From 0f13b21e66a764e304012f4f28e3ba2273fb93ba Mon Sep 17 00:00:00 2001 From: TownLake Date: Fri, 8 Jan 2021 13:18:09 +0000 Subject: [PATCH 1/2] connections update --- .../applications/configure-apps/index.md | 8 +- .../applications/configure-apps/saas-apps.md | 8 +- .../configure-apps/self-hosted-apps.md | 10 +- .../src/content/applications/index.md | 2 +- .../content/applications/non-HTTP/index.md | 2 + .../content/connections/connect-apps/index.md | 2 +- .../connect-apps/install-and-setup/index.md | 2 +- .../connections/connect-devices/DNS/index.md | 15 --- .../connections/connect-devices/HTTP/index.md | 13 -- .../agentless}/dns-over-https.md | 0 .../agentless}/dns-over-tls.md | 0 .../agentless}/index.md | 0 .../agentless}/linux.md | 0 .../DNS => connect-devices/agentless}/mac.md | 0 .../agentless}/native-os.md | 0 .../agentless}/windows.md | 0 .../connections/connect-devices/index.md | 6 +- .../connect-devices/warp/deployment/index.md | 11 +- .../connect-devices/warp/device-enrollment.md | 24 ---- .../connections/connect-devices/warp/index.md | 34 ++++-- .../{ => warp}/install-cloudflare-cert.md | 0 .../connections/connect-networks/index.md | 9 ++ .../locations/configuring-a-location.md | 39 ++++++ .../connect-networks/locations/index.md | 18 +++ .../locations/match-query-to-location.md | 23 ++++ .../setup-instructions/android/index.md | 8 ++ .../setup-instructions/android/manual.md | 53 +++++++++ .../setup-instructions/android/mdm.md | 55 +++++++++ .../locations/setup-instructions/firefox.md | 25 ++++ .../iOS/cfteams.mobileconfig | 69 +++++++++++ .../locations/setup-instructions/iOS/index.md | 8 ++ .../setup-instructions/iOS/manual.md | 53 +++++++++ .../locations/setup-instructions/iOS/mdm.md | 112 ++++++++++++++++++ .../locations/setup-instructions/index.md | 23 ++++ .../locations/setup-instructions/linux.md | 37 ++++++ .../locations/setup-instructions/mac.md | 23 ++++ .../locations/setup-instructions/router.md | 30 +++++ .../locations/setup-instructions/windows.md | 30 +++++ .../locations/troubleshooting-locations.md | 32 +++++ .../connect-without-agent/DNS/browser.md | 40 ------- .../connect-without-agent/DNS/index.md | 11 -- .../connect-without-agent/HTTP/index.md | 7 -- .../src/content/connections/index.md | 2 +- .../src/content/identity/index.md | 4 +- .../src/content/policies/filtering/index.md | 9 +- .../src/content/policies/index.md | 23 ++-- 46 files changed, 714 insertions(+), 166 deletions(-) delete mode 100644 products/cloudflare-one/src/content/connections/connect-devices/DNS/index.md delete mode 100644 products/cloudflare-one/src/content/connections/connect-devices/HTTP/index.md rename products/cloudflare-one/src/content/connections/{connect-without-agent/DNS => connect-devices/agentless}/dns-over-https.md (100%) rename products/cloudflare-one/src/content/connections/{connect-without-agent/DNS => connect-devices/agentless}/dns-over-tls.md (100%) rename products/cloudflare-one/src/content/connections/{connect-without-agent => connect-devices/agentless}/index.md (100%) rename products/cloudflare-one/src/content/connections/{connect-without-agent/DNS => connect-devices/agentless}/linux.md (100%) rename products/cloudflare-one/src/content/connections/{connect-without-agent/DNS => connect-devices/agentless}/mac.md (100%) rename products/cloudflare-one/src/content/connections/{connect-without-agent/DNS => connect-devices/agentless}/native-os.md (100%) rename products/cloudflare-one/src/content/connections/{connect-without-agent/DNS => connect-devices/agentless}/windows.md (100%) delete mode 100644 products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md rename products/cloudflare-one/src/content/connections/connect-devices/{ => warp}/install-cloudflare-cert.md (100%) create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/index.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/index.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/match-query-to-location.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/index.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/manual.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/mdm.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/firefox.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/cfteams.mobileconfig create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/index.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/manual.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/mdm.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/index.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/linux.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/mac.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/router.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/windows.md create mode 100644 products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md delete mode 100644 products/cloudflare-one/src/content/connections/connect-without-agent/DNS/browser.md delete mode 100644 products/cloudflare-one/src/content/connections/connect-without-agent/DNS/index.md delete mode 100644 products/cloudflare-one/src/content/connections/connect-without-agent/HTTP/index.md diff --git a/products/cloudflare-one/src/content/applications/configure-apps/index.md b/products/cloudflare-one/src/content/applications/configure-apps/index.md index 3b6b43e419a..ee057b71293 100644 --- a/products/cloudflare-one/src/content/applications/configure-apps/index.md +++ b/products/cloudflare-one/src/content/applications/configure-apps/index.md @@ -6,13 +6,13 @@ hideChildren: true -# Add applications +# Web applications -With Cloudflare for Teams, you can protect two types of applications: SaaS and self-hosted. +You can protect two types of web applications: SaaS and self-hosted. -**SaaS applications** include applications your team relies on that are not hosted by your organization, such as Slack or Airtable. +**SaaS applications** consist of applications your team relies on that are not hosted by your organization. Examples include Salesforce and Workday. To secure SaaS applications, you must integrate Cloudflare Access with the SaaS application's SSO configuration. -**Self-hosted applications** include your internal tools and applications, such as Jira or Grafana. You must secure self-hosted applications with Cloudflare's authoritative DNS to use Cloudflare Access. +**Self-hosted applications** consist of internal applications that you host in your own environment. These can the data center versions of tools like the Atlassian suite or applications created by your own team. To secure self-hosted applications, you must use Cloudflare's authoritative DNS and [connect the application](/connections/connect-apps) to Cloudflare. diff --git a/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md b/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md index 1ccaaacd54d..0da322ae0d4 100644 --- a/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md +++ b/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md @@ -2,13 +2,13 @@ order: 1 --- -# Add applications +# Web applications -With Cloudflare for Teams, you can protect two types of applications: SaaS and self-hosted. +You