-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
6 changed files
with
194 additions
and
139 deletions.
There are no files selected for viewing
49 changes: 49 additions & 0 deletions
49
...loudflare-one/connections/connect-networks/private-net/warp-connector/index.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| --- | ||
| pcx_content_type: concept | ||
| title: WARP Connector | ||
| sidebar: | ||
| label: Overview | ||
| order: 5 | ||
| badge: | ||
| text: Beta | ||
| tableOfContents: false | ||
| --- | ||
|
|
||
| import { Details} from "~/components"; | ||
|
|
||
| <Details header="Feature availability"> | ||
|
|
||
| | [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) | | ||
| | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | ||
| | Gateway with WARP | All plans | | ||
|
|
||
| | System | Availability | | ||
| | -------- | ------------ | | ||
| | Windows | ❌ | | ||
| | macOS | ❌ | | ||
| | Linux | ✅ | | ||
| | iOS | ❌ | | ||
| | Android | ❌ | | ||
| | ChromeOS | ❌ | | ||
|
|
||
| </Details> | ||
|
|
||
| Cloudflare WARP Connector is a piece of software [^1] that enables site-to-site, bidirectional, and mesh networking connectivity without requiring changes to underlying network routing infrastructure. WARP Connector establishes a secure Layer 3 connection between a private network and Cloudflare, allowing you to: | ||
|
|
||
| - Connect two or more private networks to each other. | ||
| - Connect IoT devices that cannot run external software, such as printers and IP phones. | ||
| - Filter and log server-initiated traffic, such as VoIP and SIP traffic. | ||
| - Apply Zero Trust security policies based on the source IP of the request. | ||
|
|
||
|  | ||
|
|
||
| As shown in the diagram, WARP Connector acts as a router for a subnet within the private network to on-ramp and off-ramp traffic through Cloudflare. All devices on the subnet can access any services connected to Cloudflare, and all devices connected to Cloudflare can access any services on the subnet. Each subnet runs a WARP Connector on a designated Linux machine (typically the default gateway router), but other devices on the network do not need to install software. | ||
|
|
||
| To set up WARP Connector, refer to the guide for your use case: | ||
|
|
||
| - **[Site-to-Internet](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/)**: Send requests from your private network to the Internet. | ||
| - **[Site-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/)**: Send requests between two or more private networks. | ||
| - **[User-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site/)**: Allow WARP client devices to access your private network. | ||
| - **Internet-to-site**: Not supported by WARP Connector. To provide clientless access to applications on your private network, set up a [Cloudflare Tunnel with `cloudflared`](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) and configure a [public hostname route](/cloudflare-one/connections/connect-networks/routing-to-tunnel/). | ||
|
|
||
| [^1]: WARP Connector is an extension of the [WARP client](/cloudflare-one/connections/connect-devices/warp/). |
22 changes: 22 additions & 0 deletions
22
...ne/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| --- | ||
| pcx_content_type: how-to | ||
| title: Connect private network to Internet | ||
| sidebar: | ||
| label: Site-to-Internet | ||
| order: 3 | ||
| --- | ||
|
|
||
| import { Details, GlossaryTooltip, TabItem, Tabs } from "~/components"; | ||
|
|
||
| Forward requests from the private network to the Internet. | ||
|
|
||
| ```mermaid | ||
| flowchart LR | ||
| subgraph subnet1[Subnet 10.0.0.0/24] | ||
| router1["WARP Connector | ||
| 10.0.0.1"] | ||
| end | ||
| router1-->C((Cloudflare))-->I{Internet} | ||
| ``` | ||
|
|
||
| The `10.0.0.0/24` WARP Connector is now routing traffic from the host machine to Cloudflare. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
18 changes: 18 additions & 0 deletions
18
...re-one/connections/connect-networks/private-net/warp-connector/user-to-site.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| --- | ||
| pcx_content_type: how-to | ||
| title: Connect WARP clients to private network | ||
| sidebar: | ||
| label: User-to-site | ||
| order: 3 | ||
| --- | ||
|
|
||
| import { Details, GlossaryTooltip, TabItem, Tabs } from "~/components"; | ||
|
|
||
| ```mermaid | ||
| flowchart LR | ||
| subgraph subnet1[Subnet 10.0.0.0/24] | ||
| router1["WARP Connector | ||
| 10.0.0.1"] | ||
| end | ||
| router1<-->C((Cloudflare))<-->W[WARP client] | ||
| ``` |
23 changes: 23 additions & 0 deletions
23
...one/connections/connect-networks/private-net/warp-connector/vpc-deployments.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| --- | ||
| pcx_content_type: reference | ||
| title: Tips for VPC deployments | ||
