From 31ac9c1d7e04dfae84d47e798105a3e10456bd4e Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 12:39:52 -0600 Subject: [PATCH 01/16] [Cloudflare One] Draft: intent-based Get Started structure (PCX-20931) Refactor the Get Started page from a flat generic setup page into an intent-based router matching the CF1 dashboard onboarding UX. - Convert setup.mdx to setup/index.mdx with universal prereqs + use-case cards - Add Replace VPN decision page with 3 scenario cards - Add full Device to Network quick-start (PCX-20915) - Add skeleton pages for Network to Network (PCX-20917) and Device to Device (PCX-20916) - Preserves /cloudflare-one/setup/ URL (directory index) --- src/content/docs/cloudflare-one/setup.mdx | 43 ----- .../docs/cloudflare-one/setup/index.mdx | 72 +++++++ .../setup/replace-vpn/device-to-device.mdx | 62 ++++++ .../setup/replace-vpn/device-to-network.mdx | 179 ++++++++++++++++++ .../setup/replace-vpn/index.mdx | 63 ++++++ .../setup/replace-vpn/network-to-network.mdx | 68 +++++++ 6 files changed, 444 insertions(+), 43 deletions(-) delete mode 100644 src/content/docs/cloudflare-one/setup.mdx create mode 100644 src/content/docs/cloudflare-one/setup/index.mdx create mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx create mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx create mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx create mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx diff --git a/src/content/docs/cloudflare-one/setup.mdx b/src/content/docs/cloudflare-one/setup.mdx deleted file mode 100644 index 74308cd56e3..00000000000 --- a/src/content/docs/cloudflare-one/setup.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -pcx_content_type: get-started -title: Get started -sidebar: - order: 2 ---- - -import { Render } from "~/components"; - -This guide covers the recommended steps to start securing your users and devices with Cloudflare Zero Trust. - -:::note - -To get started with a specific use case, refer to our [implementation guides](/cloudflare-one/implementation-guides/). -::: - -## Prerequisites - -Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up). - -## Create a Zero Trust Organization - - - -Welcome to Cloudflare Zero Trust! You can now explore a list of one-click actions we have designed to help you kickstart your experience. - -## Install the WARP client on your devices - -If you want to enable security features such as Browser Isolation, HTTP filtering, AV scanning, and device posture, or connect networks to Cloudflare, here are the next steps you need to take: - -1. **Set up a login method.** Configure [One-time PIN](/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](/cloudflare-one/integrations/identity-providers/) in Cloudflare Zero Trust. This is the login method your users will utilize when authenticating to add a new device to your Cloudflare Zero Trust setup. - -2. **Next, define [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/)**. Create device enrollment rules to define which users in your organization should be able to connect devices to your organization's Cloudflare Zero Trust setup. As you create your rule, you will be asked to select which login method you would like users to authenticate with. - -3. **Install the [Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your devices.** Advanced security features including HTTP traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all your devices, these steps will need to be performed on each new device that is to be subject to HTTP filtering. - -4. **[Download](/cloudflare-one/team-and-resources/devices/warp/download-warp/) and deploy the WARP client to your devices**. Choose one of the [different ways](/cloudflare-one/team-and-resources/devices/warp/deployment/) to deploy the WARP client, depending on what works best for your organization. - -5. **Log in to your organization's Cloudflare Zero Trust instance from your devices**. On your device, go to the Settings section in the WARP client and insert your organization's team name. - -Your devices are now connected to Cloudflare Zero Trust through the WARP client. You can go to **Team & Resources** > **Devices** to find a list of your enrolled devices, when they were last seen, and the WARP client version they are running. - -Next, [enforce security policies](/cloudflare-one/traffic-policies/) on your traffic and access requests. diff --git a/src/content/docs/cloudflare-one/setup/index.mdx b/src/content/docs/cloudflare-one/setup/index.mdx new file mode 100644 index 00000000000..0489a1c69b8 --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/index.mdx @@ -0,0 +1,72 @@ +--- +pcx_content_type: get-started +title: Get started +sidebar: + order: 2 +description: Set up Cloudflare Zero Trust for your organization. Choose a use case to get started with a guided quick-start. +--- + +import { CardGrid, LinkTitleCard, Render } from "~/components"; + +Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. + +## Prerequisites + +Before you begin any use case, you need a Cloudflare account and a Zero Trust organization. + +### 1. Create a Cloudflare account + +Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up) and enable two-factor authentication. + +### 2. Create a Zero Trust organization + + + +## What do you want to do? + +Choose the use case that best describes your goal. Each quick-start guides you through the minimum steps to get up and running, then links to deeper resources for production hardening. + + + + + Give remote users, offices, and devices secure access to private networks and + applications without a traditional VPN. + + + + Provide browser-based access to internal web applications, SSH servers, and + RDP sessions without installing software on user devices. + + + + Set up DNS filtering to block malware, phishing, and unwanted content across + your network in minutes. + + + + Inspect and filter all Internet-bound traffic from your users to block + threats, enforce acceptable use policies, and prevent data loss. + + + + +:::note + +For comprehensive deployment guides that cover configuration, policy design, and production best practices, refer to [Implementation guides](/cloudflare-one/implementation-guides/). +::: diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx new file mode 100644 index 00000000000..4eaa491fecf --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx @@ -0,0 +1,62 @@ +--- +pcx_content_type: get-started +title: "Device to device" +sidebar: + order: 3 + label: Device to device +description: Enable direct peer-to-peer connectivity between devices running the WARP client without requiring tunnels or dedicated network infrastructure. +products: + - cloudflare-one +--- + +import { Details } from "~/components"; + +:::caution[Draft] +This page is a work in progress. Section headings represent the planned structure. Full content will be added in a future update. +::: + +This quick-start walks you through enabling direct device-to-device (peer-to-peer) connectivity using the WARP client. This allows any enrolled device to reach any other enrolled device by its WARP virtual IP address — useful for developer workflows, remote troubleshooting, and ad-hoc connections. + +## How it works + +When WARP-to-WARP is enabled, each enrolled device receives a virtual IP address from Cloudflare's CGNAT range (`100.96.0.0/12`). Devices can connect to each other using these virtual IPs. Traffic flows through Cloudflare's network, where identity and network policies are applied. + +```txt +Device A (WARP) ↔ Cloudflare global network ↔ Device B (WARP) +``` + +No tunnels or dedicated servers are required — only the WARP client on each device. + +## Prerequisites + + + +## Step 1: Turn on WARP-to-WARP connectivity + + + +## Step 2: Configure Split Tunnels for CGNAT range + + + +## Step 3: Install WARP on participating devices + + + +## Step 4: (Recommended) Create access policies + + + +## Verify connectivity + + + +## Troubleshoot + + + +## Next steps + +- For the current reference documentation on WARP-to-WARP, refer to [Peer-to-peer connectivity](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/). +- To also connect devices to a central private network, combine this with [Device to network](/cloudflare-one/setup/replace-vpn/device-to-network/). +- For production hardening and policy design, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx new file mode 100644 index 00000000000..dc0e455c88e --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -0,0 +1,179 @@ +--- +pcx_content_type: get-started +title: "Device to network" +sidebar: + order: 1 + label: Device to network +description: Connect remote users to private networks and applications by deploying the WARP client on devices and creating a Cloudflare Tunnel to your network. +products: + - cloudflare-one +--- + +import { Details, Render, Tabs, TabItem } from "~/components"; + +This quick-start walks you through connecting remote users to private network resources — the most common VPN replacement scenario. By the end, your users will be able to securely access internal applications, databases, and services through Cloudflare's network instead of a traditional VPN. + +## How it works + +Traffic flows from user devices through the WARP client to Cloudflare's global network, then through a Cloudflare Tunnel into your private network. Cloudflare applies identity-based access policies at the network edge, so only authorized users can reach internal resources. + +```txt +User device (WARP) → Cloudflare global network → Cloudflare Tunnel → Private network +``` + +Unlike a VPN, this approach does not require inbound firewall rules on your network — the tunnel creates an outbound-only connection from your infrastructure to Cloudflare. + +## Prerequisites + +Before you begin, make sure you have: + +- A [Cloudflare account](https://dash.cloudflare.com/sign-up) with a [Zero Trust organization](/cloudflare-one/setup/) +- A private network with applications or services you want to make available to remote users +- A host server on the private network (Linux, macOS, Windows, or Docker) that can run the `cloudflared` daemon +- A test device (Windows, macOS, Linux, iOS, or Android) that can run the [WARP client](/cloudflare-one/team-and-resources/devices/warp/download-warp/) + +## Step 1: Configure an identity provider + +An identity provider (IdP) lets Cloudflare verify user identity before granting access to private resources. You can use your existing IdP (such as Okta, Microsoft Entra ID, or Google Workspace) or use Cloudflare's built-in one-time PIN (OTP) for testing. + +1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Integrations** > **Identity providers**. +2. Select **Add new identity provider**. +3. Select your identity provider and follow the configuration steps shown in the side panel. +4. Select **Save**. + +:::note +One-time PIN is enabled by default and works without any additional configuration. This is useful for initial testing, but you should configure a corporate IdP before deploying to production. +::: + +## Step 2: Create a Cloudflare Tunnel + +A Cloudflare Tunnel creates an encrypted, outbound-only connection from your private network to Cloudflare. You do not need to open any inbound ports or configure firewall rules. + +1. In Cloudflare One, go to **Networks** > **Connectors** > **Cloudflare Tunnels**. +2. Select **Create a tunnel**. +3. Choose **Cloudflared** as the connector type and select **Next**. +4. Enter a name for your tunnel (for example, `headquarters-vpn` or `aws-vpc-prod`). +5. Select **Save tunnel**. +6. Under **Choose an environment**, select the operating system of your host server, then copy the install command. +7. Run the command on your host server. Once `cloudflared` connects, you will see a connector appear in the dashboard. +8. Select **Next**. + +### Route your private network + +9. Select the **CIDR** tab. +10. Enter the IP/CIDR range of your private network (for example, `10.0.0.0/8` or `192.168.1.0/24`). +11. Select **Save tunnel**. + +Your tunnel is now running and routing traffic for the specified CIDR range. + +