can protect two types of web applications: SaaS and self-hosted. -**SaaS applications** include applications your team relies on that are not hosted by your organization, such as Slack or Airtable. +**SaaS applications** consist of applications your team relies on that are not hosted by your organization. Examples include Salesforce and Workday. To secure SaaS applications, you must integrate Cloudflare Access with the SaaS application's SSO configuration. -**Self-hosted applications** include your internal tools and applications, such as Jira or Grafana. You must secure self-hosted applications with Cloudflare's authoritative DNS to use Cloudflare Access. +**Self-hosted applications** consist of internal applications that you host in your own environment. These can the data center versions of tools like the Atlassian suite or applications created by your own team. To secure self-hosted applications, you must use Cloudflare's authoritative DNS and [connect the application](/connections/connect-apps) to Cloudflare. diff --git a/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md b/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md index 171699a3fe5..c642ba30cb8 100644 --- a/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md +++ b/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md @@ -2,13 +2,13 @@ order: 1 --- -# Add applications +# Web applications -With Cloudflare for Teams, you can protect two types of applications: SaaS and self-hosted. +You can protect two types of web applications: SaaS and self-hosted. -**SaaS applications** include applications your team relies on that are not hosted by your organization, such as Slack or Airtable. +**SaaS applications** consist of applications your team relies on that are not hosted by your organization. Examples include Salesforce and Workday. To secure SaaS applications, you must integrate Cloudflare Access with the SaaS application's SSO configuration. -**Self-hosted applications** include your internal tools and applications, such as Jira or Grafana. You must secure self-hosted applications with Cloudflare's authoritative DNS to use Cloudflare Access. +**Self-hosted applications** consist of internal applications that you host in your own environment. These can the data center versions of tools like the Atlassian suite or applications created by your own team. To secure self-hosted applications, you must use Cloudflare's authoritative DNS and [connect the application](/connections/connect-apps) to Cloudflare. @@ -88,4 +88,4 @@ The **Setup section** allows you to configure a few advanced settings for your a 1. Once you've configured the settings as needed, click **Add application**. -Your application is now connected to Access, and will appear in your Applications list. You can proceed with connecting your origin to Cloudflare at this URL. \ No newline at end of file +Your application is now available in Cloudflare Access, and will appear in your Applications list. You can proceed with [connecting your origin](/connections/connect-apps) to Cloudflare using this address. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/applications/index.md b/products/cloudflare-one/src/content/applications/index.md index 278683c68d7..d0bf9cd30c4 100644 --- a/products/cloudflare-one/src/content/applications/index.md +++ b/products/cloudflare-one/src/content/applications/index.md @@ -4,7 +4,7 @@ order: 5 # Applications -Cloudflare for Teams brings a consistent login experience to your internal and SaaS applications, and evaluates every request for user identity and device context. +Cloudflare for Teams can secure self-hosted and SaaS applications with Zero Trust rules. Learn how to secure your applications, and how to configure one dashboard for your users to reach all the applications you've secured behind Teams: diff --git a/products/cloudflare-one/src/content/applications/non-HTTP/index.md b/products/cloudflare-one/src/content/applications/non-HTTP/index.md index c8b0988243a..51255404024 100644 --- a/products/cloudflare-one/src/content/applications/non-HTTP/index.md +++ b/products/cloudflare-one/src/content/applications/non-HTTP/index.md @@ -4,4 +4,6 @@ order: 4 # Non-HTTP +You can use Cloudflare for Teams to secure non-HTTP resources like machines available over SSH or remote desktops. + \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-apps/index.md b/products/cloudflare-one/src/content/connections/connect-apps/index.md index 137185bd48c..90cacaffaaf 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/index.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/index.md @@ -4,7 +4,7 @@ order: 0 # Connect applications -You can connect applications, servers, and other resources to Cloudflare's network using Argo Tunnel. +You can connect applications, servers, and other resources to Cloudflare's network using Cloudflare Argo Tunnel. When connected, Cloudflare can [apply Zero Trust policies](/policies/zero-trust) to determine who can reach the resource. Argo Tunnel runs a lightweight daemon (`cloudflared`) in your infrastructure that establishes outbound connections (Tunnels) between your web server and the Cloudflare edge. When Cloudflare receives a request for your chosen hostname, it proxies the request through those connections to `cloudflared`. In turn, `cloudflared` proxies the request to your applications. diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md index 411e0a25d81..20f8b5af43c 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md @@ -2,7 +2,7 @@ order: 0 --- -# Getting started +# Install and enroll In order to create and manage Tunnels, you'll first need to install and authenticate `cloudflared` on your machine. `cloudflared` runs alongside origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints. diff --git a/products/cloudflare-one/src/content/connections/connect-devices/DNS/index.md b/products/cloudflare-one/src/content/connections/connect-devices/DNS/index.md deleted file mode 100644 index 89761fed8c5..00000000000 --- a/products/cloudflare-one/src/content/connections/connect-devices/DNS/index.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -order: 1 ---- - -# Configure DNS - -Organizations can enforce DNS content and security policies for roaming users by sending DNS queries from the WARP client over DoH in DNS-filtering only mode. This service allows organizations to apply DNS policies by selecting a DoH subdomain from aligned to an existing location and configuring WARP clients to use this DoH subdomain. - -The DNS filtering policy configured for that location will be applied to WARP client DNS traffic. When the client connection toggle is enabled, only DNS traffic is sent to Cloudflare Gateway for policy enforcement--all non-DNS traffic is sent directly to the internet. - -![DNS only filtering](../../../static/documentation/connections/client-dns-filtering-only.png) - -When DNS filtering is enabled, all other traffic will be sent directly to the Internet. Entering a DoH subdomain for an organization triggers WARP into Teams mode - -Learn more about configuring the DoH subdomain within the WARP client for your operating system [here](https://developers.cloudflare.com/warp-client/teams). \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-devices/HTTP/index.md b/products/cloudflare-one/src/content/connections/connect-devices/HTTP/index.md deleted file mode 100644 index 39416e7af2b..00000000000 --- a/products/cloudflare-one/src/content/connections/connect-devices/HTTP/index.