From e21995c63365a9ab9fc547b48c48fd926246b182 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:02:16 -0500 Subject: [PATCH 01/17] [Cloudflare One] Add network-to-network get-started page Add get-started page for the Replace VPN network-to-network wizard (PCX-20917). Covers the 6-step WARP Connector site-to-site flow: define segments, deploy connectors, forward traffic, verify. Also adds the network-to-network card to the Replace VPN index page. --- .../setup/replace-vpn/index.mdx | 9 ++ .../setup/replace-vpn/network-to-network.mdx | 115 ++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx index a91344ec4f5..36f0cc3ab32 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -23,6 +23,15 @@ How you set this up depends on what needs to connect to what. Choose the scenari connection. Best for remote access to private networks. + + Connect two or more private networks bidirectionally through Cloudflare. Best + for linking offices, data centers, or cloud environments. + + :::note diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx new file mode 100644 index 00000000000..2758486c34e --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -0,0 +1,115 @@ +--- +pcx_content_type: get-started +title: "Network to network" +sidebar: + order: 3 + label: Network to network +description: Connect two private networks using WARP Connectors and Cloudflare's network. +products: + - cloudflare-one +--- + +import { InlineBadge } from "~/components"; + +Connect two separate private networks so devices on each network can communicate bidirectionally through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments so servers and services on one network can reach the other, for example for database replication or cross-site administration. + +To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). + +This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). + +## How it works + +[WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) is a lightweight service that you install on a Linux device in each network. It acts as a gateway for the network, sending traffic to Cloudflare and receiving traffic back on behalf of all devices in the network. Other devices on the network do not need to install any software. + +With a WARP Connector deployed in each network, devices on either side can reach devices on the other. Cloudflare applies your security policies before forwarding traffic to the destination network. + +## Prerequisites + +- A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](/cloudflare-one/setup/). +- A Linux device or virtual machine on your first private network. This is where you install your first WARP Connector. +- A second Linux device or virtual machine on a separate private network. This is where you install your second WARP Connector. + +:::note +WARP Connector is currently Linux-only. For more details on requirements and limitations, refer to [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/). +::: + +## Step 1: Define a network segment + +A network segment identifies the IP range of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. + +1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. +2. For **Replace my client-based or site-to-site VPN**, select **Get started**. +3. For **Network to network**, select **Continue**. +4. On the **Route traffic between private networks** screen, select **Continue**. +5. Enter the IP range of your first network segment (for example, `10.0.0.0/24`). +6. Enter a name for this network segment (for example, `office-a`). +7. Select **Continue**. + +:::note +Enter an IPv4 range. WARP Connector does not currently support IPv6 routes. If you are not sure of your network's IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. +::: + +## Step 2: Deploy first connector + +Install the WARP Connector on a Linux device in your first network segment. The dashboard generates commands specific to your operating system. + +1. Select your device's operating system from the dropdown. +2. Copy and run the commands shown in the dashboard on your Linux device. The dashboard provides three sets of commands: + 1. **Install WARP**: Sets up the package repository and installs the `cloudflare-warp` package. + 2. **Enable IP forwarding**: Allows the device to forward traffic between networks. + 3. **Run the WARP Connector with token**: Registers the connector with your Cloudflare account and connects it. + + :::caution + Running the connector token command causes remote connections to the device to drop. If you are managing the device over SSH, your session may disconnect. You can reconnect after the command completes. + ::: + +3. After the connector deploys, the dashboard confirms your network segment is active. +4. Select **Continue**. + +## Step 3: Define a second segment + +Repeat the same process as [Step 1](#step-1-define-a-network-segment) for your second network. The IP range must be different and non-overlapping (for example, `10.0.1.0/24` if your first segment is `10.0.0.0/24`). + +## Step 4: Deploy second connector + +Repeat the same process as [Step 2](#step-2-deploy-first-connector) on a Linux device in your second network segment. After the connector deploys, the dashboard confirms both segments are active. + +## Step 5: Forward device traffic + +If the WARP Connector is installed on your network's router (the device that serves as the default gateway), other devices on the network automatically send traffic through it. No additional configuration is needed, and you can