+ +- **Name tunnels descriptively** ��� use names that reflect the network or environment (for example, `prod-east-vpc`, `staging-dc2`). +- **Run a replica for availability** — deploy `cloudflared` on a second host in the same network to ensure connectivity if one host goes down. Both instances share the same tunnel token. +- **Separate production and staging** — use different tunnels for different environments to limit blast radius. +- **Keep cloudflared updated** — enable automatic updates or include `cloudflared` in your patch management process. + +
+ +## Step 3: Set up device enrollment + +Device enrollment controls which users can register their devices with your Zero Trust organization. + +1. In Cloudflare One, go to **Team & Resources** > **Devices** > **Device profiles** > **Management**. +2. Under **Device enrollment** > **Device enrollment permissions**, select **Manage**. +3. In the **Policies** tab, create an Access policy that defines who can enroll devices. For example: + - **Rule action:** Allow + - **Include:** Emails ending in `@example.com` +4. In the **Login methods** tab, select the identity providers users can authenticate with. +5. Select **Save**. + +## Step 4: Configure Split Tunnels + +By default, the WARP client excludes private IP ranges (RFC 1918) from the tunnel. You need to update Split Tunnel settings so that traffic destined for your private network routes through Cloudflare. + +1. In Cloudflare One, go to **Team & Resources** > **Devices** > **Device profiles** > **General profiles**. +2. Select the **Default** profile and select **Edit**. +3. Go to the **Split Tunnels** setting. The default mode is **Exclude IPs and domains**. +4. Find and remove the entry that contains your private network's CIDR range. For example, if your network uses `10.0.0.0/8`, remove the `10.0.0.0/8` entry. +5. If your network only uses a portion of that range, re-add the unused portions. For example, if your network is `10.1.0.0/16`, remove `10.0.0.0/8` and add back `10.0.0.0/16`, `10.2.0.0/15`, `10.4.0.0/14`, and so on for the unused ranges. + +:::note +A Split Tunnel calculator is available in the dashboard to help you compute the correct entries when splitting a CIDR range. +::: + +## Step 5: Install WARP on a test device + +1. [Download the WARP client](/cloudflare-one/team-and-resources/devices/warp/download-warp/) on your test device. +2. Open the WARP client. +3. Go to **Settings** > **Account** (or **Preferences** > **Account** on desktop). +4. Select **Login with Cloudflare Zero Trust**. +5. Enter your organization's team name (the one you chose during [Zero Trust setup](/cloudflare-one/setup/)). +6. Authenticate with your identity provider. +7. The WARP client should show as **Connected**. + +## Step 6: (Recommended) Enable the Gateway proxy + +The Gateway proxy allows Cloudflare to inspect and apply policies to TCP/UDP traffic flowing between WARP devices and your private network. + +1. In Cloudflare One, go to **Traffic policies** > **Traffic settings**. +2. Under **Proxy and inspection**, turn on **Allow Secure Web Gateway to proxy traffic**. +3. Select **TCP**. +4. (Recommended) Select **UDP** if you have internal DNS resolvers or UDP-based services. +5. (Recommended) Select **ICMP** to allow diagnostic tools such as `ping` and `traceroute`. + +## Step 7: (Recommended) Create access policies + +Without policies, any enrolled device can reach any IP in the routed CIDR range. Create Gateway network policies to control access: + +1. In Cloudflare One, go to **Traffic policies** > **Gateway** > **Network**. +2. Create a catch-all **Block** policy for your private network's CIDR range. This blocks all traffic by default. +3. Create higher-priority **Allow** policies for specific applications or user groups. For example: + - Allow users in the `Engineering` IdP group to reach `10.0.5.0/24` (development servers) + - Allow users in the `Finance` IdP group to reach `10.0.10.50` on port `443` (finance application) + +This deny-by-default approach ensures that new resources on your private network are not accidentally exposed. + +## Verify connectivity + +1. On your test device, make sure the WARP client shows **Connected**. +2. Try to reach a known resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`). +3. In Cloudflare One, go to **Insights** > **Logs** > **Gateway** > **Network** to verify that the traffic appears in the logs. +4. (Optional) Visit `https://help.teams.cloudflare.com/` from your test device. The page should confirm that your network is fully protected and show Gateway Proxy as enabled. + +## Troubleshoot + +
+ +- Verify that the team name entered in the WARP client matches your Zero Trust organization's team name. +- Check that the user's email matches the device enrollment policy. +- If you use a third-party firewall or TLS inspection tool, make sure it does not block traffic to Cloudflare's WARP endpoints (`162.159.137.105`, `162.159.138.105`). + +
+ +
+ +- Confirm that the tunnel is running and healthy in **Networks** > **Connectors** > **Cloudflare Tunnels**. +- Verify that the CIDR route configured on the tunnel matches the IP range of the resources you are trying to reach. +- Check Split Tunnel settings — the private IP range must not be in the Exclude list. +- Verify that the device's local IP address does not overlap with the tunnel's CIDR range. If it does, reconfigure your local network or tighten the Split Tunnel configuration. +- Check Gateway network policies — a Block policy may be preventing the connection. + +
+ +
+ +- Confirm the Gateway proxy is turned on in **Traffic policies** > **Traffic settings**. +- Make sure at least **TCP** is selected under proxy protocols. +- Verify that activity logging is enabled under **Traffic policies** > **Traffic settings** > **Log traffic activity**. + +
+ +## Next steps + +You now have a working Device to network setup. To harden this deployment for production: + +- **Add a tunnel replica** — Deploy `cloudflared` on a second host for high availability. Refer to [Tunnel availability and failover](/cloudflare-one/networks/connectors/cloudflare-tunnel/high-availability/). +- **Deploy WARP at scale** — Use MDM tools (Intune, JAMF) to deploy the WARP client across your device fleet. Refer to [Managed deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/). +- **Configure private DNS** — Resolve internal hostnames (not just IPs) through the tunnel. Refer to [Private DNS](/cloudflare-one/networks/dns/private-dns/). +- **Enable TLS inspection** — Inspect HTTPS traffic for threats and data loss. Refer to [TLS decryption](/cloudflare-one/traffic-policies/gateway-inspection/). +- **Build comprehensive policies** — The [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/) covers advanced policy design, posture checks, and multi-site deployments in depth. diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx new file mode 100644 index 00000000000..4d0477c4238 --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -0,0 +1,63 @@ +--- +pcx_content_type: navigation +title: Replace your VPN +sidebar: + order: 1 +description: Choose a VPN replacement scenario based on how your users and networks need to connect through Cloudflare Zero Trust. +--- + +import { CardGrid, Details, LinkTitleCard } from "~/components"; + +Cloudflare Zero Trust replaces traditional VPNs by routing private traffic through Cloudflare's global network. How you set this up depends on what needs to connect to what. + +Choose the scenario that matches your use case: + + + + + Connect remote users running the WARP client to private networks and + applications behind a Cloudflare Tunnel. This is the most common VPN + replacement scenario. + + + + Connect two or more office networks, data centers, or cloud VPCs to each other + through Cloudflare. Supports bidirectional, server-initiated traffic between + sites. + + + + Enable direct peer-to-peer connectivity between devices running the WARP + client, without requiring a tunnel or dedicated network infrastructure. + + + + +
+ +Most organizations start with **Device to network** — it covers the classic VPN use case where remote employees need to reach internal applications, databases, and services on a private network. + +Choose **Network to network** if you need to connect entire office or data center networks to each other — for example, so servers in one site can initiate connections to servers in another site (Active Directory replication, SCCM, VoIP/SIP). + +Choose **Device to device** if you need peer-to-peer connectivity between individual devices (for example, a developer SSHing directly into a colleague's machine) without routing through a central network. + +You can combine multiple scenarios. For example, you might use Device to network for remote access and Network to network for site-to-site connectivity between offices. + +
