Introducing WARP Connector: paving the path to any-to-any connectivity

A new on-ramp for private network traffic

Cloudflare has made the WARP Connector publicly available, extending the Cloudflare One SASE platform with a new option for site-to-site and mesh-style connectivity. The connector is built on the WARP client and acts as a virtual router for subnets, letting traffic on- and off-ramp through Cloudflare's network without requiring disruptive changes to existing infrastructure.

The connector addresses a gap in Cloudflare's Zero Trust connectivity story. Previously, the primary way to link infrastructure to Cloudflare was the cloudflared Tunnel connector. While effective for many proxy use cases, its Layer 4 design was optimized for requests to origin services, not for handling traffic originating from those services. Because cloudflared source-NATs all proxied requests, the origin server never sees the true client IP address. That breaks scenarios such as SIP-based VoIP, where a server needs to initiate connections to users' softphones, or CI/CD systems that must push notifications and updates to stakeholders. In both cases, the infrastructure needs to originate outbound traffic, something a proxy-oriented connector cannot naturally support.

Why WARP was the right foundation

Rather than build a new connector from scratch, Cloudflare chose to extend the existing WARP client. The decision came down to architectural fit. WARP creates a virtual network interface on the host, which can route IP traffic bidirectionally through a WireGuard/MASQUE tunnel to the Cloudflare edge. This design preserves the true source IP of clients, something the cloudflared approach could not offer. It also enables the connector to operate as a listener on the network, supporting server-initiated flows.

The WARP Connector can be deployed on a default gateway without additional routing changes, or static routes can be configured for specific CIDRs that should traverse WARP. These routes can be set on the gateway or on individual hosts within a subnet.

Use cases that fit the new model

The connector supports a range of private network services that require bidirectional or server-initiated communication. Among them are Microsoft System Center Configuration Manager (SCCM), Active Directory updates, VOIP/SIP infrastructure, and CI/CD environments with complex pipeline interactions. The connector can run alongside cloudflared and Magic WAN, or as a standalone remote access and site-to-site connector.

VOIP and softphone traffic

VOIP services typically rely on a SIP server inside the private network to broker calls using the last known IP address of the end user. When traffic is proxied anywhere along the path, participants often receive only partial voice or data signals. WARP Connector lets organizations apply granular Zero Trust policies to these services while maintaining the bidirectional flows SIP requires.

CI/CD pipelines

Consider a typical Kubernetes deployment pipeline. A developer commits code, triggering a webhook on the CI/CD server. Images get built and deployed through test, staging, and production stages. Notifications are sent back to developers and QA engineers via webhooks from the CI/CD server when images are ready in test or staging environments. With WARP Connector, these servers can stay private and communicate with developers and QA through Cloudflare, with granular access policies applied across the DevOps ecosystem.

Source IP visibility

Organizations running Active Directory or non-web application servers often need the true source IP for auditing, rate-limiting, or ACL-based policies. Because it does not introduce a NAT boundary, WARP Connector preserves that visibility, allowing perimeter firewalls to log actual client addresses rather than connector IPs.

Dashboard changes and rollout

The Cloudflare One Dashboard now includes a "Network" tab, which becomes the home for the Cloudflare Tunnel UI. A new "Routes" tab sits next to "Tunnels" and provides an organizational view of virtual networks, tunnels, and associated routes. This view is designed to help operators answer questions about which tunnel serves a particular host, how a CIDR can be accessed, and where overlapping CIDRs exist across virtual networks.

WARP Connector is currently deployable on Linux hosts. Users can select "create a Tunnel" in the dashboard and choose between cloudflared or WARP. Support for additional platforms is planned. Cloudflare says its near-term focus is simplifying deployment to match cloudflared's experience, and improving high availability through redundancy and failover mechanisms.