skip this step. + +If the WARP Connector is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the WARP Connector device. The wizard generates OS-specific commands to add these routes. + +1. Select the operating system of the device you want to configure. +2. Select the tunnel you want to route traffic through. +3. Copy and run the generated command on the target device. +4. Repeat for additional devices as needed, or select **Continue** to proceed to the final step. + +For more details on routing options, refer to [WARP Connector site-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/#4-route-traffic-from-subnet-to-warp-connector). + +## Step 6: Verify your connection + +The dashboard confirms that your connectors can reach devices in the opposite network segment. Devices on both networks can now communicate through Cloudflare. + +To verify connectivity, try reaching a device on the opposite network (for example, `ping 10.0.1.100` from a device on your first network). + +## Recommended next steps + +After verifying your connection, consider securing your connected networks with policies and access controls: + +- **Set up Gateway policies**: By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/), [Network policies](/cloudflare-one/traffic-policies/network-policies/), and [HTTP policies](/cloudflare-one/traffic-policies/http-policies/). +- **Create an Access application**: Restrict access to specific destinations with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). +- **Create a device profile**: Customize WARP Connector settings for your connectors, such as which traffic routes through Cloudflare and which stays local. For more information, refer to [WARP Connector site-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). +- **Explore more with Zero Trust**: Review your connectors, policies, and routes in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). + +For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). + +## Troubleshoot + +If you have issues connecting, try these steps: + +- **WARP Connector not connecting**: Verify that your firewall allows inbound and outbound traffic over the [WARP ports and IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). Run `warp-cli status` on the connector device to check its connection state. +- **IP forwarding not persisting after reboot**: The wizard enables IP forwarding with `sysctl`, but the setting may not persist. To make it permanent, add `net.ipv4.ip_forward = 1` to `/etc/sysctl.d/99-warp-svc.conf` and run `sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf`. +- **SSH drops during connector install**: The WARP Connector immediately routes traffic through Cloudflare when activated, which can disrupt existing SSH sessions. Reconnect after the command completes, or add your local IP to the [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude list before deploying. +- [WARP Connector tips](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common configuration tips and troubleshooting strategies. +- [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From cabc7c32139a06d42261c457ec69a0fbac3b4602 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:06:37 -0500 Subject: [PATCH 02/17] [Cloudflare One] ELI5 clarity pass on network-to-network Replace jargon with plain language for non-technical audience: - bidirectionally -> send and receive traffic in both directions - Add inline definition for IP range on first use - Explain why IP ranges must not overlap - Add consequence statement for skipping Step 5 - Add IPv4 address examples to help identify correct format - Define Split Tunnel Exclude list inline --- .../setup/replace-vpn/network-to-network.mdx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 2758486c34e..07a32d68b36 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -11,7 +11,7 @@ products: import { InlineBadge } from "~/components"; -Connect two separate private networks so devices on each network can communicate bidirectionally through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments so servers and services on one network can reach the other, for example for database replication or cross-site administration. +Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments so servers and services on one network can reach the other, for example for database replication or cross-site administration. To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). @@ -35,7 +35,7 @@ WARP Connector is currently Linux-only. For more details on requirements and lim ## Step 1: Define a network segment -A network segment identifies the IP range of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. +A network segment identifies the IP range (the block of IP addresses assigned to your network) of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. 