You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/index.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ import { Render, Details} from "~/components";
29
29
</Details>
30
30
31
31
:::note
32
-
WARP Connector is not currently supported in accounts that have [Magic WAN](/magic-wan/) enabled.
32
+
Accounts on Legacy routing mode do not support WARP Connector when [Magic WAN](/magic-wan/)is enabled. Your account needs to be on the Cloudflare One Unified Routing for this to be supported. Contact your account team for more information.
33
33
:::
34
34
35
35
Cloudflare WARP Connector (beta) is a software client[^1] that enables site-to-site, bidirectional, and mesh networking connectivity without requiring changes to underlying network routing infrastructure. WARP Connector establishes a secure Layer 3 proxy between a private network and Cloudflare, allowing you to:
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/networks/connectors/wan-tunnels/configuration/manually/how-to/configure-routes.mdx
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,6 +23,9 @@ import { Render } from "~/components"
23
23
publicAsnMT: "",
24
24
productGatewayOrEgress: "WAN Tunnels with Gateway",
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/networks/connectors/wan-tunnels/configuration/manually/how-to/configure-tunnel-endpoints.mdx
Copy file name to clipboardExpand all lines: src/content/partials/networking-services/reference/traffic-steering.mdx
+76-1Lines changed: 76 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,8 @@ The Magic networking routing table is a virtual network overlay, private to your
26
26
- Magic Transit delivery for [DoS](/ddos-protection/) and <ahref={props.mFirewallURL}>{props.mFirewallName}</a> filtered Internet traffic, from the entry data center where the traffic ingressed, to your publicly addressed edge/border network.
27
27
-{props.productName} packet transport between Magic tunnels, interconnects, [Cloudflare Load Balancer](/load-balancing/), and [Zero Trust](/cloudflare-one/) connections such as <ahref={props.warpClientURL}>WARP Client</a>, <ahref={props.remoteBrowserURL}>Remote Browser Isolation</a>, <ahref={props.accessURL}>Access</a>, and <ahref={props.gatewayURL}>Gateway</a>.
28
28
29
-
The Magic routing table supports routing the {props.productName} traffic via anycast tunnels using <ahref={props.greIpsecReferenceURL}>GRE and Internet Protocol Security (IPsec)</a> or [Direct Cloudflare Network Interconnect (CNI)](/network-interconnect/). Entries can be added to the Magic routing table via static route configuration or via routes learned through BGP peering (only available over Direct CNI).
29
+
The Magic routing table supports routing the {props.productName} traffic via anycast tunnels using <ahref={props.greIpsecReferenceURL}>GRE and Internet Protocol Security (IPsec)</a> or [Direct Cloudflare Network Interconnect (CNI)](/network-interconnect/). Entries can be added to the Magic routing table via static route configuration or via routes learned through BGP peering (only available over Direct CNI).{props.magicWord!=="Magic Transit"&& (<> Traffic can also be routed automatically according to tracked flow state.</>)}
Cloudflare adjusts route priority when using AS prepending with communities. For example, if a route is tagged with `13335:60150`, the base priority is set to `150`. If you prepend your ASN twice, Cloudflare adds `10` for each prepend, increasing the route priority to `180`.
Automatic Return Routing (ARR) allows Cloudflare to track network flows from your Magic WAN connected locations, ensuring return traffic is routed back to the connection where it was received without requiring static or dynamic routes. This functionality requires the new [Unified Routing mode](#unified-routing-mode).
152
+
153
+
Instead of relying on static or dynamic routes for the return path, Magic WAN learns flows and remembers which connection a given flow arrived on. For any matching return traffic, Magic WAN uses this learned state to choose the next hop. This simplifies configuration, reduces the number of routes you must manage, and helps preserve symmetry for stateful traffic.
154
+
155
+
ARR provides the following benefits:
156
+
157
+
- **Removes the need for return routes**: For supported traffic types like new TCP connections (TCP SYN), UDP, and ICMP echo traffic, Magic WAN no longer requires a routing table entry to return traffic to the originating tunnel or interconnect.
158
+
- **Maintains symmetric routing for flows**: Responses to a given flow (for example, a TCP session) return over the same Magic WAN connection that carried the initial request — important for stateful firewalls and middleboxes.
159
+
- **Supports overlapping IP space**: Because the return path is tied to the learned connection state instead of a destination prefix in the routing table, Automatic Return Routing can support scenarios where different sites use overlapping private address space.
160
+
- **Operates per connection**: You decide which IPsec / GRE tunnels or network interconnects should use this behavior by enabling the feature on each connection.
161
+
`}
162
+
inline={false}
163
+
/>
164
+
165
+
<AnchorHeadingtitle="How ARR works"depth={3} />
166
+
<Markdown
167
+
text={`
168
+
When traffic that is eligible for Automatic Return Routing (ARR) arrives on a connection with ARR enabled, Magic WAN creates a flow entry that records:
169
+
170
+
- The source and destination IP addresses
171
+
- The relevant ports or identifiers, depending on the protocol
172
+
- The connection (tunnel or interconnect) that the traffic arrived on
173
+
174
+
For any subsequent packets that match this flow and require a next hop, Magic WAN:
175
+
176
+
1. Checks for a matching Automatic Return Routing flow.
177
+
2. If a match exists, routes the packet back to the same connection where the flow was learned, instead of consulting the Magic WAN routing table.
178
+
179
+
The initial request from your network to the Internet still uses your configured static or BGP routes. ARR only affects the return path for supported traffic after the flow is learned.
180
+
`}
181
+
inline={false}
182
+
/>
183
+
184
+
<AnchorHeadingtitle="Traffic and destinations affected"depth={3} />
185
+
<Markdown
186
+
text={`
187
+
Automatic Return Routing applies when:
188
+
189
+
- Traffic is received on a tunnel or network interconnect where the feature is enabled.
