[Cloudflare One] Add network-to-network get-started page#28876
Conversation
Add get-started page for the Replace VPN network-to-network wizard (PCX-20917). Covers the 6-step WARP Connector site-to-site flow: define segments, deploy connectors, forward traffic, verify. Also adds the network-to-network card to the Replace VPN index page.
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
Replace jargon with plain language for non-technical audience: - bidirectionally -> send and receive traffic in both directions - Add inline definition for IP range on first use - Explain why IP ranges must not overlap - Add consequence statement for skipping Step 5 - Add IPv4 address examples to help identify correct format - Define Split Tunnel Exclude list inline
The SSH drop during install is already covered by the caution box in Step 2. The troubleshoot bullet added Split Tunnel workaround advice that has not been fully validated. The install partial documents this separately for the manual setup flow.
Post-setup hardening concern, not relevant to the quick-start flow. Already documented in the WARP Connector install partial.
Remove first-party firewall bullet — duplicates advice already in the WARP Connector install partial. Matches the device-to-network sibling pattern of linking to reference docs instead of inlining troubleshoot steps.
Database replication and cross-site administration are not relatable for the SMB target audience. Use file server and internal application examples instead.
The dashboard introduces 'network connector' as a concept before
naming WARP Connector. Mirror the device-to-network sibling pattern
('is a network connector that...').
Explain why only one device per network needs the install: that device handles traffic for the entire network. Drop gateway jargon and redundant second paragraph about security policies (already covered in Recommended next steps).
…nition Drop the inline IP range definition (Sam either knows their range or needs to check their router, not read a parenthetical). Drop the common ranges list and IPv4 pattern examples from the note — we have not validated these as appropriate recommendations and the step instructions already show the expected format.
Confirmed the wizard rejects IPv6 input with an error message. The note was redundant with UI validation. Keep the 'check your router' tip since that is genuinely useful for users who do not know their IP range.
Consistent with earlier decision to remove the SSH troubleshoot bullet. The behavior has not been fully validated.
Align with device-to-network pattern: specify what 'destinations' means in this context (services or hosts on connected networks).
'WARP Connector site-to-site' is the sidebar label, not the page title. Use the actual title: 'Connect two or more private networks'.
Match destination page title: 'Tips and best practices' not 'WARP Connector tips'.
|
@alexamavrogianis requesting your review on this doc when you get a chance. |
|
CC @caley-b for viz |
caley-b
left a comment
caley-b
left a comment
There was a problem hiding this comment.
Approving, but I know you want Alexa's review first before merging.
|
|
||
| import { InlineBadge } from "~/components"; | ||
|
|
||
| Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments. For example, employees in one office could access a file server or internal application hosted in another. |
There was a problem hiding this comment.
Another helpful use case to mention is that it allows you to connect devices like printers that can't run external software.
There was a problem hiding this comment.
Good call, added printer to the example.
|
|
||
| ## How it works | ||
|
|
||
| [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) <InlineBadge preset="beta" /> is a network connector that you install on a single Linux device in each network. That device handles traffic for the entire network: it sends outbound traffic to Cloudflare and receives inbound traffic back, then passes it to the right device on the network. Because of this, other devices on the network do not need to install any software. |
There was a problem hiding this comment.
Also worth calling out that routing traffic through Cloudflare allows you to apply security policies.
There was a problem hiding this comment.
I moved this to the "Recommended next steps" section, where it is actionable and uses the product term gateway policies. At the point in "How it works" the user hasn't set up any policies yet, so mentioning them here could set a false expectation that policies are already active. The next steps section introduces this with: "By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks". Went with "gateway policies" over the more general "security policies" to keep the terminology consistent with the linked doc pages.
|
|
||
| ## Step 1: Define a network segment | ||
|
|
||
| A network segment identifies the IP range of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. |
There was a problem hiding this comment.
I would remove or rephrase "the wizard automatically creates a WARP connector..." I think it implies that there's nothing else the user has to do, but they still need to run the script.
There was a problem hiding this comment.
Good catch, rephrased to clarify that the dashboard creates the configuration but you still install and run the connector in the next step.
|
|
||
| If the WARP Connector is installed on your network's router (the device that serves as the default gateway), other devices on the network automatically send traffic through it. No additional configuration is needed, and you can skip this step. | ||
|
|
||
| If the WARP Connector is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the WARP Connector device. Without this route, devices do not know where to send traffic destined for the other network, and the connection does not work. The wizard generates OS-specific commands to add these routes. |
There was a problem hiding this comment.
Maybe rephrase "The wizard generates OS-specific commands..." to "The dashboard will provide OS-specific commands for the devices you want to forward traffic from."
There was a problem hiding this comment.
Updated to "The dashboard provides OS-specific commands for the devices you want to forward traffic from".
|
|
||
| - **Set up Gateway policies**: By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/), [Network policies](/cloudflare-one/traffic-policies/network-policies/), and [HTTP policies](/cloudflare-one/traffic-policies/http-policies/). | ||
| - **Create an Access application**: Restrict access to specific services or hosts on your connected networks with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). | ||
| - **Create a device profile**: Customize WARP Connector settings for your connectors, such as which traffic routes through Cloudflare and which stays local. For more information, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). |
There was a problem hiding this comment.
I wouldn't frame this as customizing WARP Connector settings, more so being able to manage how traffic routes from the WARP connector separately from how traffic routes from user devices.
There was a problem hiding this comment.
Reframed to: "Control which traffic your connectors route through Cloudflare independently from your user devices."
…etwork.mdx Co-authored-by: Caley Burton <caley@cloudflare.com>
…etwork.mdx Co-authored-by: Caley Burton <caley@cloudflare.com>
- Fix empty product bullet in frontmatter from Caley's suggestion - Add printer to intro use cases (Alexa #3) - Rephrase Step 1 to clarify dashboard creates config but user still installs the connector (Alexa #5) - Replace 'wizard generates' with 'dashboard provides' in Step 5 (Alexa #6) - Reframe device profile bullet to focus on independent routing control for connectors vs user devices (Alexa #7)
4 participants
Adds a get-started page for the Replace VPN → Network to network wizard (PCX-20917), the third and final flow in the Replace VPN epic. Also adds the network-to-network card to the Replace VPN index page.
This page mirrors the Cloudflare One dashboard's 6-step onboarding wizard for connecting two private networks using WARP Connectors:
Follows the same structure and editorial conventions as the merged device-to-network page (#28716) and the in-review device-to-device page.
Key editorial decisions:
Note on the index page: This branch was created from
production, so the index page only has device-to-network and network-to-network cards. The device-to-device card is in #28803. Both PRs will merge cleanly since they add cards at different positions in the<CardGrid>.Related: PCX-20917