[Cloudflare One] Get Started: Replace VPN — Device to Network quick-start (PCX-20915) #28716
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -40,3 +40,4 @@ CLAUDE.md | |
| .cursor/ | ||
| .github/prompts/ | ||
| .github/agents/ | ||
| agents/ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| --- | ||
| pcx_content_type: navigation | ||
| title: Replace your VPN | ||
| external_link: /cloudflare-one/setup/replace-vpn/ | ||
| sidebar: | ||
| order: 2 | ||
| --- |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| --- | ||
| pcx_content_type: get-started | ||
| title: Get started | ||
| sidebar: | ||
| order: 2 | ||
| description: Set up Cloudflare Zero Trust for your organization. Choose a use case to get started with a guided quick-start. | ||
| --- | ||
|
|
||
| import { CardGrid, LinkTitleCard, Render } from "~/components"; | ||
|
|
||
| Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| Before you begin any use case, you need a Cloudflare account and a Zero Trust organization. | ||
|
|
||
| ### 1. Create a Cloudflare account | ||
|
|
||
| Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up) and enable two-factor authentication. | ||
|
|
||
| ### 2. Create a Zero Trust organization | ||
|
|
||
| <Render file="choose-team-name" product="cloudflare-one" /> | ||
|
|
||
| ## What would you like to do? | ||
|
|
||
| These use cases match the guided onboarding in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). To follow along in the dashboard, select **Get Started**. | ||
|
|
||
| <CardGrid> | ||
|
|
||
| <LinkTitleCard | ||
| title="Replace your VPN" | ||
| href="/cloudflare-one/setup/replace-vpn/" | ||
| icon="seti:db" | ||
| > | ||
| Give remote users, offices, and devices secure access to private networks and | ||
| applications without a traditional VPN. | ||
| </LinkTitleCard> | ||
|
|
||
| <LinkTitleCard | ||
| title="Secure private apps without a client" | ||
| href="/learning-paths/clientless-access/concepts/" | ||
| icon="laptop" | ||
| > | ||
| Provide browser-based access to internal web applications, SSH servers, and | ||
| RDP sessions without installing software on user devices. | ||
| </LinkTitleCard> | ||
|
|
||
| <LinkTitleCard | ||
| title="Filter DNS to block threats" | ||
| href="/cloudflare-one/traffic-policies/initial-setup/dns/" | ||
| icon="magnifier" | ||
| > | ||
| Set up DNS filtering to block malware, phishing, and unwanted content across | ||
| your network in minutes. | ||
| </LinkTitleCard> | ||
|
|
||
| <LinkTitleCard | ||
| title="Secure web traffic from threats" | ||
| href="/learning-paths/secure-internet-traffic/concepts/" | ||
| icon="seti:lock" | ||
| > | ||
| Inspect and filter all Internet-bound traffic from your users to block | ||
| threats, enforce acceptable use policies, and prevent data loss. | ||
| </LinkTitleCard> | ||
|
|
||
| </CardGrid> | ||
|
|
||
| :::note | ||
|
|
||
| For in-depth deployment guides that cover policy design and advanced configuration, refer to [Implementation guides](/cloudflare-one/implementation-guides/). | ||
| ::: | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,122 @@ | ||||||
| --- | ||||||
| pcx_content_type: get-started | ||||||
| title: "Device to network" | ||||||
| sidebar: | ||||||
| order: 1 | ||||||
| label: Device to network | ||||||
| description: Connect a remote device to a private network using Cloudflare Tunnel and the WARP client. | ||||||
| products: | ||||||
| - cloudflare-one | ||||||
| --- | ||||||
|
|
||||||
| import { GlossaryTooltip } from "~/components"; | ||||||
|
|
||||||
| Connect a remote device to a private network so your users can securely access internal applications and services from anywhere, without the security risks and performance bottlenecks of a traditional VPN. | ||||||
|
|
||||||
| To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). | ||||||
|
|
||||||
| This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). | ||||||
|
|
||||||
| ## How it works | ||||||
|
|
||||||
| [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) is a network connector that creates an outbound-only connection between your private network and Cloudflare. No open inbound ports or firewall changes are required. | ||||||
|
|
||||||