1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Replace my client-based or site-to-site VPN**, select **Get started**. @@ -46,7 +46,7 @@ A network segment identifies the IP range of a private network you want to conne 7. Select **Continue**. :::note -Enter an IPv4 range. WARP Connector does not currently support IPv6 routes. If you are not sure of your network's IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. +Enter an IPv4 range (for example, addresses starting with `10.x.x.x`, `172.16.x.x`, or `192.168.x.x`). WARP Connector does not currently support IPv6 routes. If you are not sure of your network's IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. ::: ## Step 2: Deploy first connector @@ -68,7 +68,7 @@ Install the WARP Connector on a Linux device in your first network segment. The ## Step 3: Define a second segment -Repeat the same process as [Step 1](#step-1-define-a-network-segment) for your second network. The IP range must be different and non-overlapping (for example, `10.0.1.0/24` if your first segment is `10.0.0.0/24`). +Repeat the same process as [Step 1](#step-1-define-a-network-segment) for your second network. The IP range must not overlap with your first segment, because each network needs its own unique range so Cloudflare can route traffic to the correct destination (for example, `10.0.1.0/24` if your first segment is `10.0.0.0/24`). ## Step 4: Deploy second connector @@ -78,7 +78,7 @@ Repeat the same process as [Step 2](#step-2-deploy-first-connector) on a Linux d If the WARP Connector is installed on your network's router (the device that serves as the default gateway), other devices on the network automatically send traffic through it. No additional configuration is needed, and you can skip this step. -If the WARP Connector is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the WARP Connector device. The wizard generates OS-specific commands to add these routes. +If the WARP Connector is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the WARP Connector device. Without this route, devices do not know where to send traffic destined for the other network, and the connection does not work. The wizard generates OS-specific commands to add these routes. 1. Select the operating system of the device you want to configure. 2. Select the tunnel you want to route traffic through. @@ -110,6 +110,6 @@ If you have issues connecting, try these steps: - **WARP Connector not connecting**: Verify that your firewall allows inbound and outbound traffic over the [WARP ports and IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). Run `warp-cli status` on the connector device to check its connection state. - **IP forwarding not persisting after reboot**: The wizard enables IP forwarding with `sysctl`, but the setting may not persist. To make it permanent, add `net.ipv4.ip_forward = 1` to `/etc/sysctl.d/99-warp-svc.conf` and run `sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf`. -- **SSH drops during connector install**: The WARP Connector immediately routes traffic through Cloudflare when activated, which can disrupt existing SSH sessions. Reconnect after the command completes, or add your local IP to the [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude list before deploying. +- **SSH drops during connector install**: The WARP Connector immediately routes traffic through Cloudflare when activated, which can disrupt existing SSH sessions. Reconnect after the command completes, or add your local IP to the [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude list (a setting that keeps specific traffic from being routed through Cloudflare) before deploying. - [WARP Connector tips](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common configuration tips and troubleshooting strategies. - [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From 56ff77d4af82b3a526c565c504d628ee6de659bc Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:10:11 -0500 Subject: [PATCH 03/17] [Cloudflare One] Remove unvalidated SSH troubleshoot bullet The SSH drop during install is already covered by the caution box in Step 2. The troubleshoot bullet added Split Tunnel workaround advice that has not been fully validated. The install partial documents this separately for the manual setup flow. --- .../docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 07a32d68b36..f356986c5db 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -110,6 +110,5 @@ If you have issues connecting, try these steps: - **WARP Connector not connecting**: Verify that your firewall allows inbound and outbound traffic over the [WARP ports and IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). Run `warp-cli status` on the connector device to check its connection state. - **IP forwarding not persisting after reboot**: The wizard enables IP forwarding with `sysctl`, but the setting may not persist. To make it permanent, add `net.ipv4.ip_forward = 1` to `/etc/sysctl.d/99-warp-svc.conf` and run `sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf`. -- **SSH drops during connector install**: The WARP Connector immediately routes traffic through Cloudflare when activated, which can disrupt existing SSH sessions. Reconnect after the command completes, or add your local IP to the [Split Tunnel](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) Exclude list (a setting that keeps specific traffic from being routed through Cloudflare) before deploying. - [WARP Connector tips](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common configuration tips and troubleshooting strategies. - [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From ebae7228482bfefb08541d762c12f2d8fbbaf0b1 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:12:22 -0500 Subject: [PATCH 04/17] [Cloudflare One] Remove IP forwarding persistence troubleshoot bullet Post-setup hardening concern, not relevant to the quick-start flow. Already documented in the WARP Connector install partial. --- .../docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index f356986c5db..48505d88766 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -109,6 +109,5 @@ For in-depth guidance on policy design and device posture