+
+ The `CNAME` record for `www.example.com` would be:
+
+ ```txt
+ www.example.com CNAME www.example.com.cdn.cloudflare.net
+ ```
+
+
+3. At your authoritative DNS provider, remove any previously existing `A`, `AAAA`, or `CNAME` records referencing the hostnames you want to proxy through Cloudflare. For these hostnames, leave only the records pointing to `{your-hostname}.cdn.cloudflare.net`.
+
+## 3. Convert your Cloudflare zone
+
+1. Back at your Cloudflare zone, confirm that you have all the `A`, `AAAA`, or `CNAME` [DNS records](/dns/manage-dns-records/how-to/create-dns-records/) needed for the hostnames you pointed to `{your-hostname}.cdn.cloudflare.net` in the previous step. You can also delete any DNS records that have a different type, as they will no longer resolve once you convert your zone to a partial setup.
+2. Use the [Edit Zone endpoint](/api/operations/zones-0-patch) with `type` set to `partial` to convert the zone type. Existing DNS records will not be affected.
+3. On [**DNS** > **Records**](https://dash.cloudflare.com/?to=/:account/:zone/dns/records), get the **Verification TXT Record** and add it at your authoritative DNS provider.
+
+
+
+ A verification record for `sub.example.com` might be:
+
+ | Type | Name | Content |
+ | ---- | ------------------------------- | ------------------- |
+ | TXT | `cloudflare-verify.sub.example.com` | 966215192-518620144 |
+
+ If your authoritative DNS provider automatically appends DNS record `name` fields with your domain, make sure to only insert `cloudflare-verify` as the record name. Otherwise, it may result in an incorrect record name, such as `cloudflare-verify.sub.example.com.sub.example.com`.
+
+ After creating the record, you can use this [Dig Web Interface link](https://digwebinterface.com/?type=TXT&ns=auth&nameservers=) to search (`dig`) for `cloudflare-verify.` and validate if it is working.
+
+
+
+ :::note
+ The verification record must remain in place for as long as you want your partial setup to be active on Cloudflare.
+ :::
+
+## 4. Update nameservers
+
+At your domain registrar (or parent zone), [update the nameservers](/dns/nameservers/update-nameservers/). In a partial (CNAME) setup, only the nameservers of your external DNS provider should be listed.
+
+ - Remove any `secondary.cloudflare.com` nameservers if you used to have them.
+ - If you are also migrating to a new authoritative DNS provider, add your new nameservers.
\ No newline at end of file
diff --git a/src/content/docs/dns/zone-setups/conversions/index.mdx b/src/content/docs/dns/zone-setups/conversions/index.mdx
new file mode 100644
index 000000000000000..ffa8fa025f1cdf0
--- /dev/null
+++ b/src/content/docs/dns/zone-setups/conversions/index.mdx
@@ -0,0 +1,15 @@
+---
+pcx_content_type: navigation
+title: Zone setup conversions
+sidebar:
+ order: 10
+ group:
+ hideIndex: true
+ label: Zone conversions
+---
+
+import { DirectoryListing } from "~/components";
+
+You can perform the following zone setup conversions:
+
+| Ruleset | +Rule ID | +Legacy Rule ID | +Description | +Previous Action | +New Action | +Comments | +
|---|---|---|---|---|---|---|
| Cloudflare Specials | +
+ |
+ 100673 | +GoAnywhere - Remote Code Execution - CVE:CVE-2023-0669 | +Log | +Block | +New Detection | +
+
+The following example deploys the [Cloudflare OWASP Core Ruleset](/waf/managed-rules/reference/owasp-core-ruleset/) multiple times at the account level through the following execute rules:
+
+- First execute rule: Enable OWASP rules up to paranoia level 3 (PL3) and set the action to _Managed Challenge_.
+- Second execute rule: Enable OWASP rules up to PL4 and set the action to _Log_.
+
+This configuration gives you additional protection by enabling PL3 rules, but without blocking the requests, since higher paranoia levels are more prone to false positives.
+
+The second rule logs any matches for PL4 rules, the most strict set of rules in the ruleset, so that it does not affect live traffic. You could use this configuration to understand which traffic would be affected by PL4 rules.
