentication steps required by your organization. -5. If this does not resolve the error, select **Logout from Cloudflare Zero Trust** and then log back in. Logging out is only possible if [Allow device to leave organization](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) is enabled for your device. +5. If this does not resolve the error, select **Logout from Cloudflare Zero Trust** and then log back in. Logging out is only possible if [Allow device to leave organization](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) is enabled for your device. ## CF\_TLS\_INTERCEPTION\_BLOCKING\_DOH @@ -286,7 +286,7 @@ A third-party application or service is intercepting DNS over HTTPS traffic from ### Resolution -Configure the third-party application to exempt the [WARP DoH IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#doh-ip). +Configure the third-party application to exempt the [WARP DoH IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#doh-ip). ## CF\_TLS\_INTERCEPTION\_CHECK @@ -296,11 +296,11 @@ Configure the third-party application to exempt the [WARP DoH IPs](/cloudflare-o ### Cause -A third-party security product on the device or network is performing TLS decryption on HTTPS traffic. For more information, refer to the [Troubleshooting guide](/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues/#a-third-party-security-product-is-interfering-with-gateway). +A third-party security product on the device or network is performing TLS decryption on HTTPS traffic. For more information, refer to the [Troubleshooting guide](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues/#a-third-party-security-product-is-interfering-with-gateway). ### Resolution -In the third-party security product, disable HTTPS inspection and TLS decryption for the [WARP IP addresses](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +In the third-party security product, disable HTTPS inspection and TLS decryption for the [WARP IP addresses](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). ## Admin directed disconnect @@ -314,4 +314,4 @@ The account administrator has disconnected WARP for all devices registered to th ### Resolution -The account administrator must turn the [Global WARP override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#global-warp-override) feature off. \ No newline at end of file +The account administrator must turn the [Global WARP override](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#global-warp-override) feature off. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues.mdx similarity index 78% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues.mdx index b83ed1e1c1e19d..a240d764f09a4c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/common-issues.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/common-issues.mdx @@ -19,7 +19,7 @@ If WARP is stuck in the `Disconnected` state or frequently changes between `Conn -In your [WARP debug logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/), `daemon.log` will typically show one or more of the following errors: +In your [WARP debug logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/), `daemon.log` will typically show one or more of the following errors: - Happy Eyeball checks failing: @@ -42,7 +42,7 @@ A third-party service (such as a hardware or software firewall, router, MDM/grou #### Solution -Configure the third-party service to exempt the [IP addresses required by WARP](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +Configure the third-party service to exempt the [IP addresses required by WARP](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). ### A third-party VPN is interfering with WARP @@ -81,10 +81,10 @@ To confirm that the VPN is the source of the issue, temporarily uninstall (not d #### Solution 1. Disable all DNS enforcement on the VPN. WARP must be the last client to touch the primary and secondary DNS server on the default interface. -2. In [Zero Trust](https://one.dash.cloudflare.com/), create a [Split Tunnel rule](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) to exclude the VPN server you are connecting to (for example, `vpnserver.3rdpartyvpn.example.com`). -3. Configure your VPN to only include routes to your internal resources. Make sure that the VPN routes do not overlap with the routes [included in the WARP tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). +2. In [Zero Trust](https://one.dash.cloudflare.com/), create a [Split Tunnel rule](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) to exclude the VPN server you are connecting to (for example, `vpnserver.3rdpartyvpn.example.com`). +3. Configure your VPN to only include routes to your internal resources. Make sure that the VPN routes do not overlap with the routes [included in the WARP tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). -For more information, refer to our [guide](/cloudflare-one/connections/connect-devices/warp/deployment/vpn/) for running VPNs alongside the WARP client. +For more information, refer to our [guide](/cloudflare-one/team-and-resources/devices/warp/deployment/vpn/) for running VPNs alongside the WARP client. ### Your ISP or country is blocking WARP @@ -120,17 +120,17 @@ A misconfigured Gateway firewall policy can result in traffic to some or all sit ### The device does not have a root certificate