| The <GlossaryTooltip term="WARP client">[WARP client](/cloudflare-one/team-and-resources/devices/warp/)</GlossaryTooltip> is an app that you install on each user's device. It routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. | ||||||
|
|
||||||
| ## Prerequisites | ||||||
|
|
||||||
| - A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](/cloudflare-one/setup/). | ||||||
| - A Linux, Windows, or macOS device on your private network to run the tunnel. | ||||||
| - A Linux, Windows, or macOS device to install the WARP client on. | ||||||
|
|
||||||
| ## Step 1: Assign a Tunnel | ||||||
|
|
||||||
| Cloudflare Tunnel establishes an outbound connection between your resources and Cloudflare. This is how new devices can reach your private network. You can install Tunnel on any Windows, Mac, or Linux device currently in your private network. | ||||||
|
|
||||||
| 1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. | ||||||
| 2. For **Replace my client-based or site-to-site VPN**, select **Get started**. | ||||||
| 3. For **Device to network**, select **Continue**. | ||||||
| 4. On the **Connect a remote device to a private network** screen, select **Continue**. | ||||||
| 5. On the **Assign a Tunnel** screen, use the dropdown to choose an existing tunnel or create a new one. | ||||||
| 6. Select **Continue**. | ||||||
|
|
||||||
| ## Step 2: Set your Tunnel's IP range | ||||||
|
|
||||||
| Add the IP range of your private network to the tunnel. This defines which internal resources your remote users can reach. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. | ||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
Contributor
There was a problem hiding this comment. If you're still referring to the app Cloudflare Tunnel. If you're talking about the tunnel the app creates, ignore me
Contributor
Author
There was a problem hiding this comment. Applied — capitalized Tunnel as a product name reference. Included in the device-to-device PR since this one is already merged. |
||||||
|
|
||||||
| 1. Enter your IP range (for example, `10.0.1.0/24`). | ||||||
| 2. Select **Continue**. | ||||||
|
|
||||||
| :::note | ||||||
| If you are not sure of your IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. | ||||||
| ::: | ||||||
|
|
||||||
| ## Step 3: Deploy your Tunnel | ||||||
|
|
||||||
| Install the `cloudflared` connector on a device in your private network and run the tunnel. This service creates the secure connection between your network and Cloudflare. | ||||||
|
Contributor
There was a problem hiding this comment. same question here
Contributor
Author
There was a problem hiding this comment. Good question — here 'run the tunnel' refers to the action of running the tunnel instance (starting the cloudflared service), not to the Cloudflare Tunnel product. Keeping lowercase to distinguish the action from the product name. |
||||||
|
|
||||||
| 1. Select your device's operating system and architecture. | ||||||
| 2. Copy the install command and run it on your device. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. | ||||||
|
|
||||||
| For macOS, the command looks similar to: | ||||||
|
|
||||||
| ```sh | ||||||
| brew install cloudflared && sudo cloudflared service install <YOUR_TUNNEL_TOKEN> | ||||||
| ``` | ||||||
|
|
||||||
| For Windows and Linux, the dashboard provides a download link and install command for your selected architecture. For more download options, refer to [Downloads](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/). | ||||||
|
|
||||||
| 3. After `cloudflared` connects, the dashboard confirms the tunnel is active. | ||||||
| 4. Select **Continue**. | ||||||
|
|
||||||
| ## Step 4: Enroll your devices | ||||||
|
|
||||||
| Device enrollment controls which users can connect their devices to your private network through Cloudflare. In this step, you register your first device by providing an email address and installing the WARP client. | ||||||
|
|
||||||
| 1. Enter the email you want to use to enroll your first device. | ||||||
| 2. Select your device's operating system. | ||||||
| 3. Select **Download to continue** to download the WARP client, or copy the download link to send to a different device. | ||||||
| 4. Select **Continue**. | ||||||
|
|
||||||
| :::note | ||||||