190
+
- The received traffic is one of:
191
+
- New TCP connections (TCP SYN)
192
+
- UDP
193
+
- ICMP echo (ping) requests
194
+
- The traffic is destined for:
195
+
- Internet egress through Cloudflare
196
+
- A WARP client
197
+
- A private network connected to Cloudflare via Cloudflare Tunnel
198
+
- A private network connected to Cloudflare via WARP Connector
199
+
200
+
In this initial release, ARR does not change routing for traffic between Magic WAN connections (for example, traffic from one Magic WAN tunnel or interconnect to another). That traffic continues to follow your configured Magic WAN routes.
The Unified routing mode is the newer Cloudflare One data plane that uses a single routing fabric for all supported connection types. Unified routing mode routes traffic across WARP, Cloudflare Tunnel, IPsec, GRE, and Cloudflare Network Interconnect (CNI) in a single system, making it easier to set up your Cloudflare One connections.
209
+
210
+
In the Magic WAN dashboard, routing mode appears where you manage Magic routes:
211
+
212
+
- **Routing mode: Unified** — your account is on the unified data plane and supports the new routing features.
213
+
- **Routing mode: Legacy** — your account uses the previous data plane and does not support all unified routing features.
214
+
`}
215
+
inline={false}
216
+
/>
217
+
</>
218
+
)}
219
+
145
220
## Scoping routes to specific regions
146
221
147
222
If you have multiple connectivity paths to a network segment and you would like to apply different route prioritization based on where the traffic arrives at the Cloudflare network, you can scope routes to specific Cloudflare data center regions. This is useful, for example, if you run your own anycast network and want your end-user traffic to arrive at your network location closest to the user. When a route is scoped to a Cloudflare data center region it will only show up in the Magic routing table in that region, along with all global routes that do not have any region scope. Route prioritization and ECMP logic apply across both region-scoped and global routes.
[Automatic Return Routing (beta)](${props.arrReferenceURL}) allows Cloudflare to track network flows from your Magic WAN connected locations, ensuring return traffic is routed back to the connection where it was received without requiring static or dynamic routes. This functionality requires the new [Unified Routing mode](${props.unifiedRoutingModeURL}).
1. Follow the [Add tunnels](${props.addTunnelsURL}) information to learn how to create an IPsec or GRE tunnel.
379
+
2. On the tunnel's options, select **Automatic return routing**.
380
+
3. Select **Add tunnels** to save your changes.
381
+
`}
382
+
inline={false}
383
+
/>
384
+
385
+
</TabItem> <TabItemlabel="API">
386
+
387
+
<Markdowntext={`Create a \`POST\` request to create an [IPsec](/api/resources/magic_transit/subresources/ipsec_tunnels/methods/create/) or [GRE](/api/resources/magic_transit/subresources/gre_tunnels/methods/create/) tunnel with ARR enabled. For example:`}inline={false} />
@@ -132,8 +133,9 @@ Beyond GRE and IPsec tunnels, you can also use Network Interconnect (CNI) to onb
132
133
13. The **Health check direction** defaults to **{props.biVsUniHealthCheck}** for {props.productName}. Refer to [Bidirectional vs unidirectional health checks](#bidirectional-vs-unidirectional-health-checks) for more details.
133
134
14._(Optional)_**Health check target** is the customer end of the tunnel. This field is only visible when the **Health check direction** is set to _Unidirectional_.
134
135
15._(Optional)_ We recommend you test your tunnel before officially adding it. To test the tunnel, select **Test tunnels**.
135
-
16. To add multiple tunnels, select **Add GRE tunnel** for each new tunnel.
136
-
17. After adding your tunnel information, select **Add tunnels** to save your changes.
136
+
{props.magicWord!=="Magic Transit"&& (<Markdowntext={`16. (Optional) Select **Automatic return routing** if you are setting up this tunnel for a site that only needs to send traffic to and receive responses from Cloudflare, and does not need to receive traffic from other sites in your WAN. Refer to [Configure Automatic Return Routing](${props.configureARRURL}) for more information.`}inline={false} />)}
137
+
<Markdowntext={`${props.magicWord!=="Magic Transit"?"17":"16"}. To add multiple tunnels, select **Add GRE tunnel** for each new tunnel.`}inline={false} />
138
+
<Markdowntext={`${props.magicWord!=="Magic Transit"?"18":"17"}. After adding your tunnel information, select **Add tunnels** to save your changes.`}inline={false} />
137
139
138
140
</Details>
139
141
@@ -170,6 +172,9 @@ Beyond GRE and IPsec tunnels, you can also use Network Interconnect (CNI) to onb
170
172
4. Select **Add tunnels**.
171
173
172
174
16. (Optional) Enable **Replay protection** if you have devices that do not support disabling it. Refer to <ahref={props.antiReplayPagePath}>Anti-replay protection</a> for more information.
175
+
{props.magicWord!=="Magic Transit"&& (<Markdowntext={`17. (Optional) Select **Automatic return routing** if you are setting up this tunnel for a site that only needs to send traffic to and receive responses from Cloudflare, and does not need to receive traffic from other sites in your WAN. Refer to [Configure Automatic Return Routing](${props.configureARRURL}) for more information.`}inline={false} />)}
176
+
<Markdowntext={`${props.magicWord!=="Magic Transit"?"18":"17"}. To add multiple tunnels, select **Add IPsec tunnel** for each new tunnel.`}inline={false} />
177
+
<Markdowntext={`${props.magicWord!=="Magic Transit"?"19":"18"}. After adding your tunnel information, select **Add tunnels** to save your changes.`}inline={false} />
0 commit comments