installed -Installing and trusting a [root CA](/cloudflare-one/connections/connect-devices/user-side-certificates/) is a necessary step to enable advanced security features such as Browser Isolation, [TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/), AV scanning, and device posture. +Installing and trusting a [root CA](/cloudflare-one/team-and-resources/devices/user-side-certificates/) is a necessary step to enable advanced security features such as Browser Isolation, [TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/), AV scanning, and device posture. If the root CA is not installed on the device, you will see untrusted certificate warnings on every website. Example warnings include `Certificate not trusted`, `Not trusted identity` or `SSL Error`. #### Solution -[Install a Cloudflare certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/) on all of your devices, or [upload your own certificate](/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate/) to Cloudflare. +[Install a Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) on all of your devices, or [upload your own certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) to Cloudflare. :::note -More and more applications (including browsers) are relying on their own certificate stores. In addition to ensuring a root certificate is trusted at the device level, you may also need to [add the certificate to individual applications](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications). For example, to use Firefox on Linux, you must install the certificate on both the system and on Firefox. +More and more applications (including browsers) are relying on their own certificate stores. In addition to ensuring a root certificate is trusted at the device level, you may also need to [add the certificate to individual applications](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications). For example, to use Firefox on Linux, you must install the certificate on both the system and on Firefox. ::: @@ -142,7 +142,7 @@ To diagnose the issue, go to `https://zero-trust-client.cloudflareclient.com/v0/ #### Solution -In the third-party security product, disable HTTPS inspection and TLS decryption for the [WARP IP addresses](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). +In the third-party security product, disable HTTPS inspection and TLS decryption for the [WARP IP addresses](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). ### Docker container is failing DNS resolution @@ -151,7 +151,7 @@ The `168.63.129.16` IP address is only accessible to Azure VMs and causes the co #### Solution -To fix this issue, you must exclude the Azure-specific nameserver IP (`168.63.129.16`) from being routed through WARP tunnel. Refer to [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) and follow the instructions to exclude the Azure-specific IP. +To fix this issue, you must exclude the Azure-specific nameserver IP (`168.63.129.16`) from being routed through WARP tunnel. Refer to [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) and follow the instructions to exclude the Azure-specific IP. ## Cannot connect to a specific app or website @@ -165,7 +165,7 @@ Some applications do not support SSL inspection or are otherwise [incompatible w Applications such as Firefox, Docker, Python, and npm rely on their own certificate store and the Cloudflare root certificate must be trusted in each. -Refer to [our instructions](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications) for adding a root certificate to common applications. For applications not on our list, try searching the Internet for ` proxy support` or ` proxy certificate`. +Refer to [our instructions](/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications) for adding a root certificate to common applications. For applications not on our list, try searching the Internet for ` proxy support` or ` proxy certificate`. #### Solution (last resort) @@ -186,8 +186,8 @@ Some applications require traffic to flow either all inside or all outside of th #### Solution 1. Determine the IP addresses and/or domains required for your application to function. Common Internet search terms include ` split tunnel list`, ` allow list`, or ` firewall ips`. -2. In [Zero Trust](https://one.dash.cloudflare.com/), go to your [Split Tunnel settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). -3. Depending on the application, either include or exclude all of the necessary IPs and/or domains. For Microsoft applications, we provide a [one-click action](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic) to exclude all Microsoft 365 IPs. +2. In [Zero Trust](https://one.dash.cloudflare.com/), go to your [Split Tunnel settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). +3. Depending on the application, either include or exclude all of the necessary IPs and/or domains. For Microsoft applications, we provide a [one-click action](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic) to exclude all Microsoft 365 IPs. ## Troubleshooting diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status.mdx similarity index 54% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status.mdx index 9e21ba3e523f31..bc7c854d55ec8d 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/connectivity-status.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/connectivity-status.mdx @@ -8,26 +8,26 @@ sidebar: import { } from "~/components" -The WARP client GUI displays the following status messages when transitioning from a **Disconnected** to **Connected** state. These messages indicate the connectivity stage of the WARP daemon as it establishes a connection from the device to Cloudflare. The [WARP mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) determines which messages are displayed during the connection process. If WARP encounters an error while connecting, the status message will change to an [error code](/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors/). +The WARP client GUI displays the following status messages when transitioning from a **Disconnected** to **Connected** state. These messages indicate the connectivity stage of the WARP daemon as it establishes a connection from the device to Cloudflare. The [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) determines which messages are displayed during the connection process. If WARP encounters an error while connecting, the status message will change to an [error code](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors/). To print status messages to the console, run the `warp-cli -l status` command before turning on the WARP switch. | Status message | Description | | --------------------- | ------------------------ | -| Verifying connection settings | Initializes connection components based on your [WARP settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/). | +| Verifying connection settings | Initializes connection components based on your [WARP settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/). | | Validating network | Validates Ethernet and/or Wi-Fi network connectivity. | | Initializing IP connection | Checks for IPv4 and IPv6 connectivity to Cloudflare using the [Happy Eyeballs algorithm](https://datatracker.ietf.org/doc/html/rfc6555). | | Establishing a connection | Connects to the endpoint discovered by Happy Eyeballs. | -| Building a Tunnel | Creates a [virtual network interface](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#virtual-interface) on the operating system for the WARP tunnel. | +| Building a Tunnel | Creates a [virtual network interface](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#virtual-interface) on the operating system for the WARP tunnel. | | Configuring the firewall | Configures the system firewall to allow WARP tunnel traffic. | -| Setting up your routing table | Updates the [system routing table](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#routing-table) based on your [Split Tunnel rules](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). | -| Configuring your firewall rules | Configures the [system firewall](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall) based on your Split Tunnel rules. | +| Setting up your routing table | Updates the [system routing table](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#routing-table) based on your [Split Tunnel rules](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). | +| Configuring your firewall rules | Configures the [system firewall](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#system-firewall) based on your Split Tunnel rules. | | Checking connectivity to DNS| Checks connectivity to the DNS endpoint (`.cloudflare-gateway.com`). | | Setting local endpoint communication | Configures local DNS proxy sockets. | -| Configuring local DNS proxy | Creates a [local DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) for DNS resolution.| +| Configuring local DNS proxy | Creates a [local DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) for DNS resolution.| | Applying DNS settings | Sets the local DNS proxy as the default DNS server on the device. | -| Configuring forward proxy | (Only in [Proxy mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#proxy-mode)) Configures the SOCKS proxy. | -| Confirming Tunnel connection | Checks connectivity to [destinations](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#connectivity-checks) inside and outside of the WARP tunnel. | +| Configuring forward proxy | (Only in [Proxy mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#proxy-mode)) Configures the SOCKS proxy. | +| Confirming Tunnel connection | Checks connectivity to [destinations](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/#connectivity-checks) inside and outside of the WARP tunnel. | | Validating DNS configuration | Verifies that DNS requests are answered by WARP's local DNS proxy. | -| Verifying SOCKS proxy configuration | (Only in [Proxy mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#proxy-mode)) Verifies the SOCKS proxy configuration. | -| Ensuring MTLS identity | (Only in [Device Information Only mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only/)) Installs a client certificate for mTLS authentication. | +| Verifying SOCKS proxy configuration | (Only in [Proxy mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#proxy-mode)) Verifies the SOCKS proxy configuration. | +| Ensuring MTLS identity | (Only in [Device Information Only mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only/)) Installs a client certificate for mTLS authentication. | diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/index.mdx similarity index 100% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/index.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/index.mdx diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/known-limitations.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/known-limitations.mdx similarity index 74% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/known-limitations.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/known-limitations.mdx index 51b8d8c5b75f88..b87ddfadbcdd9c 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/known-limitations.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/known-limitations.mdx @@ -12,21 +12,21 @@ Below, you will find information on devices, software, and configurations that a ## Windows Server -The WARP client does not run on Windows Server. Refer to the [downloads page](/cloudflare-one/connections/connect-devices/warp/download-warp/) for a list of supported operating systems. +The WARP client does not run on Windows Server. Refer to the [downloads page](/cloudflare-one/team-and-resources/devices/warp/download-warp/) for a list of supported operating systems. ## Managed network on legacy Windows Server -[Managed network detection](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/) will not work when the TLS certificate is served from IIS 8.5 on Windows Server 2012 R2. To work around the limitation, move the certificate to a different host. +[Managed network detection](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/) will not work when the TLS certificate is served from IIS 8.5 on Windows Server 2012 R2. To work around the limitation, move the certificate to a different host. ## Split Tunnels for Microsoft 365 traffic -Microsoft has recently made changes to the IP addresses used by Microsoft 365 applications (such as Microsoft Teams). Customers using the [Directly route Microsoft 365 traffic](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic) feature will need to manually add the following IPs to their [Split Tunnels Exclude list](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route): +Microsoft has recently made changes to the IP addresses used by Microsoft 365 applications (such as Microsoft Teams). Customers using the [Directly route Microsoft 365 traffic](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#directly-route-microsoft-365-traffic) feature will need to manually add the following IPs to their [Split Tunnels Exclude list](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#add-a-route): - `24.24.24.24/32` - `52.120.0.0/14` ## nslookup on Windows in DoH mode -On Windows devices in [Gateway with DoH mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh), `nslookup` by default sends DNS requests to the [WARP local DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) over IPv6. However, because WARP uses an IPv4-mapped IPv6 address (instead of a real IPv6 address), `nslookup` will not recognize this address type and the query will fail: +On Windows devices in [Gateway with DoH mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh), `nslookup` by default sends DNS requests to the [WARP local DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) over IPv6. However, because WARP uses an IPv4-mapped IPv6 address (instead of a real IPv6 address), `nslookup` will not recognize this address type and the query will fail: ```txt C:\Users\JohnDoe>nslookup google.com @@ -36,7 +36,7 @@ Address: ::ffff:127.0.2.2 *** UnKnown can't find google.com: No response from server ``` -To work around the issue, specify the IPv4 address of the [WARP local DNS proxy](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) in your query: +To work around the issue, specify the IPv4 address of the [WARP local DNS proxy](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#dns-traffic) in your query: ```bash C:\Users\JohnDoe>nslookup google.com 127.0.2.2 @@ -66,14 +66,14 @@ Comcast DNS traffic (to the IPs below) cannot be proxied through WARP. This is b To work around the issue, you can either: -- Create a [Split Tunnel rule](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) that excludes the above IPs from WARP. +- Create a [Split Tunnel rule](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) that excludes the above IPs from WARP. - Configure your device or router to use a public DNS server such as [`1.1.1.1`](https://1.1.1.1/dns/). ## Cox DNS servers Similar to the [Comcast DNS servers](#comcast-dns-servers) limitation listed above, Cox DNS servers will not respond to traffic from the WARP egress IPs (or any IP that is not a Cox IP). The workaround is nearly identical, except that Cox DNS servers may be specific to the individual end user. You can either: -- Create a [Split Tunnel rule](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) that excludes all Cox DNS servers. For business customers, refer to the [COX documentation](https://www.cox.com/business/support/cox-business-dns-and-mail-exchange-hosting-services.html) for the DNS server IPs. For residential customers, check your local DNS servers. The residential DNS servers typically fall under `68.105.28.0/24` and `68.105.29.0/24`. +- Create a [Split Tunnel rule](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) that excludes all Cox DNS servers. For business customers, refer to the [COX documentation](https://www.cox.com/business/support/cox-business-dns-and-mail-exchange-hosting-services.html) for the DNS server IPs. For residential customers, check your local DNS servers. The residential DNS servers typically fall under `68.105.28.0/24` and `68.105.29.0/24`. - Configure your device or router to use a public DNS server such as [`1.1.1.1`](https://1.1.1.1/dns/). ## HP Velocity @@ -114,7 +114,7 @@ WARP runs a local DNS proxy on `127.0.2.2` and `127.0.2.3`. You may need access To enable WARP DNS resolution with containers: -- Use a [custom Docker network](https://docs.docker.com/engine/network/#user-defined-networks) (recommended): Allows the Docker container to still use the bridge network driver that maintains network isolation from the host. If you are creating your own bridge network, you should also [adjust the MTU accordingly](/cloudflare-one/connections/connect-devices/warp/troubleshooting/known-limitations/#docker-on-linux-with-bridged-networking). +- Use a [custom Docker network](https://docs.docker.com/engine/network/#user-defined-networks) (recommended): Allows the Docker container to still use the bridge network driver that maintains network isolation from the host. If you are creating your own bridge network, you should also [adjust the MTU accordingly](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/known-limitations/#docker-on-linux-with-bridged-networking). - Use [host networking](https://docs.docker.com/engine/network/drivers/host/) (not recommended): Removes the security benefits of network isolation and may lead to port conflicts. The following example uses a special host (`connectivity-check.warp-svc`) that is only resolvable by the local DNS proxy to show the supported Docker networking modes. @@ -165,11 +165,11 @@ Use of the WARP client in a Microsoft 365 Windows 10 Cloud PC is not supported. ## IPv6 DNS resolution in Secure Web Gateway without DNS filtering mode -In [Secure Web Gateway without DNS filtering mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering), devices using IPv6 DNS servers may experience connectivity issues if these servers are not manually excluded from the WARP tunnel. +In [Secure Web Gateway without DNS filtering mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering), devices using IPv6 DNS servers may experience connectivity issues if these servers are not manually excluded from the WARP tunnel. Unlike common IPv4 DHCP configurations where DNS servers often fall within automatically excluded private address ranges, IPv6 environments typically require manual exclusion of DNS server addresses via split tunnel settings for proper operation. -If your DNS server uses an IPv6 address, you must manually exclude it using [split tunnel settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) for Secure Web Gateway without DNS filtering mode to work properly. +If your DNS server uses an IPv6 address, you must manually exclude it using [split tunnel settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) for Secure Web Gateway without DNS filtering mode to work properly. ## Troubleshooting diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide.mdx similarity index 75% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide.mdx index 32c46eff8b5fa1..fd3b884b008f41 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide.mdx @@ -19,7 +19,7 @@ This guide helps you diagnose and resolve common issues with the Cloudflare WARP Cloudflare One includes two free AI helpers to speed up WARP investigations: -[**WARP Diagnostics Analyzer**](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diagnostics-analyzer-beta) - Uses AI to parse a device’s WARP diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. This analyzer is available for logs collected via the dashboard. +[**WARP Diagnostics Analyzer**](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#warp-diagnostics-analyzer-beta) - Uses AI to parse a device’s WARP diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. This analyzer is available for logs collected via the dashboard. [**DEX MCP server**](/cloudflare-one/insights/dex/dex-mcp-server/) — An AI tool that allows customers to ask a question like, "Show me the connectivity and performance metrics for the device used by carly‌@acme.com", and receive an answer that contains data from the DEX API. @@ -36,7 +36,7 @@ Cloudflare One includes two free AI helpers to speed up WARP investigations: ### Check your WARP version -Many troubleshooting issues are caused by outdated client versions. For the best performance and compatibility, administrators should check for new releases and [update the WARP client](/cloudflare-one/connections/connect-devices/warp/download-warp/) before attempting to troubleshoot other issues. +Many troubleshooting issues are caused by outdated client versions. For the best performance and compatibility, administrators should check for new releases and [update the WARP client](/cloudflare-one/team-and-resources/devices/warp/download-warp/) before attempting to troubleshoot other issues. After updating the WARP client, monitor the issue to see if it recurs. If the issue persists, continue with the troubleshooting guide. @@ -45,14 +45,14 @@ After updating the WARP client, monitor the issue to see if it recurs. If the is 1. Open the WARP GUI on the desktop. 2. Select the gear icon. 3. Select **About WARP**. -4. Compare your device's version with the [latest version of WARP](/cloudflare-one/connections/connect-devices/warp/download-warp/). +4. Compare your device's version with the [latest version of WARP](/cloudflare-one/team-and-resources/devices/warp/download-warp/). #### Via the Zero Trust dashboard 1. Log into [Zero Trust](https://one.dash.cloudflare.com/) > go to **My Team** > **Devices**. 2. Select the device you want to investigate. 3. Find the device's WARP version under **Client version** in the side menu. -4. Compare your device's version with the [latest version of WARP](/cloudflare-one/connections/connect-devices/warp/download-warp/). +4. Compare your device's version with the [latest version of WARP](/cloudflare-one/team-and-resources/devices/warp/download-warp/). ### WARP basics @@ -99,7 +99,7 @@ Collect WARP diagnostic logs remotely from the Zero Trust dashboard by using Dig To troubleshoot effectively, Cloudflare recommends reproducing the issue and noting your timestamps immediately before collecting logs. Though recreating the issue may not be possible in all cases, reproducing the issue right before WARP diag collection or during the window that a packet capture (PCAP) is running will help you troubleshoot with greater visibility. -Refer to [WARP log retention window](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#log-retention-window) to learn more. +Refer to [WARP log retention window](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#log-retention-window) to learn more. ::: #### Start a remote capture @@ -121,11 +121,11 @@ Refer to [WARP log retention window](/cloudflare-one/connections/connect-devices -After you have your diagnostic files, go to [Review key files](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#3-review-key-files) to continue troubleshooting. +After you have your diagnostic files, go to [Review key files](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#3-review-key-files) to continue troubleshooting. :::tip[AI-assisted troubleshooting] -The [WARP Diagnostics Analyzer](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diagnostics-analyzer-beta) uses AI to parse a device’s WARP diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. +The [WARP Diagnostics Analyzer](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#warp-diagnostics-analyzer-beta) uses AI to parse a device’s WARP diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. After you run a [DEX remote capture](#option-a-collect-logs-via-the-cloudflare-dashboard) for WARP diagnostics: @@ -149,7 +149,7 @@ To troubleshoot effectively, Cloudflare recommends that you recreate the steps t ::: -After you have your diagnostic files, go to [Review key files](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#3-review-key-files) to continue troubleshooting. +After you have your diagnostic files, go to [Review key files](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#3-review-key-files) to continue troubleshooting. ## 3. Review key files @@ -180,7 +180,7 @@ Open the `warp-status.txt` file to review the status of the WARP connection when Ok(Connected) ``` -If the WARP client is experiencing issues, the error will display in the WARP GUI on the device. Use the [Client errors](/cloudflare-one/connections/connect-devices/warp/troubleshooting/client-errors/) documentation to identify your error, its cause, and the solution. +If the WARP client is experiencing issues, the error will display in the WARP GUI on the device. Use the [Client errors](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/client-errors/) documentation to identify your error, its cause, and the solution. ### Check WARP settings @@ -243,17 +243,17 @@ Always On: true ##### Switch Locked -Refers to the [Lock WARP Switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) which allows the user to turn off the WARP switch and disconnect the client. In the example file, the value is `false` meaning the user is able to turn the WARP switch on or off at their discretion. +Refers to the [Lock WARP Switch](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#lock-warp-switch) which allows the user to turn off the WARP switch and disconnect the client. In the example file, the value is `false` meaning the user is able to turn the WARP switch on or off at their discretion. ```txt Switch Locked: false ``` -When the Lock WARP switch is enabled (`true`), users will need an [Admin override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) code to temporarily turn off WARP on their device. +When the Lock WARP switch is enabled (`true`), users will need an [Admin override](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#admin-override) code to temporarily turn off WARP on their device. ##### Mode -Refers to the [WARP mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) the device is using. In the example file, the WARP mode is `WarpWithDnsOverHttps` which is Gateway with WARP mode. Refer to the [WARP modes comparison matrix](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) to match your `warp-settings.txt` file's value with the mode name. +Refers to the [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) the device is using. In the example file, the WARP mode is `WarpWithDnsOverHttps` which is Gateway