+
+
+
+1. Deploy the Cloudflare OWASP Core Ruleset by following the [dashboard instructions](/waf/account/managed-rulesets/deploy-dashboard/#deploy-a-managed-ruleset), customizing the ruleset behavior using these settings:
+
+ - **OWASP Anomaly Score Threshold**: _Medium - 40 and higher_
+ - **OWASP Paranoia Level**: _PL3_
+ - **OWASP Action**: _Managed Challenge_
+
+2. Select **Deploy**.
+
+3. Repeat the deployment procedure for the OWASP ruleset, but with following ruleset configuration:
+
+ - **OWASP Anomaly Score Threshold**: _Medium - 40 and higher_
+ - **OWASP Paranoia Level**: _PL4_
+ - **OWASP Action**: _Log_
+
+Once you finish your configuration, the **Deployed managed rulesets** list will show two _Execute_ rules for the Cloudflare OWASP Core Ruleset.
+
+
+
+The following `POST` request for the [Create an account ruleset](/api/operations/createAccountRuleset) operation creates an [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_request_firewall_managed` phase at the account level. The ruleset includes two rules deploying the Cloudflare OWASP Core Ruleset twice with different configurations.
+
+```bash
+curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets" \
+--header "Authorization: Bearer " \
+--header "Content-Type: application/json" \
+--data '{
+ "name": "My ruleset",
+ "description": "Entry point ruleset for WAF managed rulesets (account)",
+ "kind": "root",
+ "phase": "http_request_firewall_managed",
+ "rules": [
+ {
+ "action": "execute",
+ "action_parameters": {
+ "id": "4814384a9e5d4991b9815dcfc25d2f1f",
+ "overrides": {
+ "categories": [
+ {
+ "category": "paranoia-level-4",
+ "enabled": false
+ }
+ ],
+ "rules": [
+ {
+ "id": "6179ae15870a4bb7b2d480d4843b323c",
+ "action": "managed_challenge"
+ }
+ ]
+ }
+ },
+ "expression": "cf.zone.plan eq \"ENT\"",
+ "description": "Execute OWASP ruleset at PL3 with Managed Challenge action"
+ },
+ {
+ "action": "execute",
+ "action_parameters": {
+ "id": "4814384a9e5d4991b9815dcfc25d2f1f",
+ "overrides": {
+ "rules": [
+ {
+ "id": "6179ae15870a4bb7b2d480d4843b323c",
+ "action": "log"
+ }
+ ]
+ }
+ },
+ "expression": "cf.zone.plan eq \"ENT\"",
+ "description": "Execute OWASP ruleset at PL4 with Log action"
+ }
+ ]
+}'
+```
+
+
+
+
(1 GB = 1,000,000,000 bytes) and not a gibibyte (GiB).
+[^2]: Durable Objects both bills and measures storage based on a gigabyte
(1 GB = 1,000,000,000 bytes) and not a gibibyte (GiB).
-3 Each incoming HTTP request or WebSocket *message* resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. +[^3]: Will be raised to 10 GB for general availability. -4 Will be raised to 10GB for general availability. - -
-
-| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
-| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
-| Gateway with WARP | All plans |
-
-| System | Availability |
-| -------- | ------------ |
-| Windows | ❌ |
-| macOS | ❌ |
-| Linux | ✅ |
-| iOS | ❌ |
-| Android | ❌ |
-| ChromeOS | ❌ |
-
-
-
-Cloudflare WARP Connector is a piece of software [^1] that enables site-to-site, bidirectional, and mesh networking connectivity without requiring changes to underlying network routing infrastructure. WARP Connector establishes a secure Layer 3 connection between a private network and Cloudflare, allowing you to:
-
-- Connect two or more private networks to each other.
-- Connect IoT devices that cannot run external software, such as printers and IP phones.
-- Filter and log server-initiated traffic, such as VoIP and SIP traffic.
-- Apply Zero Trust security policies based on the source IP of the request.
-
-
-
-As shown in the diagram, WARP Connector acts as a router for a subnet within the private network to on-ramp and off-ramp traffic through Cloudflare. All devices on the subnet can access any services connected to Cloudflare, and all devices connected to Cloudflare can access any services on the subnet. Each subnet runs a WARP Connector on a designated Linux machine (typically the default gateway router), but other devices on the network do not need to install software.
-
-This guide will cover how to connect two independent subnets, for example `10.0.0.0/24` and `192.168.1.0/24`.
