WARP clients become network endpoints with Cloudflare's new peer-to-peer fabric

Cloudflare is extending its Zero Trust networking platform with WARP-to-WARP connectivity, a feature that lets any device enrolled in an organization's WARP deployment reach any other WARP-enabled device directly. Previously, connecting two WARP clients required bridging them through a Cloudflare Tunnel, GRE tunnel, or IPsec tunnel. Now, with a single click, IT administrators can SSH into employee machines, developers can share local web servers with teammates, and servers can initiate traffic back to laptops—all without additional tunnel infrastructure.

The feature is being rolled out as a closed beta. Interested organizations can sign up for early access, and the capability will be available on all plans at no additional cost once generally available.

How WARP-to-WARP fits into the Cloudflare One model

Cloudflare One's architecture treats connectivity as composable on-ramps and off-ramps. WARP, Tunnel, GRE, and IPsec all serve as ways to get traffic onto Cloudflare's network, where Zero Trust policies are enforced before traffic is routed to its destination. The most common deployment pattern to date has been WARP-to-Tunnel: end-user devices on-ramp via WARP, policies are applied, and traffic off-ramps through a Cloudflare Tunnel into a private network. That pattern handles north-south traffic flows—public-to-private communication.

WARP-to-WARP addresses the east-west gap: private-to-private traffic between devices that are both on-ramped through WARP. Cloudflare now tracks the network location of each WARP device, much as it does for Tunnel connections. When one WARP device sends traffic to another, the traffic is relayed across Cloudflare's backbone using Argo Smart Routing and delivered through the same transport that routes IP packets to the appropriate WARP client.

Critically, traffic between WARP devices still passes through the Secure Web Gateway, so it is subject to the same filtering and auditing as any other traffic on the network. The gateway can upgrade and downgrade traffic between purely routed IP packets and fully proxied TLS connections, depending on the protocol. For SSH sessions, this means command logging and auditing apply just as they would for traffic heading to a Tunnel-connected resource.

Use cases for direct device connectivity

Three practical scenarios illustrate what the feature unlocks:

  • Remote IT support: Administrators can reach any WARP-enrolled employee device via SSH, RDP, SMB, or other services without needing a VPN or a Tunnel in front of each machine. Every action is secured, audited, and pushed to the organization's logs.
  • Developer collaboration: A developer can share a private IP assigned by Cloudflare with a teammate halfway around the world. The teammate's device treats the target machine as if it were on the same physical LAN.
  • Reverse-direction connectivity: A WARP-enabled virtual machine at a hosting provider can initiate `rsync` or `scp` sessions back to a laptop—something WARP-to-Tunnel alone couldn't support. Any server on WARP can now push traffic toward the rest of the Zero Trust organization.

WARP-to-WARP works alongside existing private network on-ramps, so organizations can mix and match connectivity options without rearchitecting their deployments.

Getting started

To join the closed beta, add your name to the waitlist at Cloudflare's signup page. Once enrolled, the setup requires only that at least two devices are joined to a Cloudflare Zero Trust organization and running the latest WARP client. From there, Zero Trust policies control which devices can reach which other devices. The full workflow—creating a Zero Trust account, installing the WARP agent, enrolling devices, and defining policies—takes minutes.