checks, refer to the [ If you have issues connecting, try these steps: - **WARP Connector not connecting**: Verify that your firewall allows inbound and outbound traffic over the [WARP ports and IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). Run `warp-cli status` on the connector device to check its connection state. -- **IP forwarding not persisting after reboot**: The wizard enables IP forwarding with `sysctl`, but the setting may not persist. To make it permanent, add `net.ipv4.ip_forward = 1` to `/etc/sysctl.d/99-warp-svc.conf` and run `sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf`. - [WARP Connector tips](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common configuration tips and troubleshooting strategies. - [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From 341867ed4a4b8aa52d4b1e875533ebdf7431ca2c Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:15:50 -0500 Subject: [PATCH 05/17] [Cloudflare One] Simplify troubleshoot section to reference links only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove first-party firewall bullet — duplicates advice already in the WARP Connector install partial. Matches the device-to-network sibling pattern of linking to reference docs instead of inlining troubleshoot steps. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 48505d88766..b482077dbc1 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -106,8 +106,7 @@ For in-depth guidance on policy design and device posture checks, refer to the [ ## Troubleshoot -If you have issues connecting, try these steps: +If you have issues connecting, refer to these resources: -- **WARP Connector not connecting**: Verify that your firewall allows inbound and outbound traffic over the [WARP ports and IPs](/cloudflare-one/team-and-resources/devices/warp/deployment/firewall/). Run `warp-cli status` on the connector device to check its connection state. - [WARP Connector tips](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common configuration tips and troubleshooting strategies. - [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From bbd67d13d093fe83d1235936edddd6f5d7edf39d Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:18:50 -0500 Subject: [PATCH 06/17] [Cloudflare One] Replace technical examples with relatable use case Database replication and cross-site administration are not relatable for the SMB target audience. Use file server and internal application examples instead. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index b482077dbc1..e2df200c259 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -11,7 +11,7 @@ products: import { InlineBadge } from "~/components"; -Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments so servers and services on one network can reach the other, for example for database replication or cross-site administration. +Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments. For example, employees in one office could access a file server or internal application hosted in another. To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). From 3169e89c990e4be9afdd3396937e0854a1197765 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:22:06 -0500 Subject: [PATCH 07/17] [Cloudflare One] Align WARP Connector intro with dashboard terminology The dashboard introduces 'network connector' as a concept before naming WARP Connector. Mirror the device-to-network sibling pattern ('is a network connector that...'). --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index e2df200c259..6977e46cd09 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -19,7 +19,7 @@ This guide follows the same steps as the **Get Started** onboarding wizard in th ## How it works -[WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) is a lightweight service that you install on a Linux device in each network. It acts as a gateway for the network, sending traffic to Cloudflare and receiving traffic back on behalf of all devices in the network. Other devices on the network do not need to install any software. +[WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) is a network connector that you install on a Linux device in each network. It acts as a gateway for the network, sending traffic to Cloudflare and receiving traffic back on behalf of all devices in the network. Other devices on the network do not need to install any software. With a WARP Connector deployed in each network, devices on either side can reach devices on the other. Cloudflare applies your security policies before forwarding traffic to the destination network. From 01e2a620688931aa3e3b40c6b3ce2de3dd8e8c96 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:27:42 -0500 Subject: [PATCH 08/17] [Cloudflare One] Clarify WARP Connector role in How it works Explain why only one device per network needs the install: that device handles traffic for the entire network. Drop gateway jargon and redundant second paragraph about security policies (already covered in Recommended next steps). --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 6977e46cd09..c3ec4d2abc8 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -19,9 +19,7 @@ This guide follows the same steps as the **Get Started** onboarding wizard in th ## How it works -[WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) is a network connector that you install on a Linux device in each network. It acts as a gateway for the network, sending traffic to Cloudflare and receiving traffic back on behalf of all devices in the network. Other