-
-## Prerequisites
-
-- A Linux host [^2] on each subnet
-- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/).
-
-## 1. Create a service token
-
-[Create a new service token](/cloudflare-one/identity/service-tokens/#create-a-service-token) and copy its **Client ID** and **Client Secret**. WARP Connector will use this service token to authenticate with your Zero Trust organization.
-
-## 2. Add a device enrollment rule
-
-Next, create a device enrollment rule that allows the WARP Connector to authenticate:
-
-1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
-
-2. In the **Device enrollment** card, select **Manage**.
-
-3. Select **Add a rule**.
-
-4. Name the rule.
-
-5. For **Rule action**, select _Service Auth_.
-
-6. Configure the following fields:
-
- | Selector | Value |
- | ------------- | ---------------------- |
- | Service Token | `
- If the registration did not go through, try the following troubleshooting strategies:
-
- - Ensure that `mdm.xml` is formatted correctly and stored in `/var/lib/cloudflare-warp`.
- - Ensure that you have a [device enrollment rule](/cloudflare-one/connections/connect-networks/private-net/warp-connector/#2-add-a-device-enrollment-rule) with the _Service Auth_ action (not _Allow_).
- - Restart the WARP systemd service:
- ```sh
- sudo systemctl restart warp-svc.service
- ```
- - Clear an old registration and trigger WARP to re-register:
- ```sh
- sudo warp-cli registration delete
- ```
- - Review your [WARP daemon logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for information about why the registration is failing.
-
-
-
- 4. Verify that WARP is connected to Cloudflare:
-
- ```sh
- warp-cli status
- ```
-
- ```sh output
- Status update: Connected
- ```
-
-
-
-
- If WARP is disconnected, try the following troubleshooting strategies:
-
- * Run `warp-cli connect`.
-
- * If your private network uses a firewall to restrict Internet traffic, ensure that it allows the [WARP ports and IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/).
-
- * Review your [WARP daemon logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for information about why the connection is failing.
-
-
-
-:::caution[Warning]
-
-If you are managing the deployment remotely over SSH, your connection may drop when you register the WARP Connector. Because the connector immediately starts forwarding traffic to Cloudflare, the remote SSH server's traffic will be routed to Cloudflare instead of via the server's public IP and will timeout your existing connection. You can work around this issue by temporarily adding the public IP of your local machine to your [Split Tunnel Exclude list](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/).
-:::
-
-9. Select **Next**.
-10. In **CIDR**, enter the private IPv4 address range that you wish to route through this WARP Connector (for example, `10.0.0.0/24`). WARP Connector does not currently support IPv6 routes.
-
-:::note
-
-If you do not already have a private network range, you can choose a subnet from one of these [pre-defined CIDRs](https://datatracker.ietf.org/doc/html/rfc1918#section-3).
-:::
-
-11. Select **Save Tunnel**.
-
-12. In your [Split Tunnel configuration](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that your CIDR is routing through the WARP tunnel. For instructions on how to do this, refer to [Route private network IPs through WARP](/cloudflare-one/connections/connect-networks/private-net/cloudflared/#3-route-private-network-ips-through-warp).
-
- The `10.0.0.0/24` WARP Connector is now connected to Cloudflare.
-
- ```mermaid
- flowchart LR
- subgraph subnet1[Subnet 10.0.0.0/24]
- router1["Device running
- WARP Connector
- 10.0.0.1"]
- end
- router1<-->C((Cloudflare))
- ```
-
-13. Repeat these steps to install an additional WARP Connector on subnet `192.168.1.0/24`. You can reuse the service token, but you will need to create a new tunnel and MDM file.
-
- ```mermaid
- flowchart LR
- subgraph subnet1[Subnet 10.0.0.0/24]
- router1["Device running
- WARP Connector #1
- 10.0.0.1"]
- end
- subgraph subnet2[Subnet 192.168.1.0/24]
- router2["Device running
- WARP Connector #2
- 192.168.1.97"]
- end
- router1<-->C((Cloudflare))<-->router2
- ```
-
-## 5. Configure the host
-
-Run the following commands on the machine where you installed WARP Connector. You will need to configure the host machine on each subnet.