| You can manage device enrollment permissions later in **Team & Resources** > **Devices**. | ||||||
| ::: | ||||||
|
|
||||||
| ## Step 5: Complete WARP setup | ||||||
|
|
||||||
| On your device, complete the WARP installation wizard. Then connect WARP to your Zero Trust organization. For comprehensive OS-specific instructions, refer to [Manual deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). | ||||||
|
|
||||||
| 1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. On Windows, select the Cloudflare icon in your system tray. | ||||||
| 2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. | ||||||
| 3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. | ||||||
|
|
||||||
| :::note | ||||||
| To find or change your team name, go to **Settings** > **Team name** and select **Edit**. | ||||||
| ::: | ||||||
|
|
||||||
| 4. Complete the authentication steps. | ||||||
| 5. The WARP client should show as **Connected**. | ||||||
| 6. Select **Continue** in the dashboard. | ||||||
|
|
||||||
| ## Step 6: Verify your connection | ||||||
|
|
||||||
| The dashboard confirms that you are securely connected. You now have remote access between your device and your private network resources. | ||||||
|
|
||||||
| To verify connectivity, try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`). | ||||||
|
|
||||||
| ## Recommended next steps | ||||||
|
|
||||||
| After verifying your connection, consider securing your private network with policies and access controls: | ||||||
|
|
||||||
| - **Set up Gateway policies**: By default, all enrolled devices can reach your entire private network. Gateway policies let you inspect traffic and control access based on user identity and network attributes. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). | ||||||
| - **Create an Access application**: Restrict access to specific applications or hostnames on your private network with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). | ||||||
| - **Explore more with Zero Trust**: Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). | ||||||
|
|
||||||
| For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). | ||||||
|
|
||||||
| ## Troubleshoot | ||||||
|
|
||||||
| If you have issues connecting, refer to these resources: | ||||||
|
|
||||||
| - [Troubleshoot WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/): resolve WARP client connection and enrollment issues. | ||||||
| - [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,31 @@ | ||||||||||||
| --- | ||||||||||||
| pcx_content_type: navigation | ||||||||||||
| title: Replace your VPN | ||||||||||||
| sidebar: | ||||||||||||
| order: 1 | ||||||||||||
| description: Replace your traditional VPN with Cloudflare Zero Trust. Choose a connection scenario to get started. | ||||||||||||
| --- | ||||||||||||
|
|
||||||||||||
| import { CardGrid, LinkTitleCard } from "~/components"; | ||||||||||||
|
|
||||||||||||
| Cloudflare One uses Cloudflare's global network and Zero Trust Network Access (ZTNA) to replace traditional VPNs. After you securely connect your devices and resources to Cloudflare, you can set policies to verify every request based on identity and context, reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](/learning-paths/replace-vpn/concepts/why-vpn/) | ||||||||||||
|
|
||||||||||||
| How you set this up depends on what needs to connect to what. Choose the scenario that matches your use case: | ||||||||||||
|
|
||||||||||||
| <CardGrid> | ||||||||||||
|
|
||||||||||||
| <LinkTitleCard | ||||||||||||
| title="Device to network" | ||||||||||||
| href="/cloudflare-one/setup/replace-vpn/device-to-network/" | ||||||||||||
| icon="laptop" | ||||||||||||
| > | ||||||||||||
| Connect remote users to internal applications and services through a secure | ||||||||||||
| connection. Best for remote access to private networks. | ||||||||||||
| </LinkTitleCard> | ||||||||||||
|
|
||||||||||||
| </CardGrid> | ||||||||||||
|
|
||||||||||||
| :::note | ||||||||||||
|
|
||||||||||||
| For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). | ||||||||||||
|
Comment on lines
+28
to
+30
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||||||
| ::: | ||||||||||||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.