Network detection and settings profiles for the Cloudflare One agent

Network-aware traffic routing for Cloudflare One

Cloudflare One offers multiple ways to connect users and networks to its edge, including GRE and IPsec tunnels, Cloudflare Tunnel, and the Cloudflare One device agent. These on-ramps send traffic to Cloudflare for filtering via Secure Web Gateway and Data Loss Prevention, or to private resources hosted in a Zero Trust network.

There are cases where sending traffic to Cloudflare is undesirable, such as when a user is physically near a printer or server and should communicate directly over the local network. Previously, handling these scenarios required an administrator to manually adjust settings when users moved between locations, which didn't scale.

Cloudflare One now lets administrators define traffic handling rules that depend on the network a user is connected to. The device agent automatically detects the network and applies the appropriate profile, so end users don't need to change any settings when entering or leaving a managed network.

Applying profiles per location and per user

Organizations have varying needs across teams, and rigid network configuration breaks in real-world usage. Common examples include:

• Manufacturing or lab environments where users want Internet traffic sent to Cloudflare but prefer local traffic for sensitive equipment to stay on the private facility network.
• Enterprises migrating from legacy appliances to Cloudflare One that need a controlled, stepwise transition while maintaining existing on-premise infrastructure.

The release introduces configuration profiles, which are defined sets of options that apply based on rules. One type of rule detects whether a user is in a specific network location, while another bases the profile on user group membership. This means a developer whose local development work requires certain traffic exclusions can get different settings than others, or a user in a known office can have traffic steered to existing appliances during a migration.

Verifying managed networks with TLS certificates

To ensure a device is truly connected to a network you manage, the agent validates against a defined TLS endpoint inside that network. An administrator creates a TLS certificate, and Cloudflare matches it based on the SHA-256 hash of the certificate.

For instance, you could generate a local certificate:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout example.key -out example.pem -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com"

Then extract the SHA-256 thumbprint:

openssl x509 -noout -fingerprint -sha256 -inform pem -in example.pem | tr -d :

Which produces output like:

SHA256 Fingerprint=DD4F4806C57A5BBAF1AA5B080F0541DA75DB468D0A1FE731310149500CCD8662

Next, run a simple HTTP server inside your network so the agent can reach that certificate, as in the Python example below:

import ssl, http.server

class BasicHandler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type', 'text/html')
        self.end_headers()
        self.wfile.write(b'OK')
        return

server = http.server.HTTPServer(('0.0.0.0', 4443), BasicHandler)
sslcontext = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
sslcontext.load_cert_chain(certfile='./example.pem', keyfile='./example.key')
server.socket = sslcontext.wrap_socket(server.socket, server_side=True)
server.serve_forever()

Start the server with:

python3 myserver.py

After creating the TLS endpoint, register the network location in the dashboard:

1. Log in to your Zero Trust Dashboard and go to Settings → WARP Client.
2. Scroll to Network Locations, click Add new, and fill in the form with the fingerprint as the TLS Cert SHA-256 and the IP of the server running the script.

With the managed network defined, you can create profiles that apply within it:

1. In Settings → WARP Client, scroll down to Device Settings and create a new profile that includes the managed network as a location.

When the agent detects a network change event, such as waking up or switching Wi-Fi networks, it attempts to reach that internal endpoint to confirm it's inside the managed network. If the endpoint responds with a certificate matching the SHA-256 fingerprint, the device gets the appropriate settings. Administrators can verify this with warp-cli settings or warp-cli get-alternate-network from the command line.

Availability

Managed network detection and settings profiles are available now. Settings profiles work with any version of the agent from the past year, but network detection requires version 2022.12 or later. The agent runs on all major operating systems and can be deployed with existing device management tools, with downloads available under Settings → Downloads in the dashboard.