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -order: 3 ---- - -# Connect to the L7 Firewall - -Organizations can enforce both DNS and HTTP content and security policies for roaming users by enrolling users in a Gateway organization. Teams Gateway, Teams Standard, and Teams Enterprise customers will have the ability to login with Cloudflare for Teams through the WARP client. - -In L7 firewall model, all traffic leaving a user's device connects to Cloudflare through the WARP connection where Gateway can apply filters. DNS Queries are sent to the DoH address for that organization. - -![HTTP filtering](../../../static/client-http-filtering.png) - -Learn more about configuring the WARP client for your operating system [here](https://developers.cloudflare.com/warp-client/teams). \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/dns-over-https.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-https.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/DNS/dns-over-https.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-https.md diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/dns-over-tls.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-tls.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/DNS/dns-over-tls.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-tls.md diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/index.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/index.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/index.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/index.md diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/linux.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/linux.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/DNS/linux.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/linux.md diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/mac.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/mac.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/DNS/mac.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/mac.md diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/native-os.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/native-os.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/DNS/native-os.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/native-os.md diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/windows.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/windows.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-without-agent/DNS/windows.md rename to products/cloudflare-one/src/content/connections/connect-devices/agentless/windows.md diff --git a/products/cloudflare-one/src/content/connections/connect-devices/index.md b/products/cloudflare-one/src/content/connections/connect-devices/index.md index de3508f1e46..004f905227c 100644 --- a/products/cloudflare-one/src/content/connections/connect-devices/index.md +++ b/products/cloudflare-one/src/content/connections/connect-devices/index.md @@ -1,7 +1,9 @@ --- -order: 1 +order: 3 --- # Connect devices - \ No newline at end of file +You can configure devices to send DNS queries to Cloudflare or you can proxy all traffic leaving the device through Cloudflare's network. + + \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md index 8bcbd4d5afc..d0297f0a551 100644 --- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md +++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md @@ -2,17 +2,14 @@ order: 1 --- -# Getting started +# Deployment - - -To get started with the WARP client, you'll first need to create a **device enrollment policy** in your Teams dashboard. To do so: +To get started, you'll first need to create a **device enrollment policy** in your Teams dashboard. The device enrollment policy will determine who can enroll a device into your organization. To do so: 1. In your [Teams dashboard](https://dash.teams.cloudflare.com/), navigate to **My Teams** > **Devices**. + 1. Under **Device Settings**, create a [device enrollment policy](connections/connect-devices/warp/device-enrollment) to define who can connect a device to your organization. 1. Once your device enrollment policy is set up, configure [filtering policies](/policies/filtering) for your organization. If you are configuring [HTTP policies](/policies/filtering/http-policies), make sure to deploy the [root certificate](/connections/connect-devices/install-cloudflare-cert.md) to your devices. diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md deleted file mode 100644 index e42955a88e5..00000000000 --- a/products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -order: 3 ---- - -# Device enrollment - - - -Cloudflare for Teams allows you to establish which users in your organization can enroll new devices or revoke access to connected devices. To do that, you can create a **device enrollment rule** on the Teams dashboard. - -1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Devices**. - -1. Click **Device Settings** on the top-right corner. - -1. In the rule builder, configure a rule to define who can enroll or revoke devices. - In this example, only users with `cloudflare.com` email addresses who successfully authenticate during device enrollment through the WARP client will be able to enroll in the organization. This rule prevents outsider users from sending traffic through your account and will give your organization the ability to capture user profile logs and apply profile-specific rules. - - ![Go to device settings page](../../../static/documentation/connections/go-to-device-settings-page.png) - -1. Click **Save**. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md index 92df0db66a0..58c9abac579 100644 --- a/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md +++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md @@ -4,23 +4,31 @@ order: 3 # WARP client -Teams customers can use the Cloudflare WARP application to connect corporate desktops to **Cloudflare Gateway** for advanced web filtering. The Gateway features rely on the same performance and security benefits of the underlying WARP technology, now with security filtering available to the connection. +You can use Cloudflare WARP client to connect devices to Cloudflare for DNS filtering or Secure Web Gateway filtering. The WARP client can be deployed in the following modes: -The result is a simple way for enterprises to protect their users wherever they are without requiring the backhaul of network traffic to a centralized security boundary. Instead, organizations can configure the WARP client application to securely and privately send remote users’ traffic through a Cloudflare data center near them. Gateway administrators apply policies to outbound Internet traffic proxied through the client, allowing organizations to protect users from threats on the