cloudflare-one

Deploy cloudflared tunnels to publish private routes, enroll devices with the WARP client, and set split tunnel to Include mode for private CIDRs. Then create Access policies for private apps and validate route lookup, DNS resolution, and end-to-end access from a test device.

Access controls application authorization with identity-aware policies, while Gateway controls traffic inspection and filtering at DNS, network, and HTTP layers. Use both when requirements span identity-aware app access and web or network security.

Use Include mode for VPN replacement only, routing just private CIDRs through the client. Use Exclude mode for secure web gateway deployments where all traffic goes through Cloudflare except specific exclusions. Mode is per-profile and cannot be mixed.

API CASB is out-of-band and periodic, so it does not enforce inline. For inline control of actions in specific SaaS applications, use Gateway granular application controls in HTTP policies instead.

Creating an Access app alone is not enough for private hostnames. You need tunnel routes, DNS resolution via resolver policies, matching split tunnel entries, and an Allow policy since Access is default-deny.

Use Zero Trust Infrastructure Access when the device client is deployed, since it adds keystroke logging and short-lived SSH certificates. Use browser-rendered SSH, RDP, or VNC for contractors or unmanaged devices where the client cannot be installed.