Connect client devices

Client devices — laptops, phones, and desktops — join your Mesh network by installing the Cloudflare One Client and enrolling. Each device receives a Mesh IP and can immediately communicate with every other enrolled device and Mesh node.

• Device enrollment permissions are configured for your account. The Mesh setup wizard handles this automatically.

Connect a laptop or phone to your Mesh network:

To enroll your device using the client GUI:

1. Download and install the Cloudflare One Agent app.
2. Launch the Cloudflare One Agent app.
3. Select Next.
4. Review the privacy policy and select Accept.
5. Enter your team name.
6. Complete the authentication steps required by your organization.
7. After authenticating, select Install VPN Profile.
8. In the Connection request popup window, select OK.
9. If you did not enable auto-connect ↗, manually turn on the switch to Connected.

Do not use interactive CLI enrollment on a device without a browser. Instead, create a Service Auth enrollment policy. Configure the organization, auth_client_id, and auth_client_secret managed deployment parameters.

For platform-specific installation methods and configuration file locations, refer to Managed deployment. For a complete Linux example, refer to Deploy the Cloudflare One Client on headless Linux machines.

This method works on supported Windows, macOS, and Linux systems. Service-token devices use the shared identity non_identity@<team-name>.cloudflareaccess.com. Policies based on identity provider users or groups do not apply to these devices. To assign device profiles, use the expression identity.service_token_uuid == "<SERVICE_TOKEN_ID>", where <SERVICE_TOKEN_ID> is the service token resource UUID (id), not its auth_client_id. Place this Service Token selector before broader OS or email profiles. Use the shared non-identity email only when all Service Auth devices should match the profile.

After enrollment, the device receives a Mesh IP and connects to your Mesh network.

From a Windows, macOS, or Linux device, test TCP connectivity to a Mesh node or another client device. For example, test SSH:

nc -vz <MESH-IP> 22

Test-NetConnection <MESH-IP> -Port 22

Replace <MESH-IP> with the Mesh IP of a node (visible on the Mesh overview page ↗) or another enrolled device. Replace port 22 with the port used by your service. You can test HTTP services from a mobile browser. If you turned on the ICMP Gateway proxy, you can also run ping <MESH-IP> as a diagnostic check.

If the device profile routes www.cloudflare.com through WARP, verify the data path:

curl --silent https://www.cloudflare.com/cdn-cgi/trace | grep '^warp=on$'

if (-not (curl.exe --silent https://www.cloudflare.com/cdn-cgi/trace | Select-String '^warp=on$')) { exit 1 }

In Include mode, expect warp=off for destinations that are not in the include list. Use the successful connection to an included Mesh IP as the data-path check. Do not rely only on the success message from warp-cli: Mesh connectivity requires Traffic and DNS mode. In DNS-only mode, use warp-cli registration show only to verify enrollment. DNS-only mode cannot carry Mesh traffic.

Once connected, a client device can:

• Other client devices — Reach any enrolled device by its Mesh IP. No Mesh nodes involved.
• Mesh nodes — Reach any online node by its Mesh IP. SSH, database connections, API calls all work.
• Subnets behind nodes — Access hosts on private networks that a node advertises via CIDR routes (for example, printers, databases, or servers that cannot run the client).

All traffic is subject to your Gateway network policies, so you can control which users and devices can reach specific resources.

For client devices to reach Mesh IPs, the Mesh IP range must route through Cloudflare. How you configure this depends on your Split Tunnel mode.

The Mesh setup wizard updates the default device profile to route the Mesh IP range through Cloudflare. If you did not use the wizard, or if another profile applies to the device, verify that 100.96.0.0/12 (or your custom device IP range) is not in the exclude list or contained by a broader exclusion.

Depending on your Cloudflare networking configuration, you may need to remove additional IPs from your exclude list. For a list of IPs to check, refer to Reserved IP addresses.

In Include mode, add the following to your include list:

• 100.96.0.0/12 — Mesh IPs (device IPs)
• Any CIDR routes you have configured for your Mesh nodes

The IPv4 range used for hostname routing (172.64.128.0/20; requires MASQUE) and all Cloudflare One IPv6 ranges are automatically routed through Cloudflare and do not need to be added manually.

Some operating systems block inbound traffic from the Mesh IP range by default:

• Windows — Windows Firewall blocks inbound traffic from 100.96.0.0/12. Add a firewall rule that allows incoming requests from 100.96.0.0/12 for your desired protocols and ports.
• macOS / Linux — Most configurations allow this traffic by default. If you have custom firewall rules, ensure 100.96.0.0/12 is permitted.