Cloudflare expands Zero Trust access beyond the browser

Cloudflare is today launching a private network offering that lets teams connect to internal IP ranges without traditional VPN infrastructure. The feature is an extension of Cloudflare Access, which has focused on securing web applications. Now organizations can extend similar connectivity and controls to non-web traffic, such as RDP sessions, SSH connections, and SMB file access.

The announcement follows Developer Week and is aimed at teams that want Zero Trust security without sacrificing the convenience of a private network. The offering is free for organizations with 50 or fewer team members as part of the Cloudflare for Teams free tier.

Beyond the limits of browser-based access

Cloudflare Access has helped thousands of organizations replace VPNs with a Zero Trust model for web applications. That approach works well because browsers handle authentication and HTTP requests make Zero Trust checks straightforward. A user authenticates, Cloudflare issues a JSON Web Token stored as a cookie, and subsequent requests to other applications in the same browser are seamless. No client software is required beyond the browser itself.

But that model does not translate to non-web applications. SSH, RDP, and other protocols handle authentication differently, and some have no authentication at all. Exposing those services directly to the Internet is risky, so organizations hide them behind a private network. That leaves users toggling a VPN and administrators maintaining appliances, with performance as an added tax.

Cloudflare previously attempted a solution using its cloudflared connector on both ends. The connector in the data center created a WebSocket connection to Cloudflare's edge, and a client-side instance of cloudflared exposed a local port that forwarded traffic through that WebSocket. The approach worked but required end users to run manual commands for each service and adjust configuration per client, making it impractical for teams without dedicated IT staff.

How the new private network works

The new architecture combines Cloudflare Tunnel with the WARP client to offer the usability of a VPN without the appliance overhead.

On the server side, cloudflared establishes an outbound-only TCP connection from a data center or public cloud environment to two nearby Cloudflare data centers. Administrators configure the tunnel to represent a range of IPs where their applications run. Those could be RFC 1918 ranges or any addresses that cloudflared can reach. Teams can run redundant tunnels for availability or separate tunnels to connect different IP ranges.

On the client side, end users install Cloudflare WARP and authenticate with their identity provider into the same Cloudflare account that administers the tunnels. A single button connects the device via a Wireguard tunnel to Cloudflare's network. By default, WARP excludes RFC 1918 traffic; administrators can reconfigure split tunneling so the agent picks up traffic bound for those ranges instead.

When a user's client application reaches for an internal IP, the WARP agent routes that traffic to Cloudflare's edge. The edge locates the tunnel that represents the enrolled IP range. If the user connects to the same data center as the tunnel, Cloudflare proxies a TCP connection directly. If the user lands on a different data center, Cloudflare's smart routing finds the fastest path to the tunnel. Once connected, cloudflared operates like a bastion inside the environment and connects to the services at those addresses.

Gateway security for all traffic

Beyond private network access, the WARP agent can secure all Internet-bound traffic. Teams can use it to filter DNS queries using Cloudflare's 1.1.1.1 resolver, blocking phishing sites, malware, and other threats. The agent can also serve as a Secure Web Gateway, tunneling all Internet traffic over Wireguard to a nearby data center where Cloudflare inspects HTTP requests. Administrators can build rules controlling file uploads, scan for viruses, or restrict access to parts of websites.

Getting started

Setting up the private network requires four steps:

  1. Install and authenticate cloudflared in your environment with cloudflared tunnel login.
  2. Create a named tunnel, e.g., cloudflared tunnel create grafana.
  3. Configure the IP range the tunnel represents with cloudflared tunnel route ip add 100.64.0/10.
  4. Start the tunnel with cloudflared tunnel run grafana.

Then configure WARP's split tunnel settings to include the private IP traffic and enroll your device to enable connectivity.

Roadmap

Today, security teams can enforce rules determining who can enroll and from which devices. Cloudflare plans to add more granular Zero Trust rules that apply to specific IPs or IP ranges. The current flow supports client-to-server connections only; support for east-west connections between cloudflared and other parts of Cloudflare One routing is forthcoming.