Internet, and stop corporate data from leaving their organization. +|Mode|Description|DNS Filtering|HTTP Filtering| +|---|---|---|---| +|DNS only|DoH-based filtering|Yes|No| +|DNS with WARP+|DoH-based filtering with encrypted WARP+ traffic|Yes|No| +|HTTP filtering|DoH-based filtering, HTTP filtering, and encrypted WARP+ traffic|Yes|Yes| -Here is how the WARP client can help your organization: +Cloudflare WARP is [available](/connections/warp/system-requirements) on iOS, Android, Mac, and Windows. -* **Encryption of user traffic** - Regardless of your users’ location, all traffic from their device is encrypted with WARP and sent privately to the nearest WARP endpoint. Used in conjunction with Cloudflare Access, your applications are 10ms away from wherever your user is located, and VPNs are no longer needed. +## DNS filtering -* **Additional speed with WARP+** - Any Teams customer who deploys the Teams client applications will automatically receive the premium speed benefits of WARP+. +The Cloudflare WARP client can be configured to send all DNS queries from roaming devices, on any network, to Cloudflare for DNS filtering. Deploying DNS filtering with WARP does not require your team to configure source or destination IPs. To begin, follow the steps below: -* **Gateway Device Roaming** - With Gateway Device Roaming, you can enforce Cloudflare Gateway policies anywhere your users roam on any operating system supported by the Cloudflare WARP Client. +1. Determine which devices can enroll. +2. Create a DNS-over-HTTPS destination. +3. [Deploy](/connections/warp/deployment) Cloudflare WARP to devices. -* **L7 Firewall and user-based policies** - This allows your organization to enforce device authentication to your Teams account, enabling you to build user specific policies and force all traffic through the firewall. +Alternatively, you can deploy Cloudflare DNS filtering on [networks](/connections/connect-networks) or [devices](connections/connect-devices/agentless) without the WARP client. -* **Device and user auditing** - Administrators can audit specific user and device traffic. Used in conjunction with logpush, this will allow your organization to do detailed level tracing in case of a breach or audit. (Available with Enterprise Teams plan only) \ No newline at end of file +## Web proxying + +You can proxy all traffic leaving devices through Cloudflare for HTTP inspection and filtering using the Cloudflare WARP client. To begin, follow the steps below: + +1. Determine which devices can enroll. +2. [Deploy](/connections/warp/deployment) Cloudflare WARP to devices. +3. [Install](/connections/warp/install-cloudflare-cert) the Cloudflare root certificate on the devices. +4. Enable web inspection in the Cloudflare for Teams dashboard. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-devices/install-cloudflare-cert.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/install-cloudflare-cert.md similarity index 100% rename from products/cloudflare-one/src/content/connections/connect-devices/install-cloudflare-cert.md rename to products/cloudflare-one/src/content/connections/connect-devices/warp/install-cloudflare-cert.md diff --git a/products/cloudflare-one/src/content/connections/connect-networks/index.md b/products/cloudflare-one/src/content/connections/connect-networks/index.md new file mode 100644 index 00000000000..34782a2aca8 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/index.md @@ -0,0 +1,9 @@ +--- +order: 1 +--- + +# Connect networks + +You can configure networks to send DNS queries to Cloudflare for filtering and logging. + + \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md new file mode 100644 index 00000000000..52e093330ca --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md @@ -0,0 +1,39 @@ +--- +order: 1 +--- + +# Configure a Location + +import gatewayCreateLocation from '../static/gateway-create-location.gif' + +The only requirement for a location is its name. All other fields are optional if the location you are sending requests from is only using IPv6 or sending all DNS requests using DNS over HTTPS. + +Configuring a location + +## IPv4 +Gateway uses the public source IPv4 address of your network to identify your location, apply policies and log the DNS requests. When you go through onboarding or in our location tab, the dashboard automatically identifies the public source IP address. + +If you are using Gateway's paid plans, you can manually enter the IP address and netmask of your location. You can find out what public IP address you are using by connecting to the network of the location and then googling “What’s my IP address”. + +On your router or if you are using a device or a daemon, forward DNS queries to the following IP addresses: + +* **172.64.36.1** +* **172.64.36.2** + +See how you can start sending DNS queries by visiting the [setup instructions](/locations/setup-instructions/) + +## IPv6 +When you create a location, your location will receive a unique IPv6 address. Cloudflare Gateway will identify your location based on this unique IPv6 address. + +On your router/device/forwarder/daemon forward DNS queries to the corresponding IPv6 address for the location. + +See how you can start sending DNS queries by visiting the [setup instructions](/locations/setup-instructions/) + +## DNS over HTTPS +Each location has a unique hostname for DNS over HTTPS. + +Cloudflare Gateway will identify your location based on the DNS over HTTPS hostname. + +![DNS over HTTPS hostname](../static/location-with-dns-over-https-hostname.png) + +See how you can start sending DNS queries over HTTPS using [Firefox.](/locations/setup-instructions/firefox). diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md new file mode 100644 index 00000000000..e7b8e16b51d --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md @@ -0,0 +1,18 @@ +--- +order: 2 +hidden: true +--- + +# Locations + +Locations are usually physical entities like offices, homes, retail stores, movie theatres or a data centers. The fastest way to start sending DNS queries from a location and protect it from security threats is by changing the DNS resolvers at the router to the dedicated IPv6 addresses for those locations. + +If you don’t have IPv6 network, you can set up a location by adding the source IP for the location and changing the DNS resolvers to + +* **172.64.36.1** +* **172.64.36.2** + +If you want to send your DNS queries over an encrypted connection, you can use the hostname that we provide in the dashboard to send queries using DNS over HTTPS. + +* [Configuring a location](/locations/configuring-a-location) +* [Setup instructions](/locations/setup-instructions) diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/match-query-to-location.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/match-query-to-location.md new file mode 100644 index 00000000000..089dee76b8a --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/match-query-to-location.md @@ -0,0 +1,23 @@ +--- +order: 3 +--- + +# Determining a location + +Gateway uses different ways to match a DNS query to [locations](/locations) depending on the type of request and network. This is how Gateway determines the location of a DNS query: + +![Determine location](../static/gateway-determine-location-dns.png) + +Here is a step by step flow of how Gateway determines the location for an incoming DNS query: + +## Step 1: DNS over HTTPS check and lookup based on hostname + +Check if the DNS query is using DNS over HTTPS. If yes, lookup location by the unique hostname. If not, go to step 2. + +## Step 2: IPv4 check and lookup based on source IPv4 address + +Check if the DNS query is sent over IPv4. If yes, lookup location by the source IPv4 address. If no, go to step 3. + +## Step 3: Lookup based on IPv6 + +If the query is in this step, it means that the DNS query is using IPv6. Gateway will lookup the location associated with the DNS query based on the destination IPv6 address. diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/index.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/index.md new file mode 100644 index 00000000000..6d9350ae99b --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/index.md @@ -0,0 +1,8 @@ +--- +order: 3 +--- + +# Android Setup Instructions + +* [Setup Gateway on Android](/locations/setup-instructions/android/manual) +* [Setup Gateway on Android using an MDM](/locations/setup-instructions/android/mdm) diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/manual.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/manual.md new file mode 100644 index 00000000000..d6fc12b9270 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/manual.md @@ -0,0 +1,53 @@ +--- +order: 1 +--- + +# Android Setup Instructions (Manual) + + + +## Install the 1.1.1.1 mobile app +Install the 1.1.1.1 mobile app by visiting the [play store](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone) on your Android device. + +If you already have the app on your phone, make sure you have the latest version of the app and then skip to the next step. + +## Click on the menu button +After you open the 1.1.1.1 mobile app, visit settings. + +## Click on Advanced +Click on 'Advanced' which is located under the 'Account' button. +![Click on Advanced](../../../static/android-click-on-advanced.png) + +## Click on Connection options +Click on 'Connection options' which is located at the bottom of the screen right above 'Diagnostics'. +![Click on Connection options](../../../static/android-click-on-connection-options.png) + +## Click on DNS Settings +Click on 'DNS Settings'. This will take you to the screen where you can configure Gateway for your 1.1.1.1 mobile app. +![Click on DNS Settings](../../../static/android-click-on-dns-settings.png) + +## Enter unique id from Gateway +When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone. + +1. Visit your teams dashboard to fetch the unique id from your location. +![Go to teams dash](../../../static/go-to-teams-dashboard.png) + +2. Go to locations page to see the list of locations. +![Go to locations page](../../../static/go-to-locations-page.png) + +3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card. +![Expand location card](../../../static/expand-location-card.png) + +4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg. +![Get unique subdomain](../../../static/unique-gateway-id.png) + +5. Click on 'Gateway Unique ID'. +![Click on guid](../../../static/android-click-on-guid.png) + +6. Enter the subdomain inside the field. +![Enter unique id](../../../static/android-enter-unique-id.png) + +If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/mdm.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/mdm.md new file mode 100644 index 00000000000..fc5030a2c36 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/android/mdm.md @@ -0,0 +1,55 @@ +--- +order: 2 +--- + +# Android Setup Instructions (MDM) + + + +You can deploy Gateway to your corporate Android devices in bulk. Use an MDM solution to deploy your Gateway configuration to all corporate devices. If you want to learn how to use Gateway on your personal Android device please use the setup instructions from [this page](../manual/) instead. + +## Unique Gateway Id +When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone. + +1. Visit your teams dashboard to fetch the unique id from your location. +![Go to teams dash](../../../static/go-to-teams-dashboard.png) + +2. Go to locations page to see the list of locations +![Go to locations page](../../../static/go-to-locations-page.png) + +3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card. +![Expand location card](../../../static/expand-location-card.png) + +4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg. +![Get unique subdomain](../../../static/unique-gateway-id.png) + +## Modify configuration file + +Create a file named `app_restrictions.xml` in your app's `res/xml` directory with the contents below: + +```xml + + + + + + +``` + +Open the file in a text editor and search for the id and replace the value `gateway_unique_id_value` with the unique id from the previous section. + +You can read more about using mdm on Android [here](https://developer.android.com/work/managed-configurations). + +After you save the file, use your preferred MDM tool to deploy the configuration change to your fleet of corporate mobile devices. + +If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/firefox.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/firefox.md new file mode 100644 index 00000000000..4433072d0a0 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/firefox.md @@ -0,0 +1,25 @@ +--- +order: 2 +--- + +# Firefox Setup Instructions + +With Firefox, you can send DNS queries using the DNS over HTTPS protocol. + +* Open Preferences and scroll to the bottom. + +* Click on Settings inside **Network Settings**. + +* Check **Enable DNS over HTTPS**. + +* Using the dropdown for **Use Provider**, choose **Custom**. + +* In the Custom field enter `https://YOUR_UNIQUE_SUBDOMAIN.cloudflare-gateway.com/dns-query` and click **OK**. + +* Enter **about:config** in the address bar. + +* Click on **Accept the risk!** if you see a prompt from Firefox. + +* Set network.trr.bootstrapAddress to `162.159.36.5` + +* Set network.trr.mode to **3** \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/cfteams.mobileconfig b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/cfteams.mobileconfig new file mode 100644 index 00000000000..c5f6550c395 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/cfteams.mobileconfig @@ -0,0 +1,69 @@ + + + + + PayloadContent + + + IPv4 + + OverridePrimary + 0 + + PayloadDescription + Configures VPN settings + PayloadDisplayName + VPN + PayloadIdentifier + com.apple.vpn.managed.0C1AE427-5904-41EB-BC46-2CA460B7F683 + PayloadType + com.apple.vpn.managed + PayloadUUID + 0C1AE427-5904-41EB-BC46-2CA460B7F683 + PayloadVersion + 1 + Proxies + + HTTPEnable + 0 + HTTPSEnable + 0 + + UserDefinedName + 1.1.1.1 + VPN + + AuthName + na + AuthenticationMethod + Password + RemoteAddress + 1.1.1.1 + + VPNSubType + com.cloudflare.1dot1dot1dot1 + VPNType + VPN + VendorConfig + + admin_installed + + gateway_unique_id + bt2y71kv3e + + + + PayloadDisplayName + 1.1.1.1 + PayloadIdentifier + C02V5189HTDD.20DD5FEA-78C3-4E2B-BE41-A96091A734B0 + PayloadRemovalDisallowed + + PayloadType + Configuration + PayloadUUID + 8D0811D8-0CCA-4162-AC6F-DA2808A942A2 + PayloadVersion + 1 + + diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/index.