devices on the network do not need to install any software. - -With a WARP Connector deployed in each network, devices on either side can reach devices on the other. Cloudflare applies your security policies before forwarding traffic to the destination network. +[WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) is a network connector that you install on a single Linux device in each network. That device handles traffic for the entire network: it sends outbound traffic to Cloudflare and receives inbound traffic back, then passes it to the right device on the network. Because of this, other devices on the network do not need to install any software. ## Prerequisites From 5cd1826e8cc99ee0594ac87da56812e49c023881 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:36:32 -0500 Subject: [PATCH 09/17] [Cloudflare One] Remove unvalidated IP range examples and inline definition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop the inline IP range definition (Sam either knows their range or needs to check their router, not read a parenthetical). Drop the common ranges list and IPv4 pattern examples from the note — we have not validated these as appropriate recommendations and the step instructions already show the expected format. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index c3ec4d2abc8..74b700ff757 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -33,7 +33,7 @@ WARP Connector is currently Linux-only. For more details on requirements and lim ## Step 1: Define a network segment -A network segment identifies the IP range (the block of IP addresses assigned to your network) of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. +A network segment identifies the IP range of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. 1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Replace my client-based or site-to-site VPN**, select **Get started**. @@ -44,7 +44,7 @@ A network segment identifies the IP range (the block of IP addresses assigned to 7. Select **Continue**. :::note -Enter an IPv4 range (for example, addresses starting with `10.x.x.x`, `172.16.x.x`, or `192.168.x.x`). WARP Connector does not currently support IPv6 routes. If you are not sure of your network's IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. +WARP Connector does not currently support IPv6 routes. Enter an IPv4 range. If you are not sure of your network's IP range, check your router or network settings. ::: ## Step 2: Deploy first connector From 3f88b4b1c865a3b68b0ba1526b67afe717c47805 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:40:16 -0500 Subject: [PATCH 10/17] =?UTF-8?q?[Cloudflare=20One]=20Drop=20IPv6=20note?= =?UTF-8?q?=20=E2=80=94=20UI=20already=20validates=20for=20IPv4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Confirmed the wizard rejects IPv6 input with an error message. The note was redundant with UI validation. Keep the 'check your router' tip since that is genuinely useful for users who do not know their IP range. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 74b700ff757..0c5228fbe5c 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -44,7 +44,7 @@ A network segment identifies the IP range of a private network you want to conne 7. Select **Continue**. :::note -WARP Connector does not currently support IPv6 routes. Enter an IPv4 range. If you are not sure of your network's IP range, check your router or network settings. +If you are not sure of your network's IP range, check your router or network settings. ::: ## Step 2: Deploy first connector From 54dd4f1ba8488f99c73e7cfd3d84e5538e0cec52 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:47:12 -0500 Subject: [PATCH 11/17] [Cloudflare One] Remove unvalidated SSH caution from Step 2 Consistent with earlier decision to remove the SSH troubleshoot bullet. The behavior has not been fully validated. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 0c5228fbe5c..658e882109a 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -57,10 +57,6 @@ Install the WARP Connector on a Linux device in your first network segment. The 2. **Enable IP forwarding**: Allows the device to forward traffic between networks. 3. **Run the WARP Connector with token**: Registers the connector with your Cloudflare account and connects it. - :::caution - Running the connector token command causes remote connections to the device to drop. If you are managing the device over SSH, your session may disconnect. You can reconnect after the command completes. - ::: - 3. After the connector deploys, the dashboard confirms your network segment is active. 4. Select **Continue**. From 92ab635fdbc56c310497d8be861a3ecbc056f2db Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 16:55:53 -0500 Subject: [PATCH 12/17] [Cloudflare One] Make Access application description more concrete Align with device-to-network pattern: specify what 'destinations' means in this context (services or hosts on connected networks). --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 658e882109a..1db90ac8f60 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -62,11 +62,11 @@ Install the WARP Connector on a Linux device in your first network segment. The ## Step 3: Define a second segment -Repeat the same process as [Step 1](#step-1-define-a-network-segment) for your second network. The IP range must not overlap with your first segment, because each network needs its own unique range so Cloudflare can route traffic to the correct destination (for example, `10.0.1.0/24` if your