-
-1. Enable IP forwarding:
-
- ```sh
- sudo sysctl -w net.ipv4.ip_forward=1
- ```
-
-
-
- ```sh
- echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-warp-svc.conf
- sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf
- ```
-
-
-:::note[IP forwarding on VPC]
-
-If you are setting up WARP Connector on a [virtual private cloud (VPC)](https://www.cloudflare.com/learning/cloud/what-is-a-virtual-private-cloud/), you may need to enable IP forwarding on the VM instance.
-:::
-
-2. WARP's [virtual interface](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#virtual-interface) has a [maximum transmission unit (MTU)](https://www.cloudflare.com/learning/network-layer/what-is-mtu/) of 1280 bytes, whereas the standard Ethernet MTU is 1500 bytes. To avoid dropping packets that exceed 1280 bytes, clamp the [maximum segment size (MSS)](https://www.cloudflare.com/learning/network-layer/what-is-mss/) of the host machine so that incoming payloads are less than the MTU of WARP:
-
- ```sh
- sudo iptables -t mangle -A FORWARD -i CloudflareWARP -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- sudo iptables -t mangle -A FORWARD -o CloudflareWARP -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- ```
-
-
-
- 1. Create a bash script that writes the `iptable` rules to a file:
-
- ```bash
- echo '#!/bin/bash
- # Define your rules
- RULES=(
- "-A FORWARD -i CloudflareWARP -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"
- "-A FORWARD -o CloudflareWARP -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"
- )
-
- # Apply the rules
- for rule in "${RULES[@]}"; do
- iptables -t mangle $rule
- done
-
- # Save the rules
- iptables-save > /etc/iptables/rules.v4
- ' | sudo tee /usr/local/bin/apply_iptables_rules.sh
- ```
-
- 2. Run the script:
-
- ```sh
- sudo chmod +x /usr/local/bin/apply_iptables_rules.sh
- sudo /usr/local/bin/apply_iptables_rules.sh
- ```
-
- 3. Create a systemd service to restore the rules at startup:
-
- ```bash
- echo '[Unit]
- Description=Load iptables rules at startup
-
- [Service]
- Type=oneshot
- ExecStart=/sbin/iptables-restore < /etc/iptables/rules.v4
-
- [Install]
- WantedBy=multi-user.target
- ' | sudo tee /etc/systemd/system/iptables-persistent.service
- ```
-
-
-
-## 6. Route traffic through WARP Connector
-
-Depending on where you installed the WARP Connector, you may need to configure other devices on the subnet to route traffic through WARP Connector.
-
-### Option 1: Default gateway
-
-If you installed WARP Connector on your router, no additional configuration is necessary. All traffic will use the router as the default gateway.
-
-
-
-### Option 2: Alternate gateway
-
-If you have access to the router but installed WARP Connector on another machine, you can configure the router to forward traffic to the WARP Connector. This typically involves adding a static route for the destination IPs that you want to connect to through Cloudflare. Refer to your router's documentation for specific instructions on how to add an IP route.
-
-For example, if you are on subnet `10.0.0.0/24` and want to reach applications behind subnet `192.168.1.0/24`, add a rule that routes `192.168.1.0/24` to the WARP Connector IP (`10.0.0.100` in the diagram below). When a device sends a request to `192.168.1.0/24`, the router will first redirect the traffic to the WARP Connector machine. WARP Connector encrypts the traffic, changes its destination IP to the [WARP ingress IP](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip), and sends it back to the router. The router will now forward this encrypted traffic to Cloudflare.
-
-
-
-:::note
-
-Ensure that your routing rules do not forward the [WARP ingress IP](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) back to the WARP Connector.
-:::
-
-### Option 3: Intermediate gateway
-
-If you do not have access to the router, you will need to configure each device on the subnet to egress through the WARP Connector machine instead of the default gateway.
-
-
-
-#### Route all traffic
-
-You can configure all traffic on a device to egress through WARP Connector with its local source IP. All traffic will be filtered by your Gateway network policies.
-
-
+
+| [WARP modes](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
+| Gateway with WARP | All plans |
+
+| System | Availability |
+| -------- | ------------ |
+| Windows | ❌ |
+| macOS | ❌ |
+| Linux | ✅ |
+| iOS | ❌ |
+| Android | ❌ |
+| ChromeOS | ❌ |
+
+
+
+Cloudflare WARP Connector is a piece of software [^1] that enables site-to-site, bidirectional, and mesh networking connectivity without requiring changes to underlying network routing infrastructure. WARP Connector establishes a secure Layer 3 connection between a private network and Cloudflare, allowing you to:
+
+- Connect two or more private networks to each other.