+ +:::note + +For a comprehensive, multi-week deployment guide that covers advanced configuration, policy design, and production best practices, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). +::: diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx new file mode 100644 index 00000000000..63589e95ef8 --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -0,0 +1,68 @@ +--- +pcx_content_type: get-started +title: "Network to network" +sidebar: + order: 2 + label: Network to network +description: Connect two or more office networks, data centers, or cloud VPCs to each other through Cloudflare Zero Trust. +products: + - cloudflare-one +--- + +import { Details } from "~/components"; + +:::caution[Draft] +This page is a work in progress. Section headings represent the planned structure. Full content will be added in a future update. +::: + +This quick-start walks you through connecting two or more private networks (offices, data centers, cloud VPCs) so that servers and services in one location can communicate with those in another — without exposing traffic to the public Internet. + +## How it works + +Each site runs a WARP Connector that creates an outbound connection to Cloudflare. Cloudflare routes traffic bidirectionally between sites based on IP routes you configure. Unlike `cloudflared` tunnels (which only support user-initiated traffic), WARP Connector supports server-initiated and bidirectional traffic flows such as Active Directory replication, SCCM updates, VoIP/SIP, and DevOps pipelines. + +```txt +Site A (WARP Connector) ↔ Cloudflare global network ↔ Site B (WARP Connector) +``` + +## When to use WARP Connector vs. Cloudflare WAN + + + +## Prerequisites + + + +## Step 1: Install the first WARP Connector + + + +## Step 2: Route traffic between the first site and Cloudflare + + + +## Step 3: Configure routing on the local network + + + +## Step 4: Install the second WARP Connector + + + +## Step 5: Create access policies + + + +## Verify connectivity + + + +## Troubleshoot + + + +## Next steps + +- For a detailed walkthrough of site-to-site connectivity including Mermaid architecture diagrams, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). +- To add remote user access to these same networks, combine this setup with [Device to network](/cloudflare-one/setup/replace-vpn/device-to-network/). +- For production hardening, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). From 47409565428d7575c6b90d5fcadbe54f9073144f Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 12:47:16 -0600 Subject: [PATCH 02/16] chore: add agents/ to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index b68780a03c4..004470e63d0 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ CLAUDE.md .cursor/ .github/prompts/ .github/agents/ +agents/ From afe191c80c61cd2c8bd087e3176763d0c86ea7f5 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 13:40:23 -0600 Subject: [PATCH 03/16] [Cloudflare One] Add 'why replace your VPN' link to decision page Bridge uncertain users to existing conceptual content without adding positioning copy to the get-started flow. --- src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx index 4d0477c4238..29624daad54 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -8,9 +8,9 @@ description: Choose a VPN replacement scenario based on how your users and netwo import { CardGrid, Details, LinkTitleCard } from "~/components"; -Cloudflare Zero Trust replaces traditional VPNs by routing private traffic through Cloudflare's global network. How you set this up depends on what needs to connect to what. +Cloudflare Zero Trust replaces traditional VPNs by routing private traffic through Cloudflare's global network. Instead of granting users full network access after login, Zero Trust verifies every request based on identity and context — reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](/learning-paths/replace-vpn/concepts/why-vpn/) -Choose the scenario that matches your use case: +How you set this up depends on what needs to connect to what. Choose the scenario that matches your use case: From dfe44d94463b8758e130d64bb85b924322acc2b6 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 14:05:28 -0600 Subject: [PATCH 04/16] fix: replace HTML comments with MDX comments in skeleton pages MDX parses as invalid JSX. Use {/* */} syntax instead. --- .../setup/replace-vpn/device-to-device.mdx | 14 +++++++------- .../setup/replace-vpn/network-to-network.mdx | 18 +++++++++--------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx index 4eaa491fecf..b86a2b3713b 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx @@ -29,31 +29,31 @@ No tunnels or dedicated servers are required — only the WARP client on each de ## Prerequisites - +{/* TODO: Cloudflare account, Zero Trust org, WARP client installed on all participating devices, device enrollment configured */} ## Step 1: Turn on WARP-to-WARP connectivity - +{/* TODO: Steps from warp-to-warp.mdx — Team & Resources > Devices > Management > enable WARP to WARP */} ## Step 2: Configure Split Tunnels for CGNAT range - +{/* TODO: Add 100.96.0.0/12 to Include list (or remove from Exclude list) in Split Tunnel settings */} ## Step 3: Install WARP on participating devices - +{/* TODO: Download, install, enroll with team name — link to shared install steps */} ## Step 4: (Recommended) Create access policies - +{/* TODO: Gateway network policies to control which devices/users can communicate peer-to-peer */} ## Verify connectivity - +{/* TODO: Find device virtual IPs, test connectivity with ping/SSH, check Gateway logs */} ## Troubleshoot - +{/* TODO: Common issues from warp-to-warp.mdx: Windows firewall blocks inbound from 100.96.0.0/12, Split Tunnel misconfiguration */} ## Next steps diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 63589e95ef8..d1a7a9cbbd9 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -27,39 +27,39 @@ Site A (WARP Connector) ↔ Cloudflare global network ↔ Site B (WARP Connector ## When to use WARP Connector vs. Cloudflare WAN - +{/* TODO: Decision table comparing WARP Connector (software, Linux only, L3-L4) vs. Cloudflare WAN (GRE/IPsec, any router, L3) */} ## Prerequisites - +{/* TODO: Cloudflare account, Zero Trust org, Linux host server at each site, network CIDR ranges for each site */} ## Step 1: Install the first WARP Connector - +{/* TODO: Steps from site-to-site.mdx — create device profile, install WARP Connector on Linux host, authenticate */} ## Step 2: Route traffic between the first site and Cloudflare - +{/* TODO: Configure Split Tunnels on the WARP Connector device profile to include the remote site's CIDR */} ## Step 3: Configure routing on the local network - +{/* TODO: Three gateway options from site-to-site.mdx: WARP Connector as default gateway, static route on router, policy-based routing */} ## Step 4: Install the second WARP Connector - +{/* TODO: Repeat for second site */} ## Step 5: Create access policies - +{/* TODO: Gateway network policies to control inter-site traffic */} ## Verify connectivity - +{/* TODO: Test bidirectional connectivity between sites, check Gateway logs */} ## Troubleshoot - +{/* TODO: Common issues: Split Tunnel misconfiguration, overlapping CIDRs, gateway routing issues */} ## Next steps From 071ddc82bd52a5014e9b756a82136c8d13e438f3 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 15:45:47 -0600 Subject: [PATCH 05/16] fix: correct 3 broken links in device-to-network next steps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - high-availability → configure-tunnels/tunnel-availability - private-dns → private-net/cloudflared/private-dns - gateway-inspection → http-policies/tls-decryption --- .../cloudflare-one/setup/replace-vpn/device-to-network.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index dc0e455c88e..c4dd8ee7785 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -172,8 +172,8 @@ This deny-by-default approach ensures that new resources on your private network You now have a working Device to network setup. To harden this deployment for production: -- **Add a tunnel replica** — Deploy `cloudflared` on a second host for high availability. Refer to [Tunnel availability and failover](/cloudflare-one/networks/connectors/cloudflare-tunnel/high-availability/). +- **Add a tunnel replica** — Deploy `cloudflared` on a second host for high availability. Refer to [Tunnel availability and failover](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/). - **Deploy WARP at scale** — Use MDM tools (Intune, JAMF) to deploy the WARP client across your device fleet. Refer to [Managed deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/). -- **Configure private DNS** — Resolve internal hostnames (not just IPs) through the tunnel. Refer to [Private DNS](/cloudflare-one/networks/dns/private-dns/). -- **Enable TLS inspection** — Inspect HTTPS traffic for threats and data loss. Refer to [TLS decryption](/cloudflare-one/traffic-policies/gateway-inspection/). +- **Configure private DNS** — Resolve internal hostnames (not just IPs) through the tunnel. Refer to [Private DNS](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/). +- **Enable TLS inspection** — Inspect HTTPS traffic for threats and data loss. Refer to [TLS decryption](/cloudflare-one/traffic-policies/http-policies/tls-decryption/). - **Build comprehensive policies** — The [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/) covers advanced policy design, posture checks, and multi-site deployments in depth. From 88908746b12b01acc732703463ae2b5460dd9378 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 16:15:24 -0600 Subject: [PATCH 06/16] [Cloudflare One] Add dashboard Get Started reference to setup landing page Bridge returning users from the Overview tab to the onboarding flows. --- src/content/docs/cloudflare-one/setup/index.