diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx index 63b05fac82..d30d2398d2 100644 --- a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/index.mdx @@ -18,4 +18,4 @@ Here are the different ways you can connect your private network to Cloudflare: - [**cloudflared**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) installs on a server in your private network to create a secure, outbound tunnel to Cloudflare. Cloudflare Tunnel using `cloudflared` only proxies traffic initiated from a user to a server. Any service or application running behind the tunnel will use the server's default routing table for server-initiated connectivity. - [**WARP-to-WARP**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/) uses the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/) to establish peer-to-peer connectivity between two or more devices. Each device running WARP can access services on any other device running WARP via an assigned virtual IP address. - [**WARP Connector**](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) installs on a Linux server in your private network to establish site-to-site, bidirectional, and mesh networking connectivity. The WARP Connector acts as a subnet router to relay client-initiated and server-initiated traffic between all devices on a private network and Cloudflare. -- [**Magic WAN**](/magic-wan/) relies on configuring legacy networking equipment to establish anycast GRE or IPsec tunnels between an entire network location and Cloudflare. +- [**Magic WAN**](/cloudflare-one/networks/connectors/wan-tunnels/) relies on configuring legacy networking equipment to establish anycast GRE or IPsec tunnels between an entire network location and Cloudflare. diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp.mdx index 41d5403dd1..e67a6cfbdf 100644 --- a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp.mdx @@ -31,13 +31,13 @@ This guide covers how to: 1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Team & Resources** > **Devices** > **Management**. 2. Select **Peer to peer connectivity**. -3. Enable **Allow all Cloudflare One traffic to reach enrolled devices**. This allows Cloudflare to route traffic to the CGNAT IP space. +3. Turn on [**Allow all Cloudflare One traffic to reach enrolled devices**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-all-cloudflare-one-traffic-to-reach-enrolled-devices). 4. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that traffic to `100.96.0.0/12` is going through WARP: If using Split Tunnels in **Exclude** mode: 1. Delete `100.64.0.0/10` from the list. - 2. We recommend [adding back the IPs](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) that are not being used for Zero Trust services. For example, if you are using [WARP-to-WARP] alongside [Gateway host selectors](/cloudflare-one/traffic-policies/egress-policies/host-selectors/) or [private hostname routing](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/), add routes to exclude the following IP addresses: + 2. We recommend [adding back the IPs](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) that are not being used for Zero Trust services. For example, if you are using WARP-to-WARP alongside [Gateway host selectors](/cloudflare-one/traffic-policies/egress-policies/host-selectors/) or [private hostname routing](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/), add routes to exclude the following IP addresses: - `100.64.0.0/12` - `100.81.0.0/16` diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx index 6438739fd5..840185cc2c 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx @@ -115,7 +115,7 @@ This setting is primarily used as a prerequisite for [WARP Connector](/cloudflar - `Enabled`: Sets the local interface IP on each device to its CGNAT IP. -The CGNAT IP assigned to a WARP device is permanent until the device unregisters from your Zero Trust organization. Disconnects and reconnects do not change the IP address assignment. +The CGNAT IP assigned to a WARP device is permanent until the device unregisters from your Zero Trust organization or switches to a different registration. Disconnects and reconnects do not change the IP address assignment. ### Disconnect WARP on all devices @@ -146,6 +146,24 @@ Requires the [Super Administrator](/cloudflare-one/roles-permissions/) role. To resume normal operations, turn off **Disconnect WARP on all devices**. The WARP client will automatically reconnect. +### Allow all Cloudflare One traffic to reach enrolled devices + +
+ +| Operating Systems | [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | +| ----------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | +| All systems | Gateway with WARP | All plans | + +
+ +Allows traffic on-ramped using [WARP-to-WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/), [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/), or [Magic WAN](/cloudflare-one/networks/connectors/wan-tunnels/) to route to WARP devices enrolled in your Zero Trust organization. + +Each WARP device is assigned a virtual IP address in the CGNAT IP space (`100.96.0.0/12`). With this setting `Enabled`, users on your private network will be able to connect to these virtual IPs and access [TCP, UDP, and/or ICMP-based services](/cloudflare-one/traffic-policies/proxy/) on your WARP devices. You can create [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to control which users and devices can access the `100.96.0.0/12`. + +:::note +Ensure that traffic destined to `100.96.0.0/12` routes from your private network to Cloudflare Gateway. For example, if you are making a [WARP-to-WARP](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/) connection, you must configure your [Split Tunnel settings](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) so that traffic to `100.96.0.0/12` routes through the WARP tunnel. +::: + ## Device settings ### Captive portal detection diff --git a/src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx b/src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx index 0611ea254f..51f6b3a032 100644 --- a/src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx +++ b/src/content/partials/cloudflare-one/tunnel/warp-connector-install.mdx @@ -9,7 +9,7 @@ To install WARP Connector on a host machine: 1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Networks** > **Connectors** > **Cloudflare Tunnels**. 2. Select **Create a tunnel**. 3. For the tunnel type, select **WARP Connector**. -4. You will be prompted to turn on **Warp to Warp** and [**Assign a unique IP address to each device**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#assign-a-unique-ip-address-to-each-device) if they are currently turned off. These settings allow Cloudflare to assign a unique CGNAT IP to each WARP device and route traffic between them. +4. You will be prompted to turn on [**Allow all Cloudflare One traffic to reach enrolled devices**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#allow-all-cloudflare-one-traffic-to-reach-enrolled-devices) and [**Assign a unique IP address to each device**](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#assign-a-unique-ip-address-to-each-device) if they are currently turned off. These settings allow Cloudflare to assign a unique CGNAT IP to each WARP device and route traffic between them. 5. Give the tunnel any name (for example, `Subnet-10.0.0.0/24`) and select **Create tunnel**. 6. Select the operating system of your host machine. 7. On your host machine, open a terminal window and run the commands shown in Cloudflare One. Those commands will install the WARP Connector, enable IP forwarding on the host, and connect WARP Connector to your Zero Trust organization.