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/index.md new file mode 100644 index 00000000000..b6fd482a214 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/index.md @@ -0,0 +1,8 @@ +--- +order: 2 +--- + +# iOS Setup Instructions + +* [Setup Gateway on iOS](/locations/setup-instructions/ios/manual) +* [Setup Gateway on iOS using an MDM](/locations/setup-instructions/ios/mdm) diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/manual.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/manual.md new file mode 100644 index 00000000000..9503a1b0f4d --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/manual.md @@ -0,0 +1,53 @@ +--- +order: 1 +--- + +# iOS Setup Instructions (Manual) + + + +## Install the 1.1.1.1 mobile app +Install the 1.1.1.1 mobile app by visiting the [app store](https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627) on your iOS device. + +If you already have the app on your phone, make sure you have the latest version of the app and then skip to the next step. + +![Install the 1.1.1.1 mobile app](../../../static/install-one-dot-app.png) + +## Click on the menu button +After you open the 1.1.1.1 mobile app, click on the menu button on the top right corner. +![Click on the menu button](../../../static/click-on-menu.PNG) + +## Click on Advanced +Click on 'Advanced' which is located under the 'Account' button. +![Click on Advanced](../../../static/click-on-advanced.PNG) + +## Click on Connection options +Click on 'Connection options' which is located at the bottom of the screen right above 'Diagnostics'. +![Click on Connection options](../../../static/click-on-connection-options.PNG) + +## Click on DNS Settings +Click on 'DNS Settings'. This will take you to the screen where you can configure Gateway for your 1.1.1.1 mobile app. +![Click on DNS Settings](../../../static/click-on-dns-settings.PNG) + +## Enter unique id from Gateway +When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone. + +1. Visit your teams dashboard to fetch the unique id from your location. +![Go to teams dash](../../../static/go-to-teams-dashboard.png) + +2. Go to locations page to see the list of locations. +![Go to locations page](../../../static/go-to-locations-page.png) + +3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card. +![Expand location card](../../../static/expand-location-card.png) + +4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg. +![Get unique subdomain](../../../static/unique-gateway-id.png) + +5. Enter the subdomain inside the field **GATEWAY UNIQUE ID** +![Enter unique id](../../../static/enter-unique-id.PNG) + +If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/mdm.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/mdm.md new file mode 100644 index 00000000000..6de1dcf95ab --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/iOS/mdm.md @@ -0,0 +1,112 @@ +--- +order: 2 +--- + +# iOS Setup Instructions (MDM) + + + +You can deploy Gateway to your corporate iOS devices in bulk. Use an MDM solution to deploy your Gateway configuration to all corporate devices. If you want to learn how to use Gateway on your personal iOS device please use the setup instructions from [this page](/locations/setup-instructions/ios/manual/) instead. + +## Unique Gateway Id +When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone. + +1. Visit your teams dashboard to fetch the unique id from your location. +![Go to teams dash](../../../static/go-to-teams-dashboard.png) + +2. Go to locations page to see the list of locations +![Go to locations page](../../../static/go-to-locations-page.png) + +3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card. +![Expand location card](../../../static/expand-location-card.png) + +4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg. +![Get unique subdomain](../../../static/unique-gateway-id.png) + +## Modify configuration file + +Download the configuration file from here + +The contents of the file will look like below: +```xml + + + + + PayloadContent + + + IPv4 + + OverridePrimary + 0 + + PayloadDescription + Configures VPN settings + PayloadDisplayName + VPN + PayloadIdentifier + com.apple.vpn.managed.0C1AE427-5904-41EB-BC46-2CA460B7F683 + PayloadType + com.apple.vpn.managed + PayloadUUID + 0C1AE427-5904-41EB-BC46-2CA460B7F683 + PayloadVersion + 1 + Proxies + + HTTPEnable + 0 + HTTPSEnable + 0 + + UserDefinedName + 1.1.1.1 + VPN + + AuthName + na + AuthenticationMethod + Password + RemoteAddress + 1.1.1.1 + + VPNSubType + com.cloudflare.1dot1dot1dot1 + VPNType + VPN + VendorConfig + + admin_installed + + gateway_unique_id + bt2y71kv3e + + + + PayloadDisplayName + 1.1.1.1 + PayloadIdentifier + C02V5189HTDD.20DD5FEA-78C3-4E2B-BE41-A96091A734B0 + PayloadRemovalDisallowed + + PayloadType + Configuration + PayloadUUID + 8D0811D8-0CCA-4162-AC6F-DA2808A942A2 + PayloadVersion + 1 + + +``` + +Use a texteditor to replace the string `gateway_unique_id` with the 10 character unique subdomain from the DNS over HTTPS hostname for your location that you got from the previous section. Please make sure that you don't change any other parts of the file. + +After you save the file, use your preferred MDM tool to deploy the configuration change to your fleet of corporate mobile devices. + +If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now. diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/index.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/index.md new file mode 100644 index 00000000000..bc41bff03eb --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/index.md @@ -0,0 +1,23 @@ +--- +order: 1 +--- + +# Setup instructions + +[Router Setup Instructions](/locations/setup-instructions/router) +See how you can send DNS queries to Gateway from a router. + +[Firefox Setup Instructions](/locations/setup-instructions/firefox) +See how you can send encrypted DNS queries to Gateway using Firefox. + +[Mac Setup Instructions](/locations/setup-instructions/mac) +See how you can send DNS queries to Gateway from a Mac. + +[Windows Setup Instructions](/locations/setup-instructions/windows) +See how you can send DNS queries to Gateway from Windows. + +[Linux Setup Instructions](/locations/setup-instructions/linux) +See how you can send DNS queries to Gateway from a Linux Distro. + +[iOS Setup Instructions](/locations/setup-instructions/ios) +See how you can send DNS queries to Gateway from an iOS device. diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/linux.