+- Connect IoT devices that cannot run external software, such as printers and IP phones.
+- Filter and log server-initiated traffic, such as VoIP and SIP traffic.
+- Apply Zero Trust security policies based on the source IP of the request.
+
+
+
+As shown in the diagram, WARP Connector acts as a router for a subnet within the private network to on-ramp and off-ramp traffic through Cloudflare. All devices on the subnet can access any services connected to Cloudflare, and all devices connected to Cloudflare can access any services on the subnet. Each subnet runs a WARP Connector on a designated Linux machine (typically the default gateway router), but other devices on the network do not need to install software.
+
+To set up WARP Connector, refer to the guide for your use case:
+
+- **[Site-to-Internet](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/)**: Send requests from your private network to the Internet.
+- **[Site-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-site/)**: Send requests between two or more private networks.
+- **[User-to-site](/cloudflare-one/connections/connect-networks/private-net/warp-connector/user-to-site/)**: Allow WARP client devices to send requests to your private network.
+- **Internet-to-site**: Not supported by WARP Connector. To provide clientless access to applications on your private network, set up a [Cloudflare Tunnel with `cloudflared`](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/) and configure a [public hostname route](/cloudflare-one/connections/connect-networks/routing-to-tunnel/).
+
+[^1]: WARP Connector is an extension of the [WARP client](/cloudflare-one/connections/connect-devices/warp/).
diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx
new file mode 100644
index 000000000000000..0f00eb2485c9eb4
--- /dev/null
+++ b/src/content/docs/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet.mdx
@@ -0,0 +1,83 @@
+---
+pcx_content_type: how-to
+title: Connect private network to Internet
+sidebar:
+ label: Site-to-Internet
+ order: 3
+---
+
+import { Render, Details, GlossaryTooltip, TabItem, Tabs } from "~/components";
+
+This guide covers how to connect a private network to the Internet using WARP Connector. In this example, we will create a WARP Connector for subnet `10.0.0.0/24` and install it on `10.0.0.1`.
+
+```mermaid
+ flowchart LR
+ subgraph subnet1[Subnet 10.0.0.0/24]
+ device1["Device
+ 10.0.0.2"]-->router1["WARP Connector
+ 10.0.0.1"]
+ end
+ router1-->C((Cloudflare))-->I{Internet}
+```
+
+## Prerequisites
+
+- A Linux host [^1] on the subnet
+- Verify that your firewall allows inbound/outbound traffic over the [WARP IP addresses, ports, and domains](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/).
+
+## 1. Install a WARP Connector
+
+
+ ```sh
+ echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-warp-svc.conf
+ sudo sysctl -p /etc/sysctl.d/99-warp-svc.conf
+ ```
+
+
+
+ If you are setting up WARP Connector on a host with iptables enabled, make sure that your iptables FORWARD chain includes rules to accept the desired traffic. For testing and troubleshooting purposes, you can set the default policy for the WARP interface to ACCEPT:
+ ```sh
+ iptables -A FORWARD -i CloudflareWARP -J ACCEPT
+ iptables -A FORWARD -o CloudflareWARP -J ACCEPT
+ ```
+
+
+
+9. To verify that the WARP Connector is connected to Cloudflare:
+ ```sh
+ $ warp-cli status
+ Status update: Connected
+ ```
+
+
+
+ If WARP is disconnected, try the following troubleshooting strategies:
+
+ - Run `warp-cli connect`.
+
+ - If your private network uses a firewall to restrict Internet traffic, ensure that it allows the [WARP ports and IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/).
+
+ - Review your [WARP daemon logs](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/) for information about why the connection is failing.
+
+
+
+WARP Connector software is now installed but not yet routing traffic.
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/tunnel/warp-connector-intermediate-gateway.mdx b/src/content/partials/cloudflare-one/tunnel/warp-connector-intermediate-gateway.mdx
new file mode 100644
index 000000000000000..7c82d640cdff706
--- /dev/null
+++ b/src/content/partials/cloudflare-one/tunnel/warp-connector-intermediate-gateway.mdx
@@ -0,0 +1,7 @@
+---
+{}
+---
+
+If you do not have access to the router, you will need to configure each device on the subnet to egress through the WARP Connector machine instead of the default gateway.
