Skip to content

Commit 325779a

Browse files
committed
refine split tunnel section
1 parent 42b121d commit 325779a

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

src/content/docs/cloudflare-one/networks/routes/reserved-ips.mdx

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,15 @@ Private Load Balancer IPs are virtual addresses allocated to [Private Network Lo
6666

6767
## WARP Split Tunnel configuration
6868

69-
If your deployment includes WARP devices, ensure that the reserved IP ranges required by your deployment are routed through WARP [Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/). Configuration depends on whether your [Split Tunnels mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude IPs and domains** or **Include IPs and domains**.
69+
For deployments that use the [WARP client](/cloudflare-one/team-and-resources/devices/warp/), ensure that the [reserved IP ranges](#ipv4-ranges) required by your deployment route through [WARP Split Tunnels](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/) to Cloudflare. Configuration depends on whether your [Split Tunnels mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude IPs and domains** or **Include IPs and domains**.
7070

7171
### Exclude mode (default)
72-
In **Exclude IPs and domains** mode, the CGNAT range (`100.64.0.0/10`) is excluded from WARP routing by default. You must delete the reserved IP ranges from your Split Tunnels list, or the associated features will stop working.
7372

74-
Cloudflare recommends [adding back the IPs](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) that are not explicitly used for Cloudflare One services. This reduces the risk of conflicts with existing private network configurations that may use CGNAT address space.
73+
In **Exclude IPs and domains** mode, the CGNAT range (`100.64.0.0/10`) is excluded from WARP routing by default. You must delete the [reserved IP ranges](#ipv4-ranges) from your Split Tunnels exclude list, or the associated features will stop working.
7574

76-
Use the calculator below to determine which IP ranges to add back based on the Cloudflare One features you use. For example, if you use WARP-to-WARP connectivity (`100.96.0.0/12`) and Gateway initial resolved IPs (`100.80.0.0/16`),
75+
Cloudflare recommends adding back the IPs that are not explicitly used for Cloudflare One services. This reduces the risk of conflicts with existing private network configurations that may use CGNAT address space.
76+
77+
You can use the calculator below to determine which IP ranges to add back based on the Cloudflare One features you use. For example, if your deployment requires [Gateway initial resolved IPs](#gateway-initial-resolved-ips) (`100.80.0.0/16`) and [WARP device IPs](#warp-device-ips) (`100.96.0.0/12`), delete `100.64.0.0/10` from Split Tunnels and add back `100.64.0.0/12`, `100.81.0.0/16`, `100.82.0.0/15`, `100.84.0.0/14`, `100.88.0.0/13`, and `100.112.0.0/12`.
7778

7879
<SubtractIPCalculator
7980
client:load
@@ -85,4 +86,4 @@ Cloudflare recommends [adding back the IPs](/cloudflare-one/networks/connectors/
8586

8687
### Include mode
8788

88-
In **Include IPs and domains** mode, only traffic for the included routes is sent to Cloudflare. You must explicitly add the reserved IP ranges that your deployment depends on. For example, if you use WARP-to-WARP connectivity, include `100.96.0.0/12` (or your [custom device IP subnet](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-ips/)).
89+
In **Include IPs and domains** mode, only traffic for the included routes is sent to Cloudflare. You must explicitly add the reserved IP ranges that your deployment depends on. For example, if you use [hostname routing or egress policy host selectors](#gateway-initial-resolved-ips), add `100.80.0.0/16` to your Split Tunnels include list.

0 commit comments

Comments
 (0)