Get started

Set up Cloudflare Mesh so your devices and servers can reach each other by private IP.

• A Cloudflare account ↗

• A Zero Trust organization with an active subscription, including the Free plan

• A laptop or phone to connect as a client device

• (Optional) A Linux server to deploy a Mesh node

  Linux server requirements

  OS version	RHEL 9 1, RHEL 10, Debian 12, Debian 13, Fedora 43, Fedora 44, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS
  Processor	AMD64 / x86-64 or ARM64 / AArch64
  HD space	75 MB
  Memory	35 MB
  Network interface type	Wi-Fi or LAN
  MTU	1381 bytes recommended 2

  Footnotes

  1. On RHEL 9 and later, enable the Extra Packages for Enterprise Linux (EPEL) ↗ repository (sudo dnf install epel-release) before installing cloudflare-warp. EPEL provides dependencies required by the client UI. ↩

  2. Minimum 1281 bytes with Path MTU Discovery ↩

Cloudflare Mesh requires that the Mesh node's device profile is configured to use MASQUE. Hostname routes, IPv6 CIDR routes, and high availability do not work if the device profile uses WireGuard instead.

Choose an enrollment method based on what you want to connect:

Choose the dashboard wizard or API and Terraform resources.

set -euo pipefail

PROFILE_RESPONSE=$(
	curl --fail-with-body --silent --show-error \
		"https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy" \
		--request POST \
		--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
		--header "Content-Type: application/json" \
		--data "$(jq -n \
			--arg match "identity.email == \"warp_connector@$TEAM_NAME.cloudflareaccess.com\"" \
			'{
				name: "Cloudflare Mesh nodes",
				description: "Route Mesh IP traffic through Cloudflare",
				enabled: true,
				precedence: 100,
				match: $match,
				service_mode_v2: {mode: "warp"},
				tunnel_protocol: "masque",
				include: [{address: "100.96.0.0/12", description: "Cloudflare Mesh IPs"}]
			}')"
)

jq -e '.success == true and (.result.id | type == "string")' \
	<<< "$PROFILE_RESPONSE" > /dev/null
PROFILE_ID=$(jq -r '.result.id' <<< "$PROFILE_RESPONSE")

set -euo pipefail

NODE_RESPONSE=$(
	curl --fail-with-body --silent --show-error \
		"https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/warp_connector" \
		--request POST \
		--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
		--header "Content-Type: application/json" \
		--data '{"name":"web-server"}'
)

jq -e '.success == true and (.result.id | type == "string")' \
	<<< "$NODE_RESPONSE" > /dev/null
NODE_ID=$(jq -r '.result.id' <<< "$NODE_RESPONSE")

TOKEN_RESPONSE=$(
	curl --fail-with-body --silent --show-error \
		"https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/warp_connector/$NODE_ID/token" \
		--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
)

MESH_NODE_TOKEN=$(jq -er \
	'select(.success == true) | .result | select(type == "string" and length > 0)' \
	<<< "$TOKEN_RESPONSE")

printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\nnet.ipv6.conf.all.accept_ra = 2\n' | sudo tee /etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf &&
sudo sysctl --system

curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg &&
echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(. /etc/os-release && echo $VERSION_CODENAME) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list &&
sudo apt-get update -qq && sudo apt-get install -y -qq cloudflare-warp

sudo warp-cli --accept-tos connector new <TOKEN> && sudo warp-cli --accept-tos connect

sudo dnf install -y epel-release

curl -fsSl https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo &&
sudo yum install -y cloudflare-warp

sudo warp-cli --accept-tos connector new <TOKEN> && sudo warp-cli --accept-tos connect

Connect a laptop or phone to your Mesh network:

To enroll your device using the client GUI:

1. Download and install the Cloudflare One Agent app.
2. Launch the Cloudflare One Agent app.
3. Select Next.
4. Review the privacy policy and select Accept.
5. Enter your team name.
6. Complete the authentication steps required by your organization.
7. After authenticating, select Install VPN Profile.
8. In the Connection request popup window, select OK.
9. If you did not enable auto-connect ↗, manually turn on the switch to Connected.

Once you see a Connected status, your device is on the mesh and receives its own Mesh IP.

From a Windows, macOS, or Linux client device, verify TCP connectivity to a Mesh node or another enrolled device. For example, test SSH:

nc -vz <MESH-IP> 22

Test-NetConnection <MESH-IP> -Port 22

Replace <MESH-IP> with the Mesh IP shown on the Mesh overview page. Replace port 22 with the port used by your service. You can test HTTP services from a mobile browser. A connected client or healthy connector status does not verify peer connectivity. Verify the application protocol you intend to use. If you turned on the ICMP Gateway proxy, you can also run ping <MESH-IP> as a diagnostic check.

Traffic from Mesh nodes appears in Gateway activity logs with the identity warp_connector@<your-team-name>.cloudflareaccess.com. Client device traffic appears in Gateway activity logs under the enrolled user's identity.

The dashboard wizard configures the following Cloudflare One settings automatically for new deployments. Non-wizard deployments must configure the same settings:

For automated deployments, the device profile documentation includes API and Terraform examples. Set service_mode_v2 = { mode = "warp" }, replace the generic example's wireguard protocol with tunnel_protocol = "masque", and configure Split Tunnels to route 100.96.0.0/12 through Cloudflare. Match Mesh nodes with identity.email == "warp_connector@<TEAM_NAME>.cloudflareaccess.com", and place this profile before broader profiles. The device enrollment documentation includes the Terraform enrollment-policy flow.

The cloudflare_zero_trust_device_settings ↗ resource supports unique device IPs and the TCP and UDP Gateway proxies:

resource "cloudflare_zero_trust_device_settings" "mesh" {
	account_id                        = var.cloudflare_account_id
	use_zt_virtual_ip                 = true
	gateway_proxy_enabled             = true
	gateway_udp_proxy_enabled         = true
}

The Terraform resource does not configure Allow all Cloudflare One traffic to reach enrolled devices or the ICMP Gateway proxy. Before connecting participants, turn on enrolled-device reachability in the dashboard. Turn on ICMP only if you require ping, traceroute, or another ICMP-based workflow.

If your account already has a Cloudflare One deployment, the setup wizard will not overwrite your existing configuration. Verify the following settings are enabled for Mesh to work:

• Device enrollment — At least one enrollment rule must exist so that devices and nodes can register with your account.
• Device profile for Mesh nodes — Your Mesh nodes need a device profile that routes the Mesh IP range (100.96.0.0/12) through Cloudflare. In Include mode, add the Mesh range. In Exclude mode, verify that no custom or legacy entry contains the Mesh range.
• Mesh connectivity — In your device profile settings, enable Allow all Cloudflare One traffic to reach enrolled devices.
• Unique device IPs — Enable Assign a unique IP address to each device so that each participant gets a routable Mesh IP.
• Client mode — Mesh nodes must run in Traffic and DNS mode. DNS-only or proxy-only modes are not supported.
• Traffic proxying — Turn on the Gateway proxy for the protocols you use. TCP and UDP carry Mesh services. ICMP supports diagnostic tools such as ping and traceroute.

• Node shows as Offline — On the server, run warp-cli status. If the output does not show Status update: Connected:
  • Run warp-cli connect.
  • If your private network uses a firewall to restrict Internet traffic, ensure that it allows the WARP ports and IPs.
  • Review your WARP daemon logs for information about why the connection is failing.
• Client device cannot reach Mesh IPs — Verify that your Split Tunnel configuration routes the Mesh IP range (100.96.0.0/12) through Cloudflare. For details, refer to Connect client devices.
• Windows firewall blocks Mesh traffic — Windows Firewall blocks inbound traffic from 100.96.0.0/12 by default. Add a firewall rule that allows incoming requests from this range for your desired protocols and ports.

For general client issues, refer to Troubleshoot the Cloudflare One Client.

• Connect client devices — Platform-specific installation details, Split Tunnel configuration, and firewall considerations.
• Run in Docker / Kubernetes — Deploy a Mesh node as a Docker container for Docker Compose, Kubernetes, and CI/CD pipelines.
• Add routes — Make an entire subnet behind your node reachable (databases, printers, other servers).
• Enable high availability — Run multiple replicas for production resilience.
• Tips and best practices — Cloud VPC configuration, updating the client, running alongside cloudflared.