+
+
\ No newline at end of file
diff --git a/src/content/partials/cloudflare-one/tunnel/warp-connector-linux-packages.mdx b/src/content/partials/cloudflare-one/tunnel/warp-connector-linux-packages.mdx
new file mode 100644
index 000000000000000..892d1feb0af43bd
--- /dev/null
+++ b/src/content/partials/cloudflare-one/tunnel/warp-connector-linux-packages.mdx
@@ -0,0 +1,5 @@
+---
+{}
+---
+
+Check the [system requirements](/cloudflare-one/connections/connect-devices/warp/download-warp/#linux). Package dependencies are the following: `curl`, `gpg`, `iptables`, `iptables-persistent`, `lsb-core`, and `sudo`.
diff --git a/src/content/partials/cloudflare-one/tunnel/warp-connector-route-all-traffic.mdx b/src/content/partials/cloudflare-one/tunnel/warp-connector-route-all-traffic.mdx
new file mode 100644
index 000000000000000..8d4e96fb65133ee
--- /dev/null
+++ b/src/content/partials/cloudflare-one/tunnel/warp-connector-route-all-traffic.mdx
@@ -0,0 +1,33 @@
+---
+{}
+---
+
+import { TabItem, Tabs } from "~/components";
+
+You can configure all traffic on a device to egress through WARP Connector with its local source IP. All traffic will be filtered by your Gateway network policies.
+
+
+
+**Compressed**
+
+- 7-Zip archive (`.7z`)
+- `bzip2` archive (`.bz2`)
+- GNU Gzip archive (`.gz`)
+- Microsoft Cabinet file (`.cab`)
+- Microsoft Compiled HTML Help file (`.chm`)
+- RAR archive (`.rar`)
+- `xz` archive (`.xz`)
+- ZIP archive (`.zip`)
+
+**Documents**
+
+- Microsoft Office/365 files
+ - Word document (`.doc`, `.docx`, `.docm`)
+ - Excel spreadsheet (`.xls`, `.xlsx`, `.xlsm`)
+ - PowerPoint presentation (`.ppt`, `.pptx`, `.pptm`)
+- PDF document (`.pdf`)
+
+**Executable**
+
+- Dynamic-link library (DLL) file (`.dll`)
+- Executable and Linkable Format (ELF) file (`.elf`)
+- Java archive (JAR) package (`.jar`)
+- Java class file (`.class`)
+- Mach object (Mach-O) file (`.macho`)
+- Microsoft Windows installer (`.msi`)
+- Microsoft Windows executable (`.exe`)
+
+**Image**
+
+- Adobe Photoshop document (`.psd`)
+- Bitmap image (`.bmp`)
+- GIF image (`.gif`)
+- Icon file (`.ico`)
+- JPEG image (`.jpg`, `.jpeg`)
+- PNG image (`.png`)
+- WebP image (`.webp`)
+
+**Other**
+
+- BitTorrent file (`.torrent`)
+
+
| UI name | API example |
| ------------------- | --------------------------------------------------- |
diff --git a/src/content/partials/cloudflare-one/gateway/policies/block-file-types.mdx b/src/content/partials/cloudflare-one/gateway/policies/block-file-types.mdx
index 887bcc1d73c6720..fda7276c0940617 100644
--- a/src/content/partials/cloudflare-one/gateway/policies/block-file-types.mdx
+++ b/src/content/partials/cloudflare-one/gateway/policies/block-file-types.mdx
@@ -1,13 +1,12 @@
---
{}
-
---
## Block file types
Block the upload or download of files based on their type.
