← Cloudflare One / cloudflare-one / networks / connectors / cloudflare-mesh

Get started

Set up Cloudflare Mesh so your devices and servers can reach each other by private IP.

• A Cloudflare account ↗

• A laptop or phone to connect as a client device

• (Optional) A Linux server to deploy a Mesh node

  Linux server requirements

  OS version	RHEL 9 1, RHEL 10, Debian 12, Debian 13, Fedora 43, Fedora 44, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS
  Processor	AMD64 / x86-64 or ARM64 / AArch64
  HD space	75 MB
  Memory	35 MB
  Network interface type	Wi-Fi or LAN
  MTU	1381 bytes recommended 2

  Footnotes

  1. On RHEL 9 and later, enable the Extra Packages for Enterprise Linux (EPEL) ↗ repository (sudo dnf install epel-release) before installing cloudflare-warp. EPEL provides dependencies required by the client UI. ↩

  2. Minimum 1281 bytes with Path MTU Discovery ↩

Cloudflare Mesh requires that the Mesh node's device profile is configured to use MASQUE. Hostname routes, IPv6 CIDR routes, and high availability do not work if the device profile uses WireGuard instead.

The setup wizard configures your account for Mesh networking and optionally guides you through creating a Mesh node. This is a one-time setup.

1. In the Cloudflare dashboard, go to Networking > Mesh.

   Go to Mesh ↗

2. Select Add a node.

3. Enter a name for your node (for example, web-server or staging-db).

4. Select Create node.

5. (Optional) If you have a Linux server, run the install commands shown in the dashboard to bring the node online. If you do not have a server ready, select I'll connect later — you can install the node at any time from the node detail page.

   Installation commands

   curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg &&
   echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(. /etc/os-release && echo $VERSION_CODENAME) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list &&
   sudo apt-get update -qq && sudo apt-get install -y -qq cloudflare-warp &&
   printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\nnet.ipv6.conf.all.accept_ra = 2\n' | sudo tee /etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf &&
   sudo sysctl --system

   sudo warp-cli connector new <TOKEN> && sudo warp-cli connect

   On RHEL 9 and later, enable the Extra Packages for Enterprise Linux (EPEL) repository before installing cloudflare-warp. EPEL provides dependencies required by the Cloudflare One Client UI:

   sudo dnf install -y epel-release

   Then install the package:

   curl -fsSl https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo &&
   sudo yum install -y cloudflare-warp &&
   printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\nnet.ipv6.conf.all.accept_ra = 2\n' | sudo tee /etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf &&
   sudo sysctl --system

   sudo warp-cli connector new <TOKEN> && sudo warp-cli connect

6. Select View node details to complete the setup wizard.

If you installed the node, it should appear as Online on the Mesh overview page along with its assigned Mesh IP. If the node does not come online, refer to Troubleshooting.

Connect a laptop or phone to your Mesh network:

To enroll your device using the client GUI:

1. Download and install the Cloudflare One Agent app.
2. Launch the Cloudflare One Agent app.
3. Select Next.
4. Review the privacy policy and select Accept.
5. Enter your team name.
6. Complete the authentication steps required by your organization.
7. After authenticating, select Install VPN Profile.
8. In the Connection request popup window, select OK.
9. If you did not enable auto-connect ↗, manually turn on the switch to Connected.

Once you see a Connected status, your device is on the mesh and receives its own Mesh IP.

From your client device, verify you can reach a Mesh node or another enrolled device:

ping <MESH-IP>

Replace <MESH-IP> with the Mesh IP of a node or another device (visible on the Mesh overview page). You can also SSH, connect to a database, or call an API — any TCP, UDP, or ICMP traffic works.

Traffic from Mesh nodes appears in Gateway activity logs with the identity warp_connector@<your-team-name>.cloudflareaccess.com. Client device traffic appears in Gateway activity logs under the enrolled user's identity.

When you create your first Mesh node, the setup wizard automatically provisions several Cloudflare One settings so you do not have to configure them manually:

If your account already has a Cloudflare One deployment, the setup wizard will not overwrite your existing configuration. Verify the following settings are enabled for Mesh to work:

• Device enrollment — At least one enrollment rule must exist so that devices and nodes can register with your account.
• Device profile for Mesh nodes — Your Mesh nodes need a device profile that uses Include mode with the Mesh IP range (100.96.0.0/12) included. If your nodes use Exclude mode instead, remove 100.64.0.0/10 (the default CGNAT exclusion) from the exclude list.
• Mesh connectivity — In your device profile settings, enable Allow all Cloudflare One traffic to reach enrolled devices.
• Unique device IPs — Enable Assign a unique IP address to each device so that each participant gets a routable Mesh IP.
• Client mode — Mesh nodes must run in Traffic and DNS mode. DNS-only or proxy-only modes are not supported.
• Traffic proxying — Enable the Gateway proxy for TCP, UDP, and ICMP so that Mesh traffic can flow between devices.

• Node shows as Offline — On the server, run warp-cli status. If the output does not show Status update: Connected:
  • Run warp-cli connect.
  • If your private network uses a firewall to restrict Internet traffic, ensure that it allows the WARP ports and IPs.
  • Review your WARP daemon logs for information about why the connection is failing.
• Client device cannot reach Mesh IPs — Verify that your Split Tunnel configuration routes the Mesh IP range (100.96.0.0/12) through Cloudflare. For details, refer to Connect client devices.
• Windows firewall blocks Mesh traffic — Windows Firewall blocks inbound traffic from 100.96.0.0/12 by default. Add a firewall rule that allows incoming requests from this range for your desired protocols and ports.

For general client issues, refer to Troubleshoot the Cloudflare One Client.

• Connect client devices — Platform-specific installation details, Split Tunnel configuration, and firewall considerations.
• Run in Docker / Kubernetes — Deploy a Mesh node as a Docker container for Docker Compose, Kubernetes, and CI/CD pipelines.
• Add routes — Make an entire subnet behind your node reachable (databases, printers, other servers).
• Enable high availability — Run multiple replicas for production resilience.
• Tips and best practices — Cloud VPC configuration, updating the client, running alongside cloudflared.