INTEGRITY Cloudflare Docs

← Cloudflare One / cloudflare-one / team-and-resources / devices / cloudflare-one-client / configure / route-traffic

Split Tunnels

Split Tunnels can be configured to exclude or include IP addresses or domains from going through the Cloudflare One Client (formerly WARP). This feature is commonly used to run the Cloudflare One Client alongside a VPN (in Exclude mode) or to provide access to a specific private network (in Include mode).

Because Split Tunnels controls what Gateway has visibility on at the network level, we recommend testing all changes before rolling out updates to end users.

Change Split Tunnels mode

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.
  2. Locate the device profile you would like to modify and select Configure.
  3. Scroll down to Split Tunnels.
  4. (Optional) To view your existing Split Tunnel configuration, select Manage. You will see a list of the IPs and domains Cloudflare Zero Trust excludes or includes, depending on the mode you have selected. We recommend making a copy of your Split Tunnel entries, as they will revert to the default upon switching modes.
  5. Under Split Tunnels, choose a mode:
    • Exclude IPs and domains — (Default) All traffic will be sent to Cloudflare Gateway except for the IPs and domains you specify.
    • Include IPs and Domains — Only traffic destined to the IPs or domains you specify will be sent to Cloudflare Gateway. All other traffic will bypass Gateway and will no longer be filtered by your network or HTTP policies. In order to use certain features, you will need to manually add Zero Trust domains.

  1. Add the following permission to your cloudflare_api_token ↗:

    • Zero Trust Write

  2. Choose a cloudflare_zero_trust_device_default_profile ↗ or cloudflare_zero_trust_device_custom_profile ↗ resource to modify, or create a new device profile.

  3. In your device profile, configure either the exclude or include argument. You cannot set both exclude and include in a given device profile.

    a. To manage Split Tunnel routes in Exclude mode, use the exclude argument:

    resource "cloudflare_zero_trust_device_custom_profile" "exclude_example" {
	account_id            = var.cloudflare_account_id
	name                  = "Custom profile in Split Tunnels Exclude mode"
	enabled               = true
	precedence            = 101
	service_mode_v2       = {mode = "warp"}
	match 								=  "identity.email == \"[email protected]\""

	exclude = [{
			address = "10.0.0.0/8"
			description = "Example route to exclude from WARP tunnel"
	}]
}

    In this example, all traffic will be sent to Cloudflare Gateway except for traffic destined to 10.0.0.0/8. To exclude the default IPs and domains recommended by Cloudflare, refer to Add a route.

    b. To manage Split Tunnel routