Skip to content

[ZT] WARP Client --> Cloudflare One Client image audit #29104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ranbel merged 3 commits into from
Mar 18, 2026
Merged

[ZT] WARP Client --> Cloudflare One Client image audit #29104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
095da74
WARP Client images
ranbel Mar 18, 2026
c416d5c
update mermaid diagrams
ranbel Mar 18, 2026
99e2a13
Merge production into ranbel/warp-images, resolve SVG conflicts
ranbel Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ts/images/reference-architecture/cloudflare-sase-with-crowdstrike/Main_Arch.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion ...ts/images/reference-architecture/cloudflare-sase-with-crowdstrike/UseCase01.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion ...ts/images/reference-architecture/cloudflare-sase-with-crowdstrike/UseCase02.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion ...ts/images/reference-architecture/cloudflare-sase-with-crowdstrike/UseCase03.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion ...ts/images/reference-architecture/cloudflare-sase-with-crowdstrike/UseCase04.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion ...ts/images/reference-architecture/cloudflare-sase-with-crowdstrike/UseCase05.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
20 changes: 10 additions & 10 deletions src/content/docs/cloudflare-one/integrations/service-providers/custom.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,13 @@ Cloudflare One allows you to enforce custom device posture checks on your applic

```mermaid
sequenceDiagram
participant WARP
participant Cloudflare One Client
participant Cloudflare Access
participant External API
WARP->>Cloudflare Access: Client ID and Secret
Cloudflare One Client->>Cloudflare Access: Client ID and Secret
Cloudflare Access->>External API: Application token
WARP->>External API: JSON with user and device identity
External API-->>WARP: JSON with 0-100 result
Cloudflare One Client->>External API: JSON with user and device identity
External API-->>Cloudflare One Client: JSON with 0-100 result
```

## External API requirements
Expand All @@ -35,14 +35,14 @@ The Cloudflare One Client authenticates to the external API through Cloudflare A

Cloudflare will pass the following parameters to the configured API endpoint. You can use this data to identify the device and assign a posture score. For some devices, not all identifying information will apply, in which case the field will be blank. A maximum of 1,000 devices will be sent per a request.

| Field | Description |
| --------------- | -------------------------------------------------- |
| Field | Description |
| --------------- | ------------------------------------------------------------ |
| `device_id` | Device UUID assigned by the Cloudflare One Client |
| `email` | Email address used to authenticate the Cloudflare One Client |
| `serial_number` | Device serial number |
| `mac_address` | Device MAC address |
| `virtual_ipv4` | Device virtual IPv4 address |
| `hostname` | Device name |
| `serial_number` | Device serial number |
| `mac_address` | Device MAC address |
| `virtual_ipv4` | Device virtual IPv4 address |
| `hostname` | Device name |

:::note

Expand Down
9 changes: 6 additions & 3 deletions ...ks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,10 @@ Our lightweight and open-source connector, [`cloudflared`](https://github.com/cl

Cloudflare Tunnel allows users to deploy additional instances of our connector, `cloudflared`, for availability and failover scenarios. We refer to these unique instances as replicas. Each replica establishes four new connections which serve as additional points of ingress to your origin, should you need them. Each of the replicas will point to the same tunnel. This ensures that your network remains up in the event a single host running `cloudflared` goes down.

<Render file="tunnel/availability/cloudflared-replicas-diagram" product="cloudflare-one" />
<Render
file="tunnel/availability/cloudflared-replicas-diagram"
product="cloudflare-one"
/>

By design, replicas do not offer any level of traffic steering (random, hash, or round-robin). Instead, when a request arrives to Cloudflare, it will be forwarded to the replica that is geographically closest. If that distance calculation is unsuccessful or the connection fails, we will retry others, but there is no guarantee about which connection is chosen.

Expand All @@ -36,7 +39,7 @@ graph LR
accTitle: Load balancing traffic to applications behind Cloudflare Tunnel

A[Internet] --> C{Cloudflare <br> Load Balancer}
B[WARP clients] --> C
B[Cloudflare One Client] --> C
M[Cloudflare WAN] --> C
C -- Tunnel 1 --> cf1
C -- Tunnel 2 --> cf2
Expand Down Expand Up @@ -74,4 +77,4 @@ There are two types of load balancers that you can use with Cloudflare Tunnel en

:::note
[Private hostname routes](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) are not currently compatible with Load Balancing. If your service is connected via a hostname route, use `cloudflared` [replicas](#cloudflared-replicas) for high availability.
:::
:::
11 changes: 4 additions & 7 deletions ...tworks/connectors/cloudflare-tunnel/private-net/warp-connector/user-to-site.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,14 @@ This guide covers how to connect Cloudflare One Client user devices to a private
router1["WARP Connector
10.0.0.1"]
end
W[WARP clients]-->C((Cloudflare))-->router1
W[Cloudflare One Client]-->C((Cloudflare))-->router1
```

## Prerequisites

- A Linux host [^1] on the subnet.
- For WARP Connector to connect to Cloudflare services, your firewall should allow inbound/outbound traffic for the [WARP IP addresses, ports, and domains](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/).
- For Cloudflare One Clients to connect to your subnet, your firewall should allow inbound traffic from your [device IPs](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-ips/).
- For Cloudflare One Clients to connect to your subnet, your firewall should allow inbound traffic from your [device IPs](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-ips/).

## 1. Install a WARP Connector

Expand All @@ -43,8 +43,7 @@ This guide covers how to connect Cloudflare One Client user devices to a private
Cloudflare One Clients and WARP Connectors are accessed using their [device IP](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-ips/). Therefore, traffic to your device IPs must route through Cloudflare on both the WARP Connector host and Cloudflare One Client devices.

1. In your WARP Connector device profile, go to [Split Tunnels](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/).
2.
<Render file="tunnel/cgnat-split-tunnels" product="cloudflare-one" />
2. <Render file="tunnel/cgnat-split-tunnels" product="cloudflare-one" />

3. Repeat the previous steps for all Cloudflare One Client device profiles.

Expand Down Expand Up @@ -120,13 +119,11 @@ You can now send a request from a Cloudflare One Client user device to your subn
router1["WARP Connector
10.0.0.1"]
end
W[WARP client]--ping 10.0.0.2 -->C((Cloudflare))-->router1
W[Cloudflare One Client]--ping 10.0.0.2 -->C((Cloudflare))-->router1
```

[^1]:
<Render
file="tunnel/warp-connector-linux-packages"
product="cloudflare-one"
/>


2 changes: 1 addition & 1 deletion src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ Because Gateway evaluates network and HTTP policies on every request, it maintai
```mermaid
flowchart LR
accTitle: Device posture policy enforcement
A[Device] --schedule--> B[WARP client]--> C((Cloudflare)) --> D[Access policy]
A[Device] --schedule--> B[Cloudflare One Client]--> C((Cloudflare)) --> D[Access policy]
C --5 min--> E[Cache] --> F[Gateway policy]
A --> G[Service provider] --interval--> C
```
Expand Down
10 changes: 5 additions & 5 deletions ...s/devices/cloudflare-one-client/configure/route-traffic/client-architecture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,16 +18,16 @@ In [DNS only mode](/cloudflare-one/team-and-resources/devices/cloudflare-one-cli

The Cloudflare One Client allows organizations to have granular control over the applications an end user device can access. The client forwards DNS and network traffic from the device to Cloudflare's global network, where Zero Trust policies are applied in the cloud. On all operating systems, the WARP daemon maintains three connections between the device and Cloudflare:

| Connection | Protocol | Purpose |
| --------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- |
| Connection | Protocol | Purpose |
| ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- |
| WARP tunnel ([via WireGuard or MASQUE](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#device-tunnel-protocol)) | UDP | Send IP packets to Gateway for network policy enforcement, HTTP policy enforcement, and private network access. |
| [DoH](https://www.cloudflare.com/learning/dns/dns-over-tls/) | HTTPS | Send DNS requests to Gateway for DNS policy enforcement. The DoH connection is maintained inside of the WARP tunnel. |
| Device orchestration | HTTPS | Perform user registration, check device posture, apply device client profile settings. |
| [DoH](https://www.cloudflare.com/learning/dns/dns-over-tls/) | HTTPS | Send DNS requests to Gateway for DNS policy enforcement. The DoH connection is maintained inside of the WARP tunnel. |
| Device orchestration | HTTPS | Perform user registration, check device posture, apply device client profile settings. |

```mermaid
flowchart LR
subgraph Device
W[WARP client] -.-> D
W[Cloudflare One Client] -.-> D
D[DNS proxy]
W -.-> V[Virtual interface]
end
Expand Down
12 changes: 6 additions & 6 deletions ...m-and-resources/devices/cloudflare-one-client/configure/route-traffic/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,11 @@ When you use the Cloudflare One Client together with `cloudflared` Tunnels or th
```mermaid
flowchart TD
%% Accessibility
accTitle: How the WARP client handles DNS requests
accDescr: Flowchart describing how the WARP client routes DNS queries when using Local Domain Fallback, Split Tunnels, and Gateway resolver policies.
accTitle: How the Cloudflare One Client handles DNS requests
accDescr: Flowchart describing how the Cloudflare One Client routes DNS queries when using Local Domain Fallback, Split Tunnels, and Gateway resolver policies.

A(["WARP user requests resource"]) --> B["WARP client proxies all DNS traffic"]
B --> LDFCHK{"WARP checks if domain is listed in Local Domain Fallback policies"}
A(["User requests resource"]) --> B["Cloudflare One Client proxies all DNS traffic"]
B --> LDFCHK{"Cloudflare One Client checks if domain is listed in Local Domain Fallback policies"}

%% Left branch (LDF exists)
LDFCHK -- Domain exists in Local Domain Fallback policies --> C["Local Domain Fallback"]
Expand All @@ -50,9 +50,9 @@ flowchart TD
GWALLOW -- Blocked by Gateway Network or HTTP Policy --> BLK(["Traffic blocked by Cloudflare"])

OR --> ORCHK{"Onramp routes include resolver IP"}
ORCHK -- Onramp routes do not include resolver IP --> GP(["Gateway proxies query to resolver IP via normal WARP egress route"])
ORCHK -- Onramp routes do not include resolver IP --> GP(["Gateway proxies query to resolver IP via normal Cloudflare One Client egress route"])
ORCHK -- Onramp routes include resolver IP --> ADV["Cloudflare onramps advertise route that includes Resolver IP"]
ADV --> PR(["Private resolver returns IP address to WARP client"])
ADV --> PR(["Private resolver returns IP address to Cloudflare One Client"])

%% Right branch (no LDF match)
LDFCHK -- Domain does not exist in Local Domain Fallback policies --> GWR{"Gateway checks Resolver Policies (Enterprise only)"}
Expand Down
4 changes: 4 additions & 0 deletions .../devices/cloudflare-one-client/deployment/mdm-deployment/partners/jumpcloud.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ import { Render } from "~/components";

![Configuring the Cloudflare One Client in the JumpCloud Windows tab](~/assets/images/cloudflare-one/connections/jumpcloud.png)

_Note: Labels in this image may reflect a previous product name._
Copy link
Copy Markdown
Contributor

@patriciasantaana patriciasantaana Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this be better as a partial given how often it's duplicated across files?

Copy link
Copy Markdown
Contributor Author

@ranbel ranbel Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@marciocloudflare wdyt?

Copy link
Copy Markdown
Contributor

@marciocloudflare marciocloudflare Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's a good idea if we make the sentence in such a way it works correctly, both for single images and multiple images. At least on my products sometimes because there are like two or three images and then the sentence, I have some single use sentences and some sentences for lots of images


4. In the **Software Name** field, enter a unique display name.

5. In the **Package ID** field, enter `warp`.
Expand Down Expand Up @@ -53,6 +55,8 @@ Verify that the Cloudflare One Client was installed by selecting the app and vie

![Configuring the Cloudflare One Client in the JumpCloud Apple tab](~/assets/images/cloudflare-one/connections/jumpcloud-mac.png)

_Note: Labels in this image may reflect a previous product name._

4. In the **Software Description** field, enter a unique display name.

5. In the **Software Package URL**, enter the URL location of the `Cloudflare_WARP_<VERSION>.pkg` file. If you do not already have the installer package, [download it here](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/#macos).
Expand Down
2 changes: 2 additions & 0 deletions ...ces/devices/cloudflare-one-client/deployment/mdm-deployment/partners/kandji.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@

![Configuring custom profile for the Cloudflare One Client in Kandji](~/assets/images/cloudflare-one/connections/custom-profile.png)

