tunnel-to-wg
❔ About
To use Cloudflare Tunnel on your client devices, you need to use Cloudflare WARP client application. On mobile phones, you need to use Cloudflare One Agent.
For people who want a little more control, e.g. to automatically turn off the tunnel connection on certain Wi-Fi APs, or to turn on the tunnel connection on mobile network or certain Wi-Fi APs, you can "extract" the WireGuard configuration from Cloudflare WARP and use it in any client WireGuard application you use. Below is a detailed guide to "extract" the WireGuard configuration for your Cloudflare Tunnel.
🚀 Guide
This guide assumes you have already signed up for Cloudflare Zero Trust
- In
Zero Trust overview
page, selectSettings
in the left panel - In
Settings
page, selectNetwork
-
- In
Network
, you may turn on or offActivity Logging
- Under
Firewall
, enableProxy
and enableTCP
,UDP
andICMP
- In
- In
Settings
, selectWARP Client
- Select
Manage
for "Device enrollment permissions" - In the
Policies
tab, selectCreate new policy
- Add
Emails
as a "rule". (This email will be used later on to login into Zero Trust)
- Select
-
- Go back to the
WARP Client
page, and select "Configure" for theDefault
profile by clicking on the 3-dotted menu - Under
Split Tunnels
, select "Manage" forExclude IPs and domains
- Select all entries by clicking on the checkbox at the top-left of the table and press "Confirm delete" under the
Action
button - Go back to the
Default
profile page and select "Save profile"
- Go back to the
-
- Now, to get started, select "Create a tunnel" under the
Tunnel
page in the left panel - Under
Create a tunnel
, chooseSelect Cloudflared
- Choose an appropriate name for your tunnel. In this example, we'll choose
test
- Choose your environment and confirm it's
Healthy
when connected - In
Route tunnel
, select thePrivate networks
tab - For this example, we choose our local network's CIDR
- Select
Save tunnel
- Confirm the route has been created in the
Routes
page in the left panel
- Now, to get started, select "Create a tunnel" under the
🛠️ Usage
To add a device to your Cloudflare Tunnel:
- Go to tpm2dot0/wgcf-teams and download the latest release. Extract the
.zip
file and open your terminal. Start thewgcf-teams
binary (.exe
for Windows e.t.c.).
The binary will output a WireGuard configuration for your Cloudflare Tunnel. - Go to the webpage https://team-name.cloudflareaccess.com/ and select
Login
.team-name
would be whatever name you chose for your Zero Trust teamname. It can also be found atSettings
>Custom Pages
, underTeam domain
- Enter the email address we previously configured the policy with
- Check your email for a one-time PIN and enter it
- Once successfully authenticated, you will see the
Oops!
page. - Do not worry. In the address bar, change the address to https://team-name.cloudflareaccess.com/warp
- This will redirect you to a
Success!
page - Hit
F12
on your keyboard (or open Developer tools on your browser). Expandhead
and copy everything aftertoken=
and paste it into the terminal. - One last thing to do is update the
Endpoint
of the WireGuard configuration with162.159.193.1:2408
, which is the WARP ingress IP for WireGuard for Cloudflare WARP.
You have successfully "extracted" the WireGuard configuration for you Cloudflared Tunnel!
This process needs to be repeated for each device
🙌 Acknowledgements
This guide has been made by collecting information from the following sources:
- WireGuard into a private LAN via CloudFlare Tunnels
- poscat0x04/wgcf-teams (Original repository of the fork tpm2dot0/wgcf-teams )