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/linux.md new file mode 100644 index 00000000000..2ad5099f908 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/linux.md @@ -0,0 +1,37 @@ +--- +order: 4 +--- + +# Linux + +## Ubuntu + +### IPv4 +* Click System > Preferences > Network Connections. +* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to. +* Click Edit then click IPv4. +* Remove any IP addresses that may be already listed and in their place add the following IP addresses: + * **172.64.36.1** + * **172.64.36.2** +* Click Apply + +### IPv6 +* Click System > Preferences > Network Connections. +* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to. +* Then go to IPv6. +* Add the IPv6 address from that we listed based on your location configuration +* Click Apply. + +## Debian + +### IPv4 +* In the command line, type: `sudo vim /etc/resolv.conf` +* Replace the nameserver lines with: (Since you are using vim press the i key on your keyboard to edit the document) + * **172.64.36.1** + * **172.64.36.2** +* Save and exit vim by pressing the ESC key on your keyboard. Then after lifting the key type `:wq` + +### IPv6 +* In the command line, type: `sudo vim /etc/resolv.conf` +* Add the IPv6 address from that we listed based on your location configuration +* Save and exit vim by pressing the ESC key on your keyboard. Then after lifting the key type `:wq` diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/mac.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/mac.md new file mode 100644 index 00000000000..cdc9e3a4b4c --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/mac.md @@ -0,0 +1,23 @@ +--- +order: 2 +--- + +# Mac Setup Instructions + +## IPv4 +* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences. +* Click on the icon called Network. +* Click Advanced. +* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the following IP addresses: + * **172.64.36.1** + * **172.64.36.2** +* Click OK. +* Click Apply. + +## IPv6 +* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences. +* Click on the icon called Network. +* Click Advanced. +* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the IPv6 address we listed based on your location configuration +* Click OK. +* Click Apply. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/router.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/router.md new file mode 100644 index 00000000000..d56f66ef9d1 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/router.md @@ -0,0 +1,30 @@ +--- +order: 1 +--- + +# Router Setup Instructions + +## IPv4 +* Click on the Start menu, then click on Control Panel. +* Click on Network and Internet. +* Click on Change Adapter Settings. +* Right click on the Wi-Fi network you are connected to. +* Click Properties. +* Select Internet Protocol Version 4. +* Click Properties. +* Remove any IP addresses that may be already listed and in their place add the following IP addresses: + * **172.64.36.1** + * **172.64.36.2** +* Click OK. + +## IPv6 +* Click on the Start menu, then click on Control Panel. +* Click on Network and Internet. +* Click on Change Adapter Settings. +* Right click on the Wi-Fi network you are connected to. +* Click Properties. +* Select Internet Protocol Version 6. +* Click Properties. +* Click Use The Following DNS Server Addresses. +* Add the IPv6 address from that we listed based on your location configuration +* Click OK. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/windows.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/windows.md new file mode 100644 index 00000000000..f442f509b46 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/setup-instructions/windows.md @@ -0,0 +1,30 @@ +--- +order: 3 +--- + +# Windows Setup Instructions + +## IPv4 +* Click on the Start menu, then click on Control Panel. +* Click on Network and Internet. +* Click on Change Adapter Settings. +* Right click on the Wi-Fi network you are connected to. +* Click Properties. +* Select Internet Protocol Version 4. +* Click Properties. +* Remove any IP addresses that may be already listed and in their place add the following IP addresses: + * **172.64.36.1** + * **172.64.36.2** +* Click OK. + +## IPv6 +* Click on the Start menu, then click on Control Panel. +* Click on Network and Internet. +* Click on Change Adapter Settings. +* Right click on the Wi-Fi network you are connected to. +* Click Properties. +* Select Internet Protocol Version 6. +* Click Properties. +* Click Use The Following DNS Server Addresses. +* Add the IPv6 address from that we listed based on your location configuration +* Click OK. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md new file mode 100644 index 00000000000..078b6a7f1fd --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md @@ -0,0 +1,32 @@ +--- +order: 3 +--- + +# Troubleshooting Locations + +### Your source IPv4 address is taken +![Source IP taken](../static/source-ip-taken.png) +You may see this if you are connected to a network where someone else in the same network signed up for Cloudflare Gateway before you did. + +If your network supports IPv6, you can still use Cloudflare Gateway's DNS filtering by sending DNS queries over IPv6. You can also use the DNS over HTTPS hostname to send queries using a DNS over HTTPS client. + +If you think someone else is wrongfully using this IPv4 address, please [let us know](https://forms.gle/MUtjTheQh24MRY2aA) + +### You are not seeing analytics on the Overview page +![Overview empty](../static/gateway-dash-overview-empty.png) + +You may not see analytics on the Overview page for the following reasons: + +##### 1. You are not sending DNS queries to Gateway +Verify that the destination IP addresses you are sending DNS queries to are correct. You can check the destination IP addresses for your location by going to your locations page and then expanding the location: + +![Location With Destinations](../static/expanded-location-with-destinations.png) + +##### 2. You are using other DNS resolvers +If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. Please make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses. + +##### 3. The source IPv4 address for your location is incorrect +If you are using IPv4, check the source IPv4 address that you entered for the location matches with the network's source IPv4 address. + +##### 4. Analytics is not available yet +It takes some time to generate the analytics for Cloudflare Gateway. If you are not seeing anything even after 5 minutes, please file a support ticket. diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/browser.md b/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/browser.md deleted file mode 100644 index d0eaa80cd1d..00000000000 --- a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/browser.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -order: 0 -hidden: true ---- - -# Browser Setup - -## Firefox - -With Firefox, you can send DNS queries using the DNS over HTTPS protocol. - -### Find a location's DoH subdomain - -[Obtain a location DoH subdomain (previously known as a unique id)](/getting-started/troubleshooting-policies/#find-a-location-doh-subdomain) - -### Set up Gateway on Firefox - -1. Open **Preferences** and scroll to the bottom. - -2. Click on **Network Settings**. - -3. Click on **Settings**. - -4. Check **Enable DNS over HTTPS**. - -5. Choose **Custom** from the drop-down for **Use Provider**. - -6. Enter `https://YOUR_UNIQUE_SUBDOMAIN.cloudflare-gateway.com/dns-query` in the **Custom** field. In place of `YOUR_UNIQUE_SUBDOMAIN`, include your **unique ID**. - -7. Click **OK**. - -8. Enter **about:config** in the address bar. - -9. Click on **Accept the risk!