Skip to content

[CF1] firewall IPs clarification #23643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 5 commits into
base: production
Choose a base branch
from
Open

[CF1] firewall IPs clarification #23643

wants to merge 5 commits into from
+8 −1

Conversation

deadlypants1973
Copy link
Contributor

@deadlypants1973 deadlypants1973 commented Jul 14, 2025 •
edited
Loading

Summary

PCX-18179
related to #16062

Screenshots (optional)

Documentation checklist

  • The documentation style guide has been adhered to.
  • If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
  • Files which have changed name or location have been allocated redirects.

@deadlypants1973 deadlypants1973 requested review from ranbel and a team as code owners July 14, 2025 17:17
@hyperlint-ai Hyperlint AI
Copy link
Contributor

hyperlint-ai bot commented Jul 14, 2025

Howdy and thanks for contributing to our repo. The Cloudflare team reviews new, external PRs within two (2) weeks. If it's been two weeks or longer without any movement, please tag the PR Assignees in a comment.

We review internal PRs within 1 week. If it's something urgent or has been sitting without a comment, start a thread in the Developer Docs space internally.

PR Change Summary

Clarified the IP addresses associated with various Cloudflare domains in the firewall documentation.

  • Added notes about hardcoded IP addresses for specific Cloudflare domains.
  • Updated firewall requirements for connectivity-related domains.
  • Clarified that certain domains may resolve to different IPs but are hardcoded to specific addresses.

Modified Files

  • src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx
How can I customize these reviews?

Check out the Hyperlint AI Reviewer docs for more information on how to customize the review.

If you just want to ignore it on this PR, you can add the hyperlint-ignore label to the PR. Future changes won't trigger a Hyperlint review.

Note specifically for link checks, we only check the first 30 links in a file and we cache the results for several hours (for instance, if you just added a page, you might experience this). Our recommendation is to add hyperlint-ignore to the PR to ignore the link check for this PR.

@github-actions GitHub Actions
Copy link
Contributor

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern Owners
/src/content/docs/cloudflare-one/connections/connect-devices/ @kkrum, @kokolocomotion1, @ranbel, @cloudflare/pcx-technical-writing

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jul 14, 2025 •
edited
Loading

Preview URL: https://167bd949.preview.developers.cloudflare.com
Preview Branch URL: https://kate-fixes-warp-ips.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link Updated Link
https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/ https://kate-fixes-warp-ips.preview.developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/

@deadlypants1973 @ranbel
Apply suggestions from code review
f6ccb3e 
Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com>
maxvp
maxvp reviewed Jul 15, 2025
View reviewed changes
src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx
Comment on lines +32 to +33


Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

maxvp
maxvp reviewed Jul 15, 2025
View reviewed changes
src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx
@@ -98,7 +105,7 @@ The WARP client connects to the following IPs to verify connectivity inside of t

Because this check happens inside of the tunnel, you do not need to add these IPs to your firewall allowlist. However, since the requests go through Gateway, ensure that they are not blocked by a Gateway HTTP or Network policy.

Thought it may be visible in `warp-diag` and other logs, `connectivity.cloudflareclient.com` is used internally by WARP and should not be used in firewall policies.
If your firewall allows traffic only by domain, you may need to explicitly allow `connectivity.cloudflareclient.com`. Even though `connectivity.cloudflareclient.com` may resolve to different IP addresses, WARP overrides the resolved IPs with the IPs listed above. To avoid connectivity issues, ensure that the above IPs are permitted through your firewall.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be better to create a flexible partial for these sections of text?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ranbel ranbel ranbel left review comments

@maxvp maxvp maxvp approved these changes

Assignees

@ranbel ranbel

Labels
product:cloudflare-one size/xs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@deadlypants1973 @maxvp @ranbel