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/index.mdx b/src/content/docs/cloudflare-one/setup/index.mdx index 0489a1c69b8..a2f5430240d 100644 --- a/src/content/docs/cloudflare-one/setup/index.mdx +++ b/src/content/docs/cloudflare-one/setup/index.mdx @@ -8,7 +8,7 @@ description: Set up Cloudflare Zero Trust for your organization. Choose a use ca import { CardGrid, LinkTitleCard, Render } from "~/components"; -Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. +Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. You can also select **Get Started** in the [Cloudflare One dashboard](https://one.dash.cloudflare.com) for guided onboarding. ## Prerequisites From 30790dba4505559da5a60996e6a8642149784e3a Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 2 Mar 2026 16:20:17 -0600 Subject: [PATCH 07/16] [Cloudflare One] Point implementation guides 'Replace VPN' to new quick-start Both sidebar entries now land users on the same decision page. The quick-start page links to the full learning path for deeper content. --- .../docs/cloudflare-one/implementation-guides/index.mdx | 5 +++-- .../cloudflare-one/implementation-guides/replace-vpn.mdx | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/content/docs/cloudflare-one/implementation-guides/index.mdx b/src/content/docs/cloudflare-one/implementation-guides/index.mdx index 978726414e5..2d18f379fc4 100644 --- a/src/content/docs/cloudflare-one/implementation-guides/index.mdx +++ b/src/content/docs/cloudflare-one/implementation-guides/index.mdx @@ -24,10 +24,11 @@ Implementation guides cover deployment steps and best practices for specific Clo - Give users secure, auditable network and application access. + Give remote users, offices, and devices secure access to private networks and + applications without a traditional VPN. Date: Mon, 2 Mar 2026 17:15:42 -0600 Subject: [PATCH 08/16] [Cloudflare One] Rewrite device-to-network to match dashboard 6-step wizard (PCX-20915) - Rewrote device-to-network.mdx to mirror the exact 6-step Get Started onboarding flow in the Cloudflare One dashboard - Removed production-oriented steps (IdP config, Split Tunnels, Gateway proxy, access policies) that belong in the learning path, not the quick-start - Updated setup landing page: moved dashboard reference from intro to card section, aligned heading with dashboard UX, removed production hardening language --- .../docs/cloudflare-one/setup/index.mdx | 8 +- .../setup/replace-vpn/device-to-network.mdx | 171 ++++++------------ 2 files changed, 59 insertions(+), 120 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/index.mdx b/src/content/docs/cloudflare-one/setup/index.mdx index a2f5430240d..ab33a2f8952 100644 --- a/src/content/docs/cloudflare-one/setup/index.mdx +++ b/src/content/docs/cloudflare-one/setup/index.mdx @@ -8,7 +8,7 @@ description: Set up Cloudflare Zero Trust for your organization. Choose a use ca import { CardGrid, LinkTitleCard, Render } from "~/components"; -Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. You can also select **Get Started** in the [Cloudflare One dashboard](https://one.dash.cloudflare.com) for guided onboarding. +Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. ## Prerequisites @@ -22,9 +22,9 @@ Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up) and enab -## What do you want to do? +## What would you like to do? -Choose the use case that best describes your goal. Each quick-start guides you through the minimum steps to get up and running, then links to deeper resources for production hardening. +These use cases match the guided onboarding in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). To follow along in the dashboard, select **Get Started**. @@ -68,5 +68,5 @@ Choose the use case that best describes your goal. Each quick-start guides you t :::note -For comprehensive deployment guides that cover configuration, policy design, and production best practices, refer to [Implementation guides](/cloudflare-one/implementation-guides/). +For in-depth deployment guides that cover policy design and advanced configuration, refer to [Implementation guides](/cloudflare-one/implementation-guides/). ::: diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index c4dd8ee7785..a14e78d2461 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -4,141 +4,100 @@ title: "Device to network" sidebar: order: 1 label: Device to network -description: Connect remote users to private networks and applications by deploying the WARP client on devices and creating a Cloudflare Tunnel to your network. +description: Connect a remote device to a private network using Cloudflare Tunnel and the WARP client. products: - cloudflare-one --- -import { Details, Render, Tabs, TabItem } from "~/components"; +import { Details } from "~/components"; -This quick-start walks you through connecting remote users to private network resources — the most common VPN replacement scenario. By the end, your users will be able to securely access internal applications, databases, and services through Cloudflare's network instead of a traditional VPN. +Connect a remote device to a private network so your users can securely access internal applications and services from anywhere. This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). + +**Steps:** 6 | **Estimated time:** 10 minutes ## How it works -Traffic flows from user devices through the WARP client to Cloudflare's global network, then through a Cloudflare Tunnel into your private network. Cloudflare applies identity-based access policies at the network edge, so only authorized users can reach internal resources. +You will deploy a network connector (Cloudflare Tunnel) and the WARP device agent to establish a Zero Trust private network configuration that your devices can connect to from anywhere. ```txt -User device (WARP) → Cloudflare global network → Cloudflare Tunnel → Private network +Device agent (WARP) → Cloudflare → cloudflared → Private network (for example, 192.168.0.220) ``` -Unlike a VPN, this approach does not require inbound firewall rules on your network — the tunnel creates an outbound-only connection from your infrastructure to Cloudflare. - -## Prerequisites - -Before you begin, make sure you have: - -- A [Cloudflare account](https://dash.cloudflare.com/sign-up) with a [Zero Trust organization](/cloudflare-one/setup/) -- A private network with applications or services you want to make available to remote users -- A host server on the private network (Linux, macOS, Windows, or Docker) that can run the `cloudflared` daemon -- A test device (Windows, macOS, Linux, iOS, or Android) that can run the [WARP client](/cloudflare-one/team-and-resources/devices/warp/download-warp/) - -## Step 1: Configure an identity provider +**You will need:** -An identity provider (IdP) lets Cloudflare verify user identity before granting access to private resources. You can use your existing IdP (such as Okta, Microsoft Entra ID, or Google Workspace) or use Cloudflare's built-in one-time PIN (OTP) for testing. - -1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Integrations** > **Identity providers**. -2. Select **Add new identity provider**. -3. Select your identity provider and follow the configuration steps shown in the side panel. -4. Select **Save**. - -:::note -One-time PIN is enabled by default and works without any additional configuration. This is useful for initial testing, but you should configure a corporate IdP before deploying to production. -::: +- A Linux, Windows, or macOS device currently connected to your private network. This is where you will install Tunnel software. +- A Linux, Windows, or macOS device you or another user can reach your private network from. This is where you will install WARP. -## Step 2: Create a Cloudflare Tunnel +## Step 1: Assign a Tunnel -A Cloudflare Tunnel creates an encrypted, outbound-only connection from your private network to Cloudflare. You do not need to open any inbound ports or configure firewall rules. +Cloudflare Tunnel establishes an outbound connection between your resources and Cloudflare. This is how new devices can reach your private network. You can install Tunnel on any Windows, Mac, or Linux device currently in your private network. -1. In Cloudflare One, go to **Networks** > **Connectors** > **Cloudflare Tunnels**. -2. Select **Create a tunnel**. -3. Choose **Cloudflared** as the connector type and select **Next**. -4. Enter a name for your tunnel (for example, `headquarters-vpn` or `aws-vpc-prod`). -5. Select **Save tunnel**. -6. Under **Choose an environment**, select the operating system of your host server, then copy the install command. -7. Run the command on your host server. Once `cloudflared` connects, you will see a connector appear in the dashboard. -8. Select **Next**. +1. In [Cloudflare One](https://one.dash.cloudflare.com), select **Get Started** and then select **Replace my client-based or site-to-site VPN** > **Device to network**. +2. On the **Assign a Tunnel** screen, use the dropdown to choose an existing tunnel or create a new one. +3. Select **Continue**. -### Route your private network +## Step 2: Set your Tunnel's IP range -9. Select the **CIDR** tab. -10. Enter the IP/CIDR range of your private network (for example, `10.0.0.0/8` or `192.168.1.0/24`). -11. Select **Save tunnel**. +Add the IP range of your private network to the tunnel. Your Tunnel will accept traffic to this range from devices enrolled in your Zero Trust organization. -Your tunnel is now running and routing traffic for the specified CIDR range. +1. Enter your IP range (for example, `10.0.1.0/24`). +2. Select **Continue**. -
+## Step 3: Deploy your Tunnel -- **Name tunnels descriptively** ��� use names that reflect the network or environment (for example, `prod-east-vpc`, `staging-dc2`). -- **Run a replica for availability** — deploy `cloudflared` on a second host in the same network to ensure connectivity if one host goes down. Both instances share the same tunnel token. -- **Separate production and staging** — use different tunnels for different environments to limit blast radius. -- **Keep cloudflared updated** — enable automatic updates or include `cloudflared` in your patch management process. +Install `cloudflared` on a device in your private network and run the tunnel. -
+1. Select your device's operating system. +2. Copy the install command displayed in the dashboard. For macOS, the command will look similar to: -## Step 3: Set up device enrollment + ```sh + brew install cloudflared && sudo cloudflared service install eyJhIjoiZj... + ``` -Device enrollment controls which users can register their devices with your Zero Trust organization. + For Windows, open Command Prompt as an administrator. For Linux and macOS, use a terminal window. -1. In Cloudflare One, go to **Team & Resources** > **Devices** > **Device profiles** > **Management**. -2. Under **Device enrollment** > **Device enrollment permissions**, select **Manage**. -3. In the **Policies** tab, create an Access policy that defines who can enroll devices. For example: - - **Rule action:** Allow - - **Include:** Emails ending in `@example.com` -4. In the **Login methods** tab, select the identity providers users can authenticate with. -5. Select **Save**. +3. Run the command on your device. After `cloudflared` connects, the dashboard will confirm the tunnel is active. +4. Select **Continue**. -## Step 4: Configure Split Tunnels +## Step 4: Enroll your devices -By default, the WARP client excludes private IP ranges (RFC 1918) from the tunnel. You need to update Split Tunnel settings so that traffic destined for your private network routes through Cloudflare. +Enrollment permissions determine who can connect devices to the resources you put behind Zero Trust. Enter an email and download the WARP client on devices you want to reach your private network. -1. In Cloudflare One, go to **Team & Resources** > **Devices** > **Device profiles** > **General profiles**. -2. Select the **Default** profile and select **Edit**. -3. Go to the **Split Tunnels** setting. The default mode is **Exclude IPs and domains**. -4. Find and remove the entry that contains your private network's CIDR range. For example, if your network uses `10.0.0.0/8`, remove the `10.0.0.0/8` entry. -5. If your network only uses a portion of that range, re-add the unused portions. For example, if your network is `10.1.0.0/16`, remove `10.0.0.0/8` and add back `10.0.0.0/16`, `10.2.0.0/15`, `10.4.0.0/14`, and so on for the unused ranges. +1. Enter the email you want to use to enroll your first device. +2. Select your device's operating system. +3. Select **Download to continue** to download the WARP client, or copy the download link to send to a different device. +4. Select **Continue**. :::note -A Split Tunnel calculator is available in the dashboard to help you compute the correct entries when splitting a CIDR range. +You can manage device enrollment permissions later in **Team & Resources** > **Devices**. ::: -## Step 5: Install WARP on a test device - -1. [Download the WARP client](/cloudflare-one/team-and-resources/devices/warp/download-warp/) on your test device. -2. Open the WARP client. -3. Go to **Settings** > **Account** (or **Preferences** > **Account** on desktop). -4. Select **Login with Cloudflare Zero Trust**. -5. Enter your organization's team name (the one you chose during [Zero Trust setup](/cloudflare-one/setup/)). -6. Authenticate with your identity provider. -7. The WARP client should show as **Connected**. +## Step 5: Complete WARP setup -## Step 6: (Recommended) Enable the Gateway proxy +On your device, complete the WARP installation wizard. Then connect WARP to your Zero Trust organization. -The Gateway proxy allows Cloudflare to inspect and apply policies to TCP/UDP traffic flowing between WARP devices and your private network. +1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. +2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. +3. Enter your team name when prompted. The dashboard displays your team name on this screen for easy reference. +4. Complete the authentication steps. +5. The WARP client should show as **Connected**. +6. Select **Continue** in the dashboard. -1. In Cloudflare One, go to **Traffic policies** > **Traffic settings**. -2. Under **Proxy and inspection**, turn on **Allow Secure Web Gateway to proxy traffic**. -3. Select **TCP**. -4. (Recommended) Select **UDP** if you have internal DNS resolvers or UDP-based services. -5. (Recommended) Select **ICMP** to allow diagnostic tools such as `ping` and `traceroute`. +## Step 6: Verify your connection -## Step 7: (Recommended) Create access policies +The dashboard will confirm that you are securely connected. You have established remote access between your device and your private network resources. -Without policies, any enrolled device can reach any IP in the routed CIDR range. Create Gateway network policies to control access: +Try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`) to verify connectivity. -1. In Cloudflare One, go to **Traffic policies** > **Gateway** > **Network**. -2. Create a catch-all **Block** policy for your private network's CIDR range. This blocks all traffic by default. -3. Create higher-priority **Allow** policies for specific applications or user groups. For example: - - Allow users in the `Engineering` IdP group to reach `10.0.5.0/24` (development servers) - - Allow users in the `Finance` IdP group to reach `10.0.10.50` on port `443` (finance application) +## Recommended next steps -This deny-by-default approach ensures that new resources on your private network are not accidentally exposed. +After verifying your connection, the dashboard suggests these next steps: -## Verify connectivity +- **Set up Gateway policies** — Add a DNS policy that targets the domain list for your application, then create a network policy that targets its IP list. Go to **Traffic policies** > **Gateway** in the dashboard. +- **Create an Access application** — Add your private network as a self-hosted Access application for more granular access and identity control. +- **Explore more with Zero Trust** — View your created application, policy, and Tunnel. Then configure and manage more with Zero Trust. -1. On your test device, make sure the WARP client shows **Connected**. -2. Try to reach a known resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`). -3. In Cloudflare One, go to **Insights** > **Logs** > **Gateway** > **Network** to verify that the traffic appears in the logs. -4. (Optional) Visit `https://help.teams.cloudflare.com/` from your test device. The page should confirm that your network is fully protected and show Gateway Proxy as enabled. +For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). ## Troubleshoot @@ -153,27 +112,7 @@ This deny-by-default approach ensures that new resources on your private network
- Confirm that the tunnel is running and healthy in **Networks** > **Connectors** > **Cloudflare Tunnels**. -- Verify that the CIDR route configured on the tunnel matches the IP range of the resources you are trying to reach. -- Check Split Tunnel settings — the private IP range must not be in the Exclude list. -- Verify that the device's local IP address does not overlap with the tunnel's CIDR range. If it does, reconfigure your local network or tighten the Split Tunnel configuration. -- Check Gateway network policies — a Block policy may be preventing the connection. +- Verify that the IP range configured on the tunnel matches the resources you are trying to reach. +- Check that your device's local IP address does not overlap with the tunnel's IP range.
- -
- -- Confirm the Gateway proxy is turned on in **Traffic policies** > **Traffic settings**. -- Make sure at least **TCP** is selected under proxy protocols. -- Verify that activity logging is enabled under **Traffic policies** > **Traffic settings** > **Log traffic activity**. - -
- -## Next steps - -You now have a working Device to network setup. To harden this deployment for production: - -- **Add a tunnel replica** — Deploy `cloudflared` on a second host for high availability. Refer to [Tunnel availability and failover](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/). -- **Deploy WARP at scale** — Use MDM tools (Intune, JAMF) to deploy the WARP client across your device fleet. Refer to [Managed deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/). -- **Configure private DNS** — Resolve internal hostnames (not just IPs) through the tunnel. Refer to [Private DNS](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/). -- **Enable TLS inspection** — Inspect HTTPS traffic for threats and data loss. Refer to [TLS decryption](/cloudflare-one/traffic-policies/http-policies/tls-decryption/). -- **Build comprehensive policies** — The [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/) covers advanced policy design, posture checks, and multi-site deployments in depth. From 3747cf3833710418215e82f84414676fd82a8be6 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 4 Mar 2026 10:52:33 -0600 Subject: [PATCH 09/16] [Cloudflare One] Narrow PR scope to device-to-network only - Remove skeleton pages for network-to-network and device-to-device (will be added in follow-up PRs) - Remove corresponding cards and Details accordion from replace-vpn navigation page - Keep setup landing page cards as-is (all link to existing content) --- .../setup/replace-vpn/device-to-device.mdx | 62 ----------------- .../setup/replace-vpn/index.mdx | 37 +--------- .../setup/replace-vpn/network-to-network.mdx | 68 ------------------- 3 files changed, 3 insertions(+), 164 deletions(-) delete mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx delete mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx deleted file mode 100644 index b86a2b3713b..00000000000 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-device.mdx +++ /dev/null @@ -1,62 +0,0 @@ ---- -pcx_content_type: get-started -title: "Device to device" -sidebar: - order: 3 - label: Device to device -description: Enable direct peer-to-peer connectivity between devices running the WARP client without requiring tunnels or dedicated network infrastructure. -products: - - cloudflare-one ---- - -import { Details } from "~/components"; - -:::caution[Draft] -This page is a work in progress. Section headings represent the planned structure. Full content will be added in a future update. -::: - -This quick-start walks you through enabling direct device-to-device (peer-to-peer) connectivity using the WARP client. This allows any enrolled device to reach any other enrolled device by its WARP virtual IP address — useful for developer workflows, remote troubleshooting, and ad-hoc connections. - -## How it works - -When WARP-to-WARP is enabled, each enrolled device receives a virtual IP address from Cloudflare's CGNAT range (`100.96.0.0/12`). Devices can connect to each other using these virtual IPs. Traffic flows through Cloudflare's network, where identity and network policies are applied. - -```txt -Device A (WARP) ↔ Cloudflare global network ↔ Device B (WARP) -``` - -No tunnels or dedicated servers are required — only the WARP client on each device. - -## Prerequisites - -{/* TODO: Cloudflare account, Zero Trust org, WARP client installed on all participating devices, device enrollment configured */} - -## Step 1: Turn on WARP-to-WARP connectivity - -{/* TODO: Steps from warp-to-warp.mdx — Team & Resources > Devices > Management > enable WARP to WARP */} - -## Step 2: Configure Split Tunnels for CGNAT range - -{/* TODO: Add 100.96.0.0/12 to Include list (or remove from Exclude list) in Split Tunnel settings */} - -## Step 3: Install WARP on participating devices - -{/* TODO: Download, install, enroll with team name — link to shared install steps */} - -## Step 4: (Recommended) Create access policies - -{/* TODO: Gateway network policies to control which devices/users can communicate peer-to-peer */} - -## Verify connectivity - -{/* TODO: Find device virtual IPs, test connectivity with ping/SSH, check Gateway logs */} - -## Troubleshoot - -{/* TODO: Common issues from warp-to-warp.mdx: Windows firewall blocks inbound from 100.96.0.0/12, Split Tunnel misconfiguration */} - -## Next steps - -- For the current reference documentation on WARP-to-WARP, refer to [Peer-to-peer connectivity](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-to-warp/). -- To also connect devices to a central private network, combine this with [Device to network](/cloudflare-one/setup/replace-vpn/device-to-network/). -- For production hardening and policy design, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx index 29624daad54..5b54e0cef9d 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -3,10 +3,10 @@ pcx_content_type: navigation title: Replace your VPN sidebar: order: 1 -description: Choose a VPN replacement scenario based on how your users and networks need to connect through Cloudflare Zero Trust. +description: Replace your traditional VPN with Cloudflare Zero Trust. Choose a connection scenario to get started. --- -import { CardGrid, Details, LinkTitleCard } from "~/components"; +import { CardGrid, LinkTitleCard } from "~/components"; Cloudflare Zero Trust replaces traditional VPNs by routing private traffic through Cloudflare's global network. Instead of granting users full network access after login, Zero Trust verifies every request based on identity and context — reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](/learning-paths/replace-vpn/concepts/why-vpn/) @@ -24,40 +24,9 @@ How you set this up depends on what needs to connect to what. Choose the scenari replacement scenario. - - Connect two or more office networks, data centers, or cloud VPCs to each other - through Cloudflare. Supports bidirectional, server-initiated traffic between - sites. - - - - Enable direct peer-to-peer connectivity between devices running the WARP - client, without requiring a tunnel or dedicated network infrastructure. - - -
