Cloudflare Docs

Cloudflare Docs

Cloudflare Zero Trust

Overview
Get started
Tutorials
Identity
One-time PIN login
SSO integration

Generic SAML 2.0
SAML | Centrify
Azure AD®
SAML | OneLogin
SAML | Jumpcloud
SAML | Active Directory®
PingFederate®
PingOne®
SAML | Citrix ADC
SAML | Signed AuthN requests
SAML | Keycloak
Generic OIDC
OneLogin OIDC
Centrify
Facebook
GitHub
Google
Google Workspace
LinkedIn
Okta
Okta (SAML)
Yandex

Device posture

Gateway
WARP
Azure AD
Carbon Black
CrowdStrike
Microsoft Endpoint Manager
SentinelOne
Tanium
Uptycs
Workspace ONE
Mutual TLS
OS Version
Device serial numbers
Application Check
File Check
Domain Joined
Disk Encryption
Firewall

User management

Access groups
Session management
Seat management
Short-lived certificates
Access JWTs

Validate JWTs
Application token

Service tokens
Login page
Connections
Cloudflare Tunnel

Get started

Set up a tunnel

Via the dashboard

Configuration

Via the command line

Configuration

Configuration file
Ingress rules
Cloudflared parameters

Run a tunnel
Run as a service

Linux
macOS
Windows

Useful commands

Tunnel availability and failover
Tunnel permissions
Useful terms
Downloads
GitHub

Private networks

Connect private networks
Private hostnames and IPs
Tunnel Virtual Networks

Public hostnames

DNS record
Load balancers

Tunnel administration

AWS
Azure
GCP
Kubernetes

Do more with Tunnel

Secure the server
Ports and IPs
Migrate legacy tunnels
Quick Tunnels
Tunnel hosting requirements

License

Copyrights

Connect devices

WARP

First-time setup
Download WARP
Install the Cloudflare certificate
Deploy WARP

Managed deployment

Partners

Hexnode
Intune
Jamf
JumpCloud
Kandji

Parameters

Manual deployment
WARP with firewall
WARP with legacy VPN

Bypass WARP

Local Domain Fallback
Split Tunnels

WARP settings
Remove WARP

Agentless options

DNS

Add locations

DNS resolver IPs and hostnames

DNS over HTTPS
DNS over TLS
Native OS
Router setup

HTTP
Applications
Add web applications

SaaS applications
Self-hosted applications
Cloudflare dashboard SSO application

Add non-HTTP applications

Arbitrary TCP

Scan SaaS applications

Available integrations

Google Workspace
Microsoft 365

Add bookmarks
App Launcher
Policies
Secure Web Gateway

Get started

DNS filtering
Network filtering
HTTP filtering

DNS policies

Common policies
Check that a policy is working
DNS Categories

Network policies

Common policies
SSH proxy and command logs

HTTP policies

Common policies
Global rules
Order of enforcement
Data Loss Prevention

Predefined DLP Profiles

Incompatible traffic
Tenant control
AV scanning

Applications and app types
Identity-based policies
Block page
WARP session duration
Lists
Dedicated egress IPs

Access

Policy management
Require Purpose Justification
CORS
External Evaluation rules
Application paths
Enforce MFA
Temporary authentication

Browser Isolation

Accessibility
Setup
Known limitations
Clientless Web Isolation
Extensions
Browser Isolation with firewall
Analytics
Shadow IT Discovery
Gateway Analytics
User logs
Zero Trust logs

Gateway Activity logs

Manage PII

Access Audit logs
Tunnel Audit logs
API and Terraform
Access API examples
Scoped API tokens
Terraform
Glossary
Roles and permissions
Technical limitations
FAQ

Do more with Tunnel