| sidebar: | ||
| label: VPC deployments | ||
| order: 3 | ||
| --- | ||
|
|
||
| When setting up WARP Connector on a virtual private cloud (VPC), you may need to configure additional settings in the cloud service provider. | ||
|
|
||
| ## GCP | ||
|
|
||
| For Google Cloud Project (GCP) deployments, [enable IP forwarding](https://cloud.google.com/vpc/docs/using-routes#canipforward) on the VM instance where you installed WARP Connector. | ||
|
|
||
| ## AWS | ||
|
|
||
| For Amazon Web Services (AWS) deployments: | ||
| - Stop [source/destination checking](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html) on the EC2 instance where you installed WARP Connector. | ||
| - In your [subnet route table](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html), route all IPv4 traffic to the EC2 instance where you installed WARP Connector. For example, | ||
|
|
||
| | Destination | Target | | ||
| | ----------- | ------ | | ||
| | `0.0.0.0/0` | `eni-11223344556677889` | |
62 changes: 62 additions & 0 deletions
62
src/content/partials/cloudflare-one/tunnel/install-warp-connector.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| --- | ||
| {} | ||
| --- | ||
|
|
||
| import { Details } from "~/components"; | ||
|
|
||
| To install WARP Connector on a host machine: | ||
|
|
||
| 1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Network** > **Tunnels**. | ||
| 2. Select **Create a tunnel**. | ||
| 3. For the tunnel type, select **WARP Connector**. | ||
| 4. You will be prompted to turn on **Warp to Warp** and [**Override local interface IP**](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#override-local-interface-ip) if they are currently turned off. These settings allow Cloudflare to assign a unique <GlossaryTooltip term="CGNAT IP">CGNAT IP</GlossaryTooltip> to each WARP device and route traffic between them. | ||
| 5. Give the tunnel any name (for example, `Subnet-10.0.0.0/24`) and select **Create tunnel**. | ||
| 7. Select the operating system of your host machine. | ||
| 8. On your host machine, open a terminal window and run the commands shown in the Zero Trust dashboard. Those commands will install the WARP Connector, enable IP forwarding on the host, and connect WARP Connector to your Zero Trust organization. | ||
|
|
||
| :::note[Remote SSH connections] | ||
|
|
||
| If you are managing the deployment remotely over SSH, your connection may drop when you install the WARP Connector. Because the WARP connector immediately starts forwarding traffic to Cloudflare, the remote SSH server's traffic will now route to Cloudflare instead of via the server's public IP. To work around the issue: | ||
| - **Option 1**: In your WARP Connector [device profile](#3-recommended-create-a-device-profile), temporarily add the public IP of your local machine to the [Split Tunnel Exclude list](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/). | ||
|
|
||
| - **Option 2**: If your local machine is connected to Zero Trust (for example, via the WARP client), you can SSH to the <GlossaryTooltip term="CGNAT IP">CGNAT IP</GlossaryTooltip> of the WARP Connector. Traffic to the CGNAT IP must [route through the WARP tunnel](#4-configure-split-tunnels). | ||
| ::: | ||
|
|
||
| 9. (Optional) Configure IP forwarding: | ||
|
|
||
| <Details header="Enable IP forwarding to persist after reboot"> | ||
| ```sh | ||
| echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-warp-svc.conf | ||
| sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf | ||
| ``` | ||
| </Details> | ||
|
|
||
| <Details header="Configure IP forwarding with iptables"> | ||
| If you are setting up WARP Connector on a host with iptables enabled, make sure that your iptables FORWARD chain includes rules to accept the desired traffic. For testing and troubleshooting purposes, you can set the default policy for the WARP interface to ACCEPT: | ||
| ```sh | ||
| iptables -A FORWARD -i CloudflareWARP -J ACCEPT | ||
| iptables -A FORWARD -o CloudflareWARP -J ACCEPT | ||
| ``` | ||
| </Details> | ||
|
|
||
|
|
||
| 10. To verify that the WARP Connector is connected to Cloudflare: | ||
| ```sh | ||
| $ warp-cli status | ||
| Status update: Connected | ||
| Success | ||
| ``` | ||
|
|
||
| <Details header="Troubleshoot connection"> | ||
|
|
||
| If WARP is disconnected, try the following troubleshooting strategies: | ||
|
|
||
| - Run `warp-cli connect`. | ||
|
|
||
| - If your private network uses a firewall to restrict Internet traffic, ensure that it allows the [WARP ports and IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/). | ||
|
|
||
| - Review your [WARP daemon logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for information about why the connection is failing. | ||
|
|
||
| </Details> | ||
|
|
||
| WARP Connector software is now installed but not yet routing traffic. |