_Note: Labels in this image may reflect a previous product name._

4. Add a custom app:
1. Go to **Library** > **Add New** > **Add Library Item** > **Custom App**.
2. Select **Add & Configure**.
Expand Down Expand Up @@ -66,7 +68,7 @@
###################################################################################################
# Created by Matt Wilson | se@kandji.io | Kandji, Inc. | Solutions Engineering
###################################################################################################
# Created on 07/30/2021

Check warning on line 71 in src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/kandji.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
###################################################################################################
# Software Information
###################################################################################################
Expand All @@ -76,7 +78,7 @@
###################################################################################################
# License Information
###################################################################################################
# Copyright 2021 Kandji, Inc.

Check warning on line 81 in src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/kandji.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
# software and associated documentation files (the "Software"), to deal in the Software
Expand Down
2 changes: 2 additions & 0 deletions ...es/devices/cloudflare-one-client/deployment/mdm-deployment/protocol-handler.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@

![Browser popup requesting permission to open the Cloudflare One Client](~/assets/images/cloudflare-one/connections/warp-protocol-handler.png)

_Note: Labels in this image may reflect a previous product name._

### Chromium-based browsers

Chromium-based browsers such as Google Chrome and Microsoft Edge have a policy setting called [AutoLaunchProtocolsFromOrigins](https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#autolaunchprotocolsfromorigins). This setting takes in two parameters: a protocol for the browser to launch and the origins that are allowed to launch it. For the browser to launch the Cloudflare One Client, you need to set the protocol to `com.cloudflare.warp` and the origin to your <GlossaryTooltip term="team domain">Cloudflare Zero Trust team domain</GlossaryTooltip> (`https://<your-team-name>.cloudflareaccess.com`).
Expand Down Expand Up @@ -172,7 +174,7 @@
4. Upload the `.plist` or `.mobileconfig` file to your preferred MDM.
5. Deploy the configuration profile to your devices.

For more information on configuring browser policies on macOS, refer to the [Google Chrome](https://support.google.com/chrome/a/answer/9020077?hl=en&ref_topic=7650028&sjid=15337530832025656704-NA) or [Microsoft Edge](https://learn.microsoft.com/en-us/deployedge/configure-microsoft-edge-on-mac) documentation.

Check warning on line 177 in src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/protocol-handler.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)

Check warning on line 177 in src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/protocol-handler.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)

</TabItem>
</Tabs>
8 changes: 4 additions & 4 deletions ...s/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,12 @@
<Details header="Feature availability">

| [WARP modes](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| All modes | All plans |
| ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| All modes | All plans |

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2025.6.1400.0 |

Check warning on line 18 in src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| macOS | ❌ | |
| Linux | ❌ | |
| iOS | ❌ | |
Expand Down Expand Up @@ -63,7 +63,7 @@
<key>auth_client_id</key>
<string>88bf3b6d86161464f6509f7219099e57.access</string>
<key>auth_client_secret</key>
<string>bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5</string>

Check warning on line 66 in src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
</dict>
<key>configs</key>
<array>
Expand Down Expand Up @@ -91,7 +91,7 @@

```mermaid
flowchart TB
start(["Enable multi-user mode"])-->reg["Active Windows user is prompted to register WARP"]
start(["Enable multi-user mode"])-->reg["Active Windows user is prompted to register Cloudflare One Client"]
reg--"Log out of Windows"-->prelogin
reg--"Switch user"-->regexists

Expand All @@ -103,7 +103,7 @@
preloginno["Stay registered as <br />previous Windows user"]
end

preloginbehavior--"Log in to Windows"---->regexists{{"Has the user already registered with WARP?"}}
preloginbehavior--"Log in to Windows"---->regexists{{"Has the user already registered with Cloudflare One Client?"}}
regexists--"Yes"-->user["Switch to that user's registration"]
regexists-. "No" .->reg
```
Expand Down
2 changes: 2 additions & 0 deletions ...m-and-resources/devices/cloudflare-one-client/troubleshooting/common-issues.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ If the Cloudflare One Client is stuck in the `Disconnected` state or frequently

</div>

_Note: Labels in this image may reflect a previous product name._

In your [client diagnostic logs](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/), `daemon.log` will typically show one or more of the following errors:

- Happy Eyeball checks failing:
Expand Down
Loading
Loading