first segment is `10.0.0.0/24`). +Repeat the same process as [Step 1](#step-1-define-a-network-segment) for your second network. The IP range must not overlap with your first segment. Each network needs its own unique range so Cloudflare can route traffic to the correct destination (for example, `10.0.1.0/24` if your first segment is `10.0.0.0/24`). ## Step 4: Deploy second connector -Repeat the same process as [Step 2](#step-2-deploy-first-connector) on a Linux device in your second network segment. After the connector deploys, the dashboard confirms both segments are active. +Repeat the same process as [Step 2](#step-2-deploy-first-connector) on a Linux device in your second network segment. After the connector deploys, the dashboard confirms your network segment is active. ## Step 5: Forward device traffic @@ -92,7 +92,7 @@ To verify connectivity, try reaching a device on the opposite network (for examp After verifying your connection, consider securing your connected networks with policies and access controls: - **Set up Gateway policies**: By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/), [Network policies](/cloudflare-one/traffic-policies/network-policies/), and [HTTP policies](/cloudflare-one/traffic-policies/http-policies/). -- **Create an Access application**: Restrict access to specific destinations with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). +- **Create an Access application**: Restrict access to specific services or hosts on your connected networks with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). - **Create a device profile**: Customize WARP Connector settings for your connectors, such as which traffic routes through Cloudflare and which stays local. For more information, refer to [WARP Connector site-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). - **Explore more with Zero Trust**: Review your connectors, policies, and routes in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). From d38f7a0106c6a808fffc1d8fe037f5f0f44a8aae Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 17:02:13 -0500 Subject: [PATCH 13/17] [Cloudflare One] Fix anchor text to match destination page title 'WARP Connector site-to-site' is the sidebar label, not the page title. Use the actual title: 'Connect two or more private networks'. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 1db90ac8f60..89073729bd1 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -79,7 +79,7 @@ If the WARP Connector is installed on a different device, other devices on the n 3. Copy and run the generated command on the target device. 4. Repeat for additional devices as needed, or select **Continue** to proceed to the final step. -For more details on routing options, refer to [WARP Connector site-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/#4-route-traffic-from-subnet-to-warp-connector). +For more details on routing options, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/#4-route-traffic-from-subnet-to-warp-connector). ## Step 6: Verify your connection @@ -93,7 +93,7 @@ After verifying your connection, consider securing your connected networks with - **Set up Gateway policies**: By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/), [Network policies](/cloudflare-one/traffic-policies/network-policies/), and [HTTP policies](/cloudflare-one/traffic-policies/http-policies/). - **Create an Access application**: Restrict access to specific services or hosts on your connected networks with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). -- **Create a device profile**: Customize WARP Connector settings for your connectors, such as which traffic routes through Cloudflare and which stays local. For more information, refer to [WARP Connector site-to-site](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). +- **Create a device profile**: Customize WARP Connector settings for your connectors, such as which traffic routes through Cloudflare and which stays local. For more information, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). - **Explore more with Zero Trust**: Review your connectors, policies, and routes in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). From 9930b97ae32fed74f6dad839f51283ecc36a8497 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Mon, 9 Mar 2026 17:03:01 -0500 Subject: [PATCH 14/17] [Cloudflare One] Fix anchor text for WARP Connector tips link Match destination page title: 'Tips and best practices' not 'WARP Connector tips'. --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 89073729bd1..98e336db189 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -102,5 +102,5 @@ For in-depth guidance on policy design and device posture checks, refer to the [ If you have issues connecting, refer to these resources: -- [WARP Connector tips](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common configuration tips and troubleshooting strategies. +- [Tips and best practices](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/tips/): review common WARP Connector configuration tips and troubleshooting strategies. - [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. From 16bb7b6587db7c6265888d8e4367e54935b65756 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 11 Mar 2026 11:26:13 -0500 Subject: [PATCH 15/17] Update src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx Co-authored-by: Caley Burton --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 98e336db189..e52167b7bd7 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -7,6 +7,10 @@ sidebar: description: Connect two private networks using WARP Connectors and Cloudflare's network. products: - cloudflare-one + - +tags: + - Linux + - Private networks --- import { InlineBadge } from "~/components"; From a1a4c6e0d532215534a043e328856e1e1f56ff86 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 11 Mar 2026 11:26:26 -0500 Subject: [PATCH 16/17] Update src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx Co-authored-by: Caley Burton --- .../cloudflare-one/setup/replace-vpn/network-to-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index e52167b7bd7..7770245be23 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -19,7 +19,7 @@ Connect two separate private networks so devices on each network can send and re To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). -This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). +This guide follows the same steps as the **Get Started** experience in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). ## How it works From c9c84f0b75cbe97ac82284473bbf7cc8b45f3746 Mon Sep 17 00:00:00 2001 From: Cody Anthony Date: Wed, 11 Mar 2026 11:40:20 -0500 Subject: [PATCH 17/17] [Cloudflare One] Address reviewer feedback on network-to-network page - Fix empty product bullet in frontmatter from Caley's suggestion - Add printer to intro use cases (Alexa #3) - Rephrase Step 1 to clarify dashboard creates config but user still installs the connector (Alexa #5) - Replace 'wizard generates' with 'dashboard provides' in Step 5 (Alexa #6) - Reframe device profile bullet to focus on independent routing control for connectors vs user devices (Alexa #7) --- .../setup/replace-vpn/network-to-network.mdx | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx index 7770245be23..ec320f2b6b3 100644 --- a/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/network-to-network.mdx @@ -7,7 +7,6 @@ sidebar: description: Connect two private networks using WARP Connectors and Cloudflare's network. products: - cloudflare-one - - tags: - Linux - Private networks @@ -15,7 +14,7 @@ tags: import { InlineBadge } from "~/components"; -Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments. For example, employees in one office could access a file server or internal application hosted in another. +Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments. For example, employees in one office could access a file server, printer, or internal application in another office. To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). @@ -37,7 +36,7 @@ WARP Connector is currently Linux-only. For more details on requirements and lim ## Step 1: Define a network segment -A network segment identifies the IP range of a private network you want to connect. For each segment, the wizard automatically creates a WARP Connector and configures the routes that tell Cloudflare how to reach your network. +A network segment identifies the IP range of a private network you want to connect. When you define a segment, the dashboard creates a WARP Connector configuration and sets up the routes that tell Cloudflare how to reach your network. You install and run the connector in the next step. 1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Replace my client-based or site-to-site VPN**, select **Get started**. @@ -76,7 +75,7 @@ Repeat the same process as [Step 2](#step-2-deploy-first-connector) on a Linux d If the WARP Connector is installed on your network's router (the device that serves as the default gateway), other devices on the network automatically send traffic through it. No additional configuration is needed, and you can skip this step. -If the WARP Connector is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the WARP Connector device. Without this route, devices do not know where to send traffic destined for the other network, and the connection does not work. The wizard generates OS-specific commands to add these routes. +If the WARP Connector is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the WARP Connector device. Without this route, devices do not know where to send traffic destined for the other network, and the connection does not work. The dashboard provides OS-specific commands for the devices you want to forward traffic from. 1. Select the operating system of the device you want to configure. 2. Select the tunnel you want to route traffic through. @@ -97,7 +96,7 @@ After verifying your connection, consider securing your connected networks with - **Set up Gateway policies**: By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/), [Network policies](/cloudflare-one/traffic-policies/network-policies/), and [HTTP policies](/cloudflare-one/traffic-policies/http-policies/). - **Create an Access application**: Restrict access to specific services or hosts on your connected networks with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). -- **Create a device profile**: Customize WARP Connector settings for your connectors, such as which traffic routes through Cloudflare and which stays local. For more information, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). +- **Create a device profile**: Control which traffic your connectors route through Cloudflare independently from your user devices. For more information, refer to [Connect two or more private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/site-to-site/). - **Explore more with Zero Trust**: Review your connectors, policies, and routes in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/).