with WARP mode. Refer to the [WARP modes comparison matrix](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) to match your `warp-settings.txt` file's value with the mode name. ```txt Mode: WarpWithDnsOverHttps @@ -261,7 +261,7 @@ Mode: WarpWithDnsOverHttps ##### Exclude mode, with hosts/ips -Refers to your [split tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) settings. In the example file, WARP is running in Exclude mode, meaning all traffic except for the traffic destined for these hosts and IPs will be sent through the WARP tunnel. The host `cname.user.net` and the IP `1xx.1xx.1xx.1xx/25 ` are both excluded from the WARP tunnel. +Refers to your [split tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) settings. In the example file, WARP is running in Exclude mode, meaning all traffic except for the traffic destined for these hosts and IPs will be sent through the WARP tunnel. The host `cname.user.net` and the IP `1xx.1xx.1xx.1xx/25 ` are both excluded from the WARP tunnel. ```txt Exclude mode, with hosts/ips: @@ -278,7 +278,7 @@ Exclude mode, with hosts/ips: ##### Fallback domains -Refers to your [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) settings. In the example file, WARP lists `intranet` as a domain that will not be sent to Gateway for processing and will instead be sent directly to the configured fallback servers. +Refers to your [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/local-domains/) settings. In the example file, WARP lists `intranet` as a domain that will not be sent to Gateway for processing and will instead be sent directly to the configured fallback servers. ```txt (network policy) Fallback domains: @@ -288,7 +288,7 @@ Refers to your [Local Domain Fallback](/cloudflare-one/connections/connect-devic ##### Allow Mode Switch -Refers to the [Mode switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#mode-switch) setting. In the example file, the mode switch is enabled (`true`) which means the user has the option to switch between [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode and [Gateway with DNS-over-HTTPS (DoH)](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode. +Refers to the [Mode switch](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#mode-switch) setting. In the example file, the mode switch is enabled (`true`) which means the user has the option to switch between [Gateway with WARP](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode and [Gateway with DNS-over-HTTPS (DoH)](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode. ```txt Allow Mode Switch: true @@ -296,7 +296,7 @@ Allow Mode Switch: true ##### Allow Updates -Refers to the [Allow updates](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-updates) setting. In the example file, the allow updates setting is set to `false` meaning that the user will not receive update notifications when a new version of the WARP client is available and cannot update WARP without administrator approval. +Refers to the [Allow updates](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-updates) setting. In the example file, the allow updates setting is set to `false` meaning that the user will not receive update notifications when a new version of the WARP client is available and cannot update WARP without administrator approval. ```txt Allow Updates: false @@ -304,7 +304,7 @@ Allow Updates: false ##### Allowed to Leave Org -Refers to the [Allow device to leave organization](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) setting. In the example file, the value is set to `true` meaning the user can log out from your Zero Trust organization. +Refers to the [Allow device to leave organization](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) setting. In the example file, the value is set to `true` meaning the user can log out from your Zero Trust organization. ```txt Allowed to Leave Org: true @@ -312,7 +312,7 @@ Allowed to Leave Org: true ##### LAN Access Settings -Refers to the [Allow users to enable local network exclusion](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-users-to-enable-local-network-exclusion) setting. When enabled, it allows users to temporarily access local devices (like printers) by excluding the detected local subnet from the WARP tunnel. This example indicates access is allowed until the next WARP reconnection, and only for subnets up to `/24`. +Refers to the [Allow users to enable local network exclusion](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-users-to-enable-local-network-exclusion) setting. When enabled, it allows users to temporarily access local devices (like printers) by excluding the detected local subnet from the WARP tunnel. This example indicates access is allowed until the next WARP reconnection, and only for subnets up to `/24`. ```txt LAN Access Settings: Allowed until reconnect on a /24 subnet @@ -320,7 +320,7 @@ LAN Access Settings: Allowed until reconnect on a /24 subnet ##### Profile ID -Refers to the [Device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) a device is using. In this example, the ID is `000000x1-00x1-1xx0-1xx1-11101x1axx11`. +Refers to the [Device profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) a device is using. In this example, the ID is `000000x1-00x1-1xx0-1xx1-11101x1axx11`. ```txt Profile ID: 