-| Selector | Operator | Value | Logic | Action |
-| ------------------ | -------- | ------------------------------------- | ----- | ------ |
-| Upload File Type | in | Microsoft Office Word Document (docx) | And | Block |
-| Download File Type | in | PDF (pdf) | | |
+| Selector | Operator | Value | Logic | Action |
+| ------------------ | -------- | --------------------------------------- | ----- | ------ |
+| Upload File Type | in | _Microsoft Office Word Document (docx)_ | And | Block |
+| Download File Type | in | _PDF (pdf)_ | | |
From 0cc038b3bcfa9377e02296fe62c12242d030ceed Mon Sep 17 00:00:00 2001
From: marciocloudflare <83226960+marciocloudflare@users.noreply.github.com>
Date: Thu, 17 Oct 2024 09:46:05 +0100
Subject: [PATCH 043/110] added dash status (#17588)
---
.../express-cni/create-interconnects.mdx | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx b/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx
index 3911d50e8d517a6..01a0b45c989fce0 100644
--- a/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx
+++ b/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx
@@ -17,3 +17,13 @@ pcx_content_type: how-to
6. Review the options you have chosen, and select **Confirm order**.
7. Download the Letter of Authorization that Cloudflare created with your settings. You will need this document to contact your data center and provide them the IP addresses for the CNI connection.
8. Select **View Interconnects** to review the CNIs you have ordered.
+
+## Review interconnects
+
+The Cloudflare dashboard shows a list of all previously created interconnects, as well as useful information such as IP addresses, speed, type of interconnect, and status.
+
+Direct CNI connections are LACP (Link Aggregation Control Protocol) enabled and use LACP packets to negotiate with other ports. The [Status column](https://dash.cloudflare.com/?to=/:account/interconnects/all) in the dashboard shows three different status:
+
+- **Pending**: Pending shows up in new interconnects that are not yet active. This is expected and can occur for several reasons: the customer has not received their interconnect, the device is unresponsive, or physical adjustments may be required, such as swapping RX/TX fibers. The `Pending` status will go away after the customer completes the cross-connect.
+- **Active**: The interconnect port on the Customer Connectivity Router (CCR) has established a LACP session with the connected port on the customer device.
+- **Unhealthy**: The interconnect port on the CCR has lost a previously established LACP session with the connected port on the customer device. You can take general troubleshooting steps to solve the issue (such as checking cables and status lights for connectivity issues). If you are unable to solve the issue in this way, contact your account team.
\ No newline at end of file
From 692e9494737f23cb0e8e60e8bb798c30163bcff3 Mon Sep 17 00:00:00 2001
From: Victor Berchet +
## CF-EW-Via @@ -62,10 +61,8 @@ Alternatively, if you do not wish to receive the `True-Client-IP` header or any :::caution - If you are using Cloudflare in a stacked CDN and authenticating HTTP requests based on the IP address value in the `True-Client-IP` header, you must add a `True-Client-IP` header to your requests. If you do not add this header, its value can be spoofed to any value. - ::: ## X-Forwarded-For @@ -80,10 +77,8 @@ If you do not wish to receive the visitor's IP address in the `X-Forwarded-For` :::note - To restore the original visitor IP address at your origin web server, Cloudflare recommends that your logs or applications look at `CF-Connecting-IP` or `True-Client-IP` instead of `X-Forwarded-For`. `CF-Connecting-IP` and `True-Client-IP` both have a consistent format containing only one IP address. - ::: ## X-Forwarded-Proto @@ -104,19 +99,17 @@ Enterprise customers can also see all requests via [Cloudflare Logs](/logs/). The `CF-IPCountry` header contains a two-character country code of the originating visitor’s country. -Besides the [ISO-3166-1 alpha-2 codes](https://www.iso.org/iso-3166-country-codes.html), Cloudflare uses the following special country codes: +Besides the [ISO-3166-1 alpha-2 codes](https://www.iso.org/iso-3166-country-codes.html), Cloudflare uses the following special country codes: -* `XX` - Used for clients without country code data. -* `T1` - Used for clients using the Tor network. +- `XX` - Used for clients without country code data. +- `T1` - Used for clients using the Tor network. To add this header to requests, along with other HTTP headers with location information for the visitor's IP address, [enable the **Add visitor location headers** Managed Transform](/rules/transform/managed-transforms/configure/). :::note - The `CF-IPCountry` header is removed from requests made from a Worker to an origin that is not proxied behind Cloudflare. - ::: ## CF-Visitor @@ -141,10 +134,8 @@ The intended purpose of this header is to provide a means for recipients (for ex :::note - When configuring WAF custom rules, do not match on this header. These rules are applied before Cloudflare adds the `CF-Worker` header. Instead, use the [`cf.worker.upstream_zone`](/ruleset-engine/rules-language/fields/dynamic-fields/#cfworkerupstream_zone) dynamic field, which contains the same value and exists for the same purpose. - ::: ## Connection @@ -155,5 +146,5 @@ For incoming requests, the value of this header will always be set to `Keep-Aliv When using Spectrum with a TCP application, these headers are not visible at the origin as they are HTTP headers. If you wish to utilize these in your application, there are two options: -* Use an HTTP or HTTPS Spectrum app instead of TCP -* Use the [Proxy Protocol feature](/spectrum/how-to/enable-proxy-protocol/) +- Use an HTTP or HTTPS Spectrum app instead of TCP +- Use the [Proxy Protocol feature](/spectrum/how-to/enable-proxy-protocol/) diff --git a/src/content/docs/speed/optimization/content/brotli/content-compression.mdx b/src/content/docs/speed/optimization/content/brotli/content-compression.mdx index 5595fdf6a4619b2..cb5dc97920ea90c 100644 --- a/src/content/docs/speed/optimization/content/brotli/content-compression.mdx +++ b/src/content/docs/speed/optimization/content/brotli/content-compression.mdx @@ -116,19 +116,19 @@ Smaller responses will not be compressed, regardless of their content type. ## Content compression from origin servers to the Cloudflare network -When requesting content from your origin server, Cloudflare supports Gzip compression, Brotli compression, or no compression. +When requesting content from your origin server, Cloudflare supports Brotli compression, Gzip compression, or no compression. ```mermaid flowchart LR accTitle: Compressed responses sent from the origin server -accDescr: Cloudflare accepts responses from origin server using Gzip compression, Brotli compression, or no compression. +accDescr: Cloudflare accepts responses from origin server using Brotli compression, Gzip compression, or no compression. A[Visitor browser] B((Cloudflare)) C[(Origin server)] -A -.-> B == "Request
Accept-Encoding: gzip, br" ==> C -C == "Response
(Gzip / Brotli / No compression)" ==> B -.-> A +A -.-> B == "Request
Accept-Encoding: br, gzip" ==> C +C == "Response
(Brotli / Gzip / No compression)" ==> B -.-> A style A stroke-dasharray: 5 5 style B stroke: orange,fill: orange,color: black @@ -137,18 +137,18 @@ linkStyle 1,2 stroke-width: 2px linkStyle 0,3 stroke-width: 1px ``` -If your origin server responds to a Cloudflare request using Gzip/Brotli compression, we will keep the same compression in the response sent to the website visitor if: +If your origin server responds to a Cloudflare request using Brotli/Gzip compression, we will keep the same compression in the response sent to the website visitor if: -- You include a `content-encoding` header in your server response mentioning the compression being used (`gzip` or `br`). +- You include a `content-encoding` header in your server response mentioning the compression being used (`br` or `gzip`). - The visitor browser (or client) supports the compression algorithm. - You do not enable Cloudflare features that change the response content (refer to [Notes about end-to-end compression](#notes-about-end-to-end-compression) for details). -Cloudflare's reverse proxy can also convert between compressed formats and uncompressed formats. Cloudflare can receive content from your origin server with Gzip or Brotli compression and serve it to visitors uncompressed (or vice versa), independently of caching. +Cloudflare's reverse proxy can also convert between compressed formats and uncompressed formats. Cloudflare can receive content from your origin server with Brotli or Gzip compression and serve it to visitors uncompressed (or vice versa), independently of caching. -If you do not want a particular response from your origin to be encoded with Gzip/Brotli when delivered to website visitors, you can disable this by including a `cache-control: no-transform` HTTP header in the response from your origin web server. +If you do not want a particular response from your origin to be encoded with Brotli/Gzip when delivered to website visitors, you can disable this by including a `cache-control: no-transform` HTTP header in the response from your origin web server. :::caution -Cloudflare will take into consideration the `accept-encoding` header value in website visitors' requests when sending responses to those visitors. However, when requesting content from your origin server, Cloudflare will send a different `Accept-Encoding` header, supporting Gzip and Brotli compression. +Cloudflare will take into consideration the `accept-encoding` header value in website visitors' requests when sending responses to those visitors. However, when requesting content from your origin server, Cloudflare will send a different `Accept-Encoding` header, supporting Brotli and Gzip compression. ::: --- From 48e9976ec4b80b6d5ca84d3e8158a51f212d17a8 Mon Sep 17 00:00:00 2001 From: Olivier