** if you see a prompt from Firefox. - -10. Set network.trr.bootstrapAddress to `162.159.36.5`. - -11. Set network.trr.mode to **3**. - -You should now be able to send queries through the DNS over HTTPS protocol. diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/index.md b/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/index.md deleted file mode 100644 index 7955f25294c..00000000000 --- a/products/cloudflare-one/src/content/connections/connect-without-agent/DNS/index.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -order: 0 ---- - -# Configure DNS - -Cloudflare Gateway supports a variety of client configurations and operating systems. It also allows you to send private, encrypted queries over both DNS over HTTPS (DoH) and DNS over TLS (DoT). - -- [DNS over HTTPS](/connecting-to-gateway/without-client/DNS/dns-over-https) -- [DNS over TLS](/connecting-to-gateway/without-client/DNS/dns-over-tls) -- [Native Operating System Integration](/connecting-to-gateway/without-client/DNS/native-os) diff --git a/products/cloudflare-one/src/content/connections/connect-without-agent/HTTP/index.md b/products/cloudflare-one/src/content/connections/connect-without-agent/HTTP/index.md deleted file mode 100644 index 1a59b5768e7..00000000000 --- a/products/cloudflare-one/src/content/connections/connect-without-agent/HTTP/index.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -order: 3 ---- - -# Connect to the L7 Firewall - -In the future, Cloudflare Gateway will support the ability for organizations to connect to the L7 firewall directly, without the use of the Cloudflare for Teams client, through the deployment of a PAC file. Today, organizations must connect to Cloudflare Gateway with the Teams client and the user must be enrolled in a Gateway organization with a paid subscription in order to receive protections from HTTP traffic filtering. diff --git a/products/cloudflare-one/src/content/connections/index.md b/products/cloudflare-one/src/content/connections/index.md index 2a871d99c16..87eee19fe9d 100644 --- a/products/cloudflare-one/src/content/connections/index.md +++ b/products/cloudflare-one/src/content/connections/index.md @@ -4,6 +4,6 @@ order: 4 # Connections -Learn how you can connect your applications or devices to Cloudflare's network. +Learn how you can connect your applications, devices, and networks to Cloudflare. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/identity/index.md b/products/cloudflare-one/src/content/identity/index.md index b6d97a57b22..08389fce377 100644 --- a/products/cloudflare-one/src/content/identity/index.md +++ b/products/cloudflare-one/src/content/identity/index.md @@ -4,8 +4,8 @@ order: 3 # Identity -Cloudflare for Teams integrates with your organization's identity provider to apply Zero Trust and Secure Web Gateway policies. You can also integrate multiple identity providers. +Cloudflare for Teams integrates with your organization's identity provider to apply Zero Trust and Secure Web Gateway policies. If you work with partners, contractors, or other organizations you can integrate multiple identity providers simultaneously. -Beyond identity, your team can integrate device posture signal from third party providers like Tanium and Azure AD. +You can also build rules based on device posture using mutual TLS authentication, third party integrations, or the Cloudflare WARP client. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/policies/filtering/index.md b/products/cloudflare-one/src/content/policies/filtering/index.md index 9b71e8d82b2..2c9ba20dbe6 100644 --- a/products/cloudflare-one/src/content/policies/filtering/index.md +++ b/products/cloudflare-one/src/content/policies/filtering/index.md @@ -4,8 +4,13 @@ order: 0 # Secure Web Gateway -Gateway policies allow you to grant or deny your users access to specific domains or domain categories. If the WARP client is configured to send DNS requests over DoH to Gateway, the DNS queries are evaluated against content and security policies configured for the organization. If the domain is allowed, the client receives the DNS resolution and initiates an HTTP connection. +Gateway polices filter DNS requests and HTTP traffic to the Internet. -Cloudflare Gateway currently filters HTTP traffic over port 80 and 443. If the HTTP connection is within a TLS connection, the TLS connection will be terminated at Cloudflare Gateway so the HTTP traffic can be inspected (unless an administrator configures a bypass rule). If the HTTP connection does not violate any policies configured by an administrator, the traffic is allowed through to the origin server. +Cloudflare Gateway filters traffic in two modes: + +* **DNS filtering:** Filter DNS queries from networks or devices. +* **HTTP filtering:** Inspect and filter HTTP traffic over port 80 and 443 from enrolled devices. If the HTTP connection is within a TLS connection, the TLS connection will be terminated at Cloudflare Gateway so the HTTP traffic can be inspected (unless an administrator configures a bypass rule). + +This section describes how to create DNS and HTTP policies in Cloudflare for Teams. You can review how to connect networks and devices to Cloudflare in the [Connections section](/connections) \ No newline at end of file diff --git a/products/cloudflare-one/src/content/policies/index.md b/products/cloudflare-one/src/content/policies/index.md index fb34020912f..11d046c4523 100644 --- a/products/cloudflare-one/src/content/policies/index.md +++ b/products/cloudflare-one/src/content/policies/index.md @@ -2,20 +2,17 @@ order: 6 --- -# Policies - - +# Policies -Cloudflare for Teams allows your organization to control inbound requests to your applications, as well as outbound traffic to the Internet. Policies also allow you to block security threats and potentially malicious websites. +Policies are sets of rules that allow you to create: +* **Zero Trust** rules to secure applications with **Cloudflare Access**, and +* **Secure Web Gateway** rules to filter traffic to the Internet, with **Cloudflare Gateway**. -While both [zero-trust policies](/policies/zero-trust) in Access and [filters](/policies/filtering) in Gateway act as a set of rules that help you filter activity on your network, they are quite different in nature and scope. Let's dive into what you can do with policies in both products. + + + + - \ No newline at end of file + \ No newline at end of file From 5a63a545acb4293224ba7e06153b5145d54200b2 Mon Sep 17 00:00:00 2001 From: TownLake Date: Fri, 8 Jan 2021 13:35:58 +0000 Subject: [PATCH 2/2] fix gif --- .../connect-networks/locations/configuring-a-location.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md index 52e093330ca..730de9c176c 100644 --- a/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md +++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md @@ -4,8 +4,6 @@ order: 1 # Configure a Location -import gatewayCreateLocation from '../static/gateway-create-location.gif' - The only requirement for a location is its name. All other fields are optional if the location you are sending requests from is only using IPv6 or sending all DNS requests using DNS over HTTPS. Configuring a location