000000x1-00x1-1xx0-1xx1-11101x1axx11 @@ -330,12 +330,12 @@ Profile ID: 000000x1-00x1-1xx0-1xx1-11101x1axx11 To verify that WARP is configured and working properly, review the following: -1. Is the [wrong profile ID](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#edit-your-device-profile-match-rules) applied to the device? -2. Is the [wrong split tunnel configuration](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#wrong-split-tunnel-configuration) active on the device? +1. Is the [wrong profile ID](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#edit-your-device-profile-match-rules) applied to the device? +2. Is the [wrong split tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#wrong-split-tunnel-configuration) active on the device? ### Wrong profile ID -A profile ID is a unique identifier assigned to each [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) in the Zero Trust dashboard, used to determine which configuration settings apply to a device. +A profile ID is a unique identifier assigned to each [device profile](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) in the Zero Trust dashboard, used to determine which configuration settings apply to a device. #### Check the applied device profile @@ -357,12 +357,12 @@ If your organization has multiple device profiles defined in the Zero Trust dash :::caution -Avoid [reordering profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#order-of-precedence) unless you are confident it will not affect other users. +Avoid [reordering profiles](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/#order-of-precedence) unless you are confident it will not affect other users. ::: #### Review your managed network settings -A [managed network](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/) is a network location that you define with a TLS endpoint, like a physical office. The WARP client checks for this TLS endpoint to determine its location and apply the corresponding device profile. +A [managed network](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/) is a network location that you define with a TLS endpoint, like a physical office. The WARP client checks for this TLS endpoint to determine its location and apply the corresponding device profile. If the managed network is misconfigured or the TLS endpoint is unreachable, the device may fall back to an unintended profile. @@ -409,7 +409,7 @@ To modify the match rules of a device profile, you will need to edit the device :::note -Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP). +Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP). ::: @@ -417,7 +417,7 @@ Identity-based selectors are only available if the user [enrolled the device](/c -A misconfigured [split tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) can cause connectivity issues. +A misconfigured [split tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) can cause connectivity issues. For example, if you set your mode to Exclude IPs and domains and accidentally exclude an IP address needed by an application, that application may not work correctly. Similarly, in Include IPs and domains mode, forgetting to include a necessary IP or domain will cause traffic to bypass WARP, and you will lose access to your Zero Trust security features. @@ -439,7 +439,7 @@ After downloading the WARP diagnostic logs, review that your configuration is wo 5. Find **Split Tunnels** and note the mode you have selected > select **Manage**. 6. Cross-reference the IPs/hosts you have configured in the Zero Trust dashboard with the IPs/hosts listed in `warp-settings.txt`. -If your dashboard split tunnel configuration does not match your `warp-settings.txt` file configuration, you may need to force the WARP client to [update its settings](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#update-the-warp-clients-settings). +If your dashboard split tunnel configuration does not match your `warp-settings.txt` file configuration, you may need to force the WARP client to [update its settings](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/troubleshooting-guide/#update-the-warp-clients-settings). #### 2. Update the WARP client's settings @@ -454,7 +454,7 @@ Both methods update the client with the latest configuration. On the end user device, open the WARP GUI and toggle WARP on and off. :::note[What if the end user cannot turn off WARP?] -If the end user's [WARP switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) is locked, they will need an [admin override code](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) to be able to toggle the WARP switch. +If the end user's [WARP switch](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#lock-warp-switch) is locked, they will need an [admin override code](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#admin-override) to be able to toggle the WARP switch. [Resetting the encryption keys](#option-b-reset-the-encryption-keys) may be a faster solution. ::: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx similarity index 94% rename from src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs.mdx rename to src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx index eaf8e323d9fde8..3845c1a0c3200f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx @@ -57,11 +57,11 @@ The `warp-debugging-info--