- -Most organizations start with **Device to network** — it covers the classic VPN use case where remote employees need to reach internal applications, databases, and services on a private network. - -Choose **Network to network** if you need to connect entire office or data center networks to each other — for example, so servers in one site can initiate connections to servers in another site (Active Directory replication, SCCM, VoIP/SIP). - -Choose **Device to device** if you need peer-to-peer connectivity between individual devices (for example, a developer SSHing directly into a colleague's machine) without routing through a central network. - -You can combine multiple scenarios. For example, you might use Device to network for remote access and Network to network for site-to-site connectivity between offices. - -
- :::note -For a comprehensive, multi-week deployment guide that covers advanced configuration, policy design, and production best practices, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). +For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). ::: diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx deleted file mode 100644 index d1a7a9cbbd9..00000000000 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ /dev/null @@ -1,68 +0,0 @@ ---- -pcx_content_type: get-started -title: "Network to network" -sidebar: - order: 2 - label: Network to network -description: Connect two or more office networks, data centers, or cloud VPCs to each other through Cloudflare Zero Trust. -products: - - cloudflare-one ---- - -import { Details } from "~/components"; - -:::caution[Draft] -This page is a work in progress. Section headings represent the planned structure. Full content will be added in a future update. -::: - -This quick-start walks you through connecting two or more private networks (offices, data centers, cloud VPCs) so that servers and services in one location can communicate with those in another — without exposing traffic to the public Internet. - -## How it works - -Each site runs a WARP Connector that creates an outbound connection to Cloudflare. Cloudflare routes traffic bidirectionally between sites based on IP routes you configure. Unlike `cloudflared` tunnels (which only support user-initiated traffic), WARP Connector supports server-initiated and bidirectional traffic flows such as Active Directory replication, SCCM updates, VoIP/SIP, and DevOps pipelines. - -```txt -Site A (WARP Connector) ↔ Cloudflare global network ↔ Site B (WARP Connector) -``` - -## When to use WARP Connector vs. Cloudflare WAN - -{/* TODO: Decision table comparing WARP Connector (software, Linux only, L3-L4) vs. Cloudflare WAN (GRE/IPsec, any router, L3) */} - -## Prerequisites - -{/* TODO: Cloudflare account, Zero Trust org, Linux host server at each site, network CIDR ranges for each site */} - -## Step 1: Install the first WARP Connector - -{/* TODO: Steps from site-to-site.mdx — create device profile, install WARP Connector on Linux host, authenticate */} - -## Step 2: Route traffic between the first site and Cloudflare - -{/* TODO: Configure Split Tunnels on the WARP Connector device profile to include the remote site's CIDR */} - -## Step 3: Configure routing on the local network - -{/* TODO: Three gateway options from site-to-site.mdx: WARP Connector as default gateway, static route on router, policy-based routing */} - -## Step 4: Install the second WARP Connector - -{/* TODO: Repeat for second site */} - -## Step 5: Create access policies - -{/* TODO: Gateway network policies to control inter-site traffic */} - -## Verify connectivity - -{/* TODO: Test bidirectional connectivity between sites, check Gateway logs */} - -## Troubleshoot - -{/* TODO: Common issues: Split Tunnel misconfiguration, overlapping CIDRs, gateway routing issues */} - -## Next steps - -- For a detailed walkthrough of site-to-site connectivity including Mermaid architecture diagrams, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). -- To add remote user access to these same networks, combine this setup with [Device to network](/cloudflare-one/setup/replace-vpn/device-to-network/). -- For production hardening, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). From a6fbc19dd3493b4aaa3533f58041452dd45c9a57 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 4 Mar 2026 13:19:49 -0600 Subject: [PATCH 10/16] [Cloudflare One] Style and content review fixes for device-to-network - Align implementation guides card titles with get-started landing page - Replace code block flow diagram with prose in How it works section - Promote 'You need' list to standard Prerequisites heading - Fix future tense to present tense throughout - Break multi-page navigation into separate procedural steps - Genericize tunnel token placeholder in install command example - Replace AI-generated troubleshooting with links to canonical docs - Use standard 'refer to' link pattern for recommended next steps - Remove unused Details component import --- .../implementation-guides/index.mdx | 11 ++-- .../setup/replace-vpn/device-to-network.mdx | 58 +++++++------------ 2 files changed, 27 insertions(+), 42 deletions(-) diff --git a/src/content/docs/cloudflare-one/implementation-guides/index.mdx b/src/content/docs/cloudflare-one/implementation-guides/index.mdx index 2d18f379fc4..c8ced420f3b 100644 --- a/src/content/docs/cloudflare-one/implementation-guides/index.mdx +++ b/src/content/docs/cloudflare-one/implementation-guides/index.mdx @@ -14,12 +14,12 @@ Implementation guides cover deployment steps and best practices for specific Clo - Provide your users and networks with a secure, performant, and flexible path - to the Internet. + Inspect and filter all Internet-bound traffic from your users to block + threats, enforce acceptable use policies, and prevent data loss. - Secure access to internal web applications without a device client. + Provide browser-based access to internal web applications, SSH servers, and + RDP sessions without installing software on user devices. **Device to network**. -2. On the **Assign a Tunnel** screen, use the dropdown to choose an existing tunnel or create a new one. -3. Select **Continue**. +1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. +2. For **Replace my client-based or site-to-site VPN**, select **Get started**. +3. For **Device to network**, select **Continue**. +4. On the **Connect a remote device to a private network** screen, select **Continue**. +5. On the **Assign a Tunnel** screen, use the dropdown to choose an existing tunnel or create a new one. +6. Select **Continue**. ## Step 2: Set your Tunnel's IP range -Add the IP range of your private network to the tunnel. Your Tunnel will accept traffic to this range from devices enrolled in your Zero Trust organization. +Add the IP range of your private network to the tunnel. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. 1. Enter your IP range (for example, `10.0.1.0/24`). 2. Select **Continue**. @@ -48,15 +43,15 @@ Add the IP range of your private network to the tunnel. Your Tunnel will accept Install `cloudflared` on a device in your private network and run the tunnel. 1. Select your device's operating system. -2. Copy the install command displayed in the dashboard. For macOS, the command will look similar to: +2. Copy the install command displayed in the dashboard. For macOS, the command looks similar to: ```sh - brew install cloudflared && sudo cloudflared service install eyJhIjoiZj... + brew install cloudflared && sudo cloudflared service install ``` For Windows, open Command Prompt as an administrator. For Linux and macOS, use a terminal window. -3. Run the command on your device. After `cloudflared` connects, the dashboard will confirm the tunnel is active. +3. Run the command on your device. After `cloudflared` connects, the dashboard confirms the tunnel is active. 4. Select **Continue**. ## Step 4: Enroll your devices @@ -85,7 +80,7 @@ On your device, complete the WARP installation wizard. Then connect WARP to your ## Step 6: Verify your connection -The dashboard will confirm that you are securely connected. You have established remote access between your device and your private network resources. +The dashboard confirms that you are securely connected. You now have remote access between your device and your private network resources. Try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`) to verify connectivity. @@ -93,26 +88,15 @@ Try reaching a resource on your private network (for example, `http://10.0.1.100 After verifying your connection, the dashboard suggests these next steps: -- **Set up Gateway policies** — Add a DNS policy that targets the domain list for your application, then create a network policy that targets its IP list. Go to **Traffic policies** > **Gateway** in the dashboard. -- **Create an Access application** — Add your private network as a self-hosted Access application for more granular access and identity control. -- **Explore more with Zero Trust** — View your created application, policy, and Tunnel. Then configure and manage more with Zero Trust. +- **Set up Gateway policies** — Add a DNS policy that targets the domain list for your application, then create a network policy that targets its IP list. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). +- **Create an Access application** — Add your private network as a self-hosted Access application for more granular access and identity control. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). +- **Explore more with Zero Trust** — Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). ## Troubleshoot -
- -- Verify that the team name entered in the WARP client matches your Zero Trust organization's team name. -- Check that the user's email matches the device enrollment policy. -- If you use a third-party firewall or TLS inspection tool, make sure it does not block traffic to Cloudflare's WARP endpoints (`162.159.137.105`, `162.159.138.105`). - -
- -
- -- Confirm that the tunnel is running and healthy in **Networks** > **Connectors** > **Cloudflare Tunnels**. -- Verify that the IP range configured on the tunnel matches the resources you are trying to reach. -- Check that your device's local IP address does not overlap with the tunnel's IP range. +If you have issues connecting, refer to these resources: -
+- [Troubleshoot WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/) — resolve WARP client connection and enrollment issues. +- [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/) — diagnose tunnel connectivity and routing problems. From e501e2287d5ffa84fb276a813dbfc5425be686e7 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 4 Mar 2026 15:13:53 -0600 Subject: [PATCH 11/16] [Cloudflare One] Apply eli5 clarity pass to device-to-network - Add value framing to intro (VPN security risks and performance) - Explain why outbound-only tunnel matters (no inbound ports) - Link WARP client on first mention - Add context for IP range step and helper note for SMB users - Define cloudflared as connector software - Rewrite enrollment step to replace jargon with plain language - Add context for team name (what it is, where it came from) - Replace em dashes with colons throughout --- .../setup/replace-vpn/device-to-network.mdx | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index 55088704cfa..778fb467b1d 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -9,11 +9,11 @@ products: - cloudflare-one --- -Connect a remote device to a private network so your users can securely access internal applications and services from anywhere. This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). +Connect a remote device to a private network so your users can securely access internal applications and services from anywhere, without the security risks and performance bottlenecks of a traditional VPN. This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). ## How it works -A Cloudflare Tunnel connects your private network to Cloudflare through an outbound-only connection. The WARP client on each user device routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. +A Cloudflare Tunnel connects your private network to Cloudflare through an outbound-only connection. No open inbound ports or firewall changes are required. The [WARP client](/cloudflare-one/team-and-resources/devices/warp/) on each user device routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. ## Prerequisites @@ -33,14 +33,18 @@ Cloudflare Tunnel establishes an outbound connection between your resources and ## Step 2: Set your Tunnel's IP range -Add the IP range of your private network to the tunnel. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. +Add the IP range of your private network to the tunnel. This defines which internal resources your remote users can reach. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. 1. Enter your IP range (for example, `10.0.1.0/24`). 2. Select **Continue**. +:::note +If you are not sure of your IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. +::: + ## Step 3: Deploy your Tunnel -Install `cloudflared` on a device in your private network and run the tunnel. +Install the `cloudflared` connector on a device in your private network and run the tunnel. This software creates the secure connection between your network and Cloudflare. 1. Select your device's operating system. 2. Copy the install command displayed in the dashboard. For macOS, the command looks similar to: @@ -56,7 +60,7 @@ Install `cloudflared` on a device in your private network and run the tunnel. ## Step 4: Enroll your devices -Enrollment permissions determine who can connect devices to the resources you put behind Zero Trust. Enter an email and download the WARP client on devices you want to reach your private network. +Device enrollment controls which users can connect their devices to your private network through Cloudflare. In this step, you register your first device by providing an email address and installing the WARP client. 1. Enter the email you want to use to enroll your first device. 2. Select your device's operating system. @@ -73,7 +77,7 @@ On your device, complete the WARP installation wizard. Then connect WARP to your 1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. 2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. -3. Enter your team name when prompted. The dashboard displays your team name on this screen for easy reference. +3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. 4. Complete the authentication steps. 5. The WARP client should show as **Connected**. 6. Select **Continue** in the dashboard. @@ -88,9 +92,9 @@ Try reaching a resource on your private network (for example, `http://10.0.1.100 After verifying your connection, the dashboard suggests these next steps: -- **Set up Gateway policies** — Add a DNS policy that targets the domain list for your application, then create a network policy that targets its IP list. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). -- **Create an Access application** — Add your private network as a self-hosted Access application for more granular access and identity control. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). -- **Explore more with Zero Trust** — Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). +- **Set up Gateway policies**: Add a DNS policy that targets the domain list for your application, then create a network policy that targets its IP list. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). +- **Create an Access application**: Add your private network as a self-hosted Access application for more granular access and identity control. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). +- **Explore more with Zero Trust**: Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). @@ -98,5 +102,5 @@ For in-depth guidance on policy design, device posture checks, and multi-site de If you have issues connecting, refer to these resources: -- [Troubleshoot WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/) — resolve WARP client connection and enrollment issues. -- [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/) — diagnose tunnel connectivity and routing problems. +- [Troubleshoot WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/): resolve WARP client connection and enrollment issues. +- [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From 451e3c8ff935aa11d5c8f355bd0063a69ac7049d Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 4 Mar 2026 16:45:27 -0600 Subject: [PATCH 12/16] [Cloudflare One] Address reviewer feedback on replace-vpn quick-start - Rewrite replace-vpn intro to use Cloudflare One branding and ZTNA framing - Align card descriptions across replace-vpn and implementation-guides pages - Expand How it works with network connector and device agent definitions - Add team name Settings path for discoverability - Add Windows system tray reference and manual deployment link in Step 5 - Rewrite next steps with why context instead of dashboard-suggests framing --- .../cloudflare-one/implementation-guides/index.mdx | 4 ++-- .../setup/replace-vpn/device-to-network.mdx | 14 +++++++------- .../cloudflare-one/setup/replace-vpn/index.mdx | 7 +++---- 3 files changed, 12 insertions(+), 13 deletions(-) diff --git a/src/content/docs/cloudflare-one/implementation-guides/index.mdx b/src/content/docs/cloudflare-one/implementation-guides/index.mdx index c8ced420f3b..ccef3c2f6f5 100644 --- a/src/content/docs/cloudflare-one/implementation-guides/index.mdx +++ b/src/content/docs/cloudflare-one/implementation-guides/index.mdx @@ -27,8 +27,8 @@ Implementation guides cover deployment steps and best practices for specific Clo href="/cloudflare-one/setup/replace-vpn/" icon="seti:db" > - Give remote users, offices, and devices secure access to private networks and - applications without a traditional VPN. + Connect remote users to internal applications and services through a secure + connection. Best for remote access to private networks. **D ## Step 5: Complete WARP setup -On your device, complete the WARP installation wizard. Then connect WARP to your Zero Trust organization. +On your device, complete the WARP installation wizard. Then connect WARP to your Zero Trust organization. For comprehensive OS-specific instructions, refer to [Manual deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). -1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. +1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. On Windows, select the Cloudflare icon in your system tray. 2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. -3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. +3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. To find or change your team name, go to **Settings** > **Team name** and select **Edit**. 4. Complete the authentication steps. 5. The WARP client should show as **Connected**. 6. Select **Continue** in the dashboard. @@ -90,10 +90,10 @@ Try reaching a resource on your private network (for example, `http://10.0.1.100 ## Recommended next steps -After verifying your connection, the dashboard suggests these next steps: +After verifying your connection, consider securing your private network with policies and access controls: -- **Set up Gateway policies**: Add a DNS policy that targets the domain list for your application, then create a network policy that targets its IP list. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). -- **Create an Access application**: Add your private network as a self-hosted Access application for more granular access and identity control. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). +- **Set up Gateway policies**: By default, all enrolled devices can reach your entire private network. Gateway policies let you inspect traffic and control access based on user identity and device posture. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). +- **Create an Access application**: Restrict access to specific applications or hostnames on your private network with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). - **Explore more with Zero Trust**: Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx index 5b54e0cef9d..fbf9da4bb3f 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -8,7 +8,7 @@ description: Replace your traditional VPN with Cloudflare Zero Trust. Choose a c import { CardGrid, LinkTitleCard } from "~/components"; -Cloudflare Zero Trust replaces traditional VPNs by routing private traffic through Cloudflare's global network. Instead of granting users full network access after login, Zero Trust verifies every request based on identity and context — reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](/learning-paths/replace-vpn/concepts/why-vpn/) +Cloudflare One uses Cloudflare's global network and Zero Trust Network Access (ZTNA) to replace traditional VPNs. After you securely connect your devices and resources to Cloudflare, you can set policies to verify every request based on identity and context, reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](/learning-paths/replace-vpn/concepts/why-vpn/) How you set this up depends on what needs to connect to what. Choose the scenario that matches your use case: @@ -19,9 +19,8 @@ How you set this up depends on what needs to connect to what. Choose the scenari href="/cloudflare-one/setup/replace-vpn/device-to-network/" icon="laptop" > - Connect remote users running the WARP client to private networks and - applications behind a Cloudflare Tunnel. This is the most common VPN - replacement scenario. + Connect remote users to internal applications and services through a secure + connection. Best for remote access to private networks. From 8ef961846247d6a920d66db11332eb56def02d99 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 4 Mar 2026 17:03:04 -0600 Subject: [PATCH 13/16] [Cloudflare One] Fix Step 3 to match dashboard deploy tunnel UI - Add architecture selection (dashboard has OS + architecture dropdowns) - Remove incorrect winget/package manager claims for Windows/Linux - Accurately describe dashboard behavior: download link + install command - Keep Windows Command Prompt and terminal window text matching dashboard verbatim - Link to Downloads page for comprehensive reference --- .../setup/replace-vpn/device-to-network.mdx | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index 75479fb53ca..984fa187a46 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -46,16 +46,18 @@ If you are not sure of your IP range, check your router or network settings. Com Install the `cloudflared` connector on a device in your private network and run the tunnel. This software creates the secure connection between your network and Cloudflare. -1. Select your device's operating system. -2. Copy the install command displayed in the dashboard. For macOS, the command looks similar to: +1. Select your device's operating system and architecture. +2. Copy the install command and run it on your device. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. + + For macOS, the command looks similar to: ```sh brew install cloudflared && sudo cloudflared service install ``` - For Windows, open Command Prompt as an administrator. For Linux and macOS, use a terminal window. + For Windows and Linux, the dashboard provides a download link and install command for your selected architecture. For more download options, refer to [Downloads](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/). -3. Run the command on your device. After `cloudflared` connects, the dashboard confirms the tunnel is active. +3. After `cloudflared` connects, the dashboard confirms the tunnel is active. 4. Select **Continue**. ## Step 4: Enroll your devices From e7559d3aa3abcac23204c7a74eaaac385200e4a9 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 4 Mar 2026 17:41:54 -0600 Subject: [PATCH 14/16] [Cloudflare One] Polish device-to-network wording and formatting - Use 'service' instead of 'software' for cloudflared description - Move team name Settings path to note callout under Step 5 - Reorder Step 6 sentence for clarity --- .../setup/replace-vpn/device-to-network.mdx | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index 984fa187a46..0f80a21cc3e 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -44,7 +44,7 @@ If you are not sure of your IP range, check your router or network settings. Com ## Step 3: Deploy your Tunnel -Install the `cloudflared` connector on a device in your private network and run the tunnel. This software creates the secure connection between your network and Cloudflare. +Install the `cloudflared` connector on a device in your private network and run the tunnel. This service creates the secure connection between your network and Cloudflare. 1. Select your device's operating system and architecture. 2. Copy the install command and run it on your device. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. @@ -79,7 +79,12 @@ On your device, complete the WARP installation wizard. Then connect WARP to your 1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. On Windows, select the Cloudflare icon in your system tray. 2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. -3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. To find or change your team name, go to **Settings** > **Team name** and select **Edit**. +3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. + + :::note + To find or change your team name, go to **Settings** > **Team name** and select **Edit**. + ::: + 4. Complete the authentication steps. 5. The WARP client should show as **Connected**. 6. Select **Continue** in the dashboard. @@ -88,7 +93,7 @@ On your device, complete the WARP installation wizard. Then connect WARP to your The dashboard confirms that you are securely connected. You now have remote access between your device and your private network resources. -Try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`) to verify connectivity. +To verify connectivity, try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`). ## Recommended next steps From 39f8bd104280e82134bcd86b5d1b15a795354d55 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Thu, 5 Mar 2026 17:57:06 -0600 Subject: [PATCH 15/16] [Cloudflare One] Add glossary tooltips, account prereq, and parent cross-link to device-to-network - Add GlossaryTooltip for Cloudflare Tunnel and WARP client on first mention - Change 'device agent' to 'app' for plain language consistency - Break 4-sentence How it works paragraph into two 2-sentence paragraphs - Add Cloudflare account prerequisite with link to parent setup page - Add parent cross-link for other connection scenarios (scales to future flows) - Replace 'device posture' with 'network attributes' in Gateway policies description - Remove inaccurate 'multi-site deployments' from learning path references --- .../setup/replace-vpn/device-to-network.mdx | 22 +++++++++++++++---- .../setup/replace-vpn/index.mdx | 2 +- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index 0f80a21cc3e..7f99d6c3d90 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -9,14 +9,28 @@ products: - cloudflare-one --- -Connect a remote device to a private network so your users can securely access internal applications and services from anywhere, without the security risks and performance bottlenecks of a traditional VPN. This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). +import { GlossaryTooltip } from "~/components"; + +Connect a remote device to a private network so your users can securely access internal applications and services from anywhere, without the security risks and performance bottlenecks of a traditional VPN. + +To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). + +This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). ## How it works -[Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) is a network connector that creates an outbound-only connection between your private network and Cloudflare. No open inbound ports or firewall changes are required. The [WARP client](/cloudflare-one/team-and-resources/devices/warp/) is a device agent that you install on each user's device. It routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. + + [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) + +is a network connector that creates an outbound-only connection between your +private network and Cloudflare. No open inbound ports or firewall changes are +required. + +The [WARP client](/cloudflare-one/team-and-resources/devices/warp/) is an app that you install on each user's device. It routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. ## Prerequisites +- A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](/cloudflare-one/setup/). - A Linux, Windows, or macOS device on your private network to run the tunnel. - A Linux, Windows, or macOS device to install the WARP client on. @@ -99,11 +113,11 @@ To verify connectivity, try reaching a resource on your private network (for exa After verifying your connection, consider securing your private network with policies and access controls: -- **Set up Gateway policies**: By default, all enrolled devices can reach your entire private network. Gateway policies let you inspect traffic and control access based on user identity and device posture. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). +- **Set up Gateway policies**: By default, all enrolled devices can reach your entire private network. Gateway policies let you inspect traffic and control access based on user identity and network attributes. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). - **Create an Access application**: Restrict access to specific applications or hostnames on your private network with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). - **Explore more with Zero Trust**: Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). -For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). +For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). ## Troubleshoot diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx index fbf9da4bb3f..a91344ec4f5 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -27,5 +27,5 @@ How you set this up depends on what needs to connect to what. Choose the scenari :::note -For in-depth guidance on policy design, device posture checks, and multi-site deployments, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). +For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). ::: From d94ba955ced1cff65c1249dbb62d3d7732b0dfaf Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Thu, 5 Mar 2026 18:06:18 -0600 Subject: [PATCH 16/16] [Cloudflare One] Remove Cloudflare Tunnel GlossaryTooltip that broke page formatting --- .../cloudflare-one/setup/replace-vpn/device-to-network.mdx | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx index 7f99d6c3d90..0e2b2f6cf95 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -19,12 +19,7 @@ This guide follows the same steps as the **Get Started** onboarding wizard in th ## How it works - - [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) - -is a network connector that creates an outbound-only connection between your -private network and Cloudflare. No open inbound ports or firewall changes are -required. +[Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) is a network connector that creates an outbound-only connection between your private network and Cloudflare. No open inbound ports or firewall changes are required. The [WARP client](/cloudflare-one/team-and-resources/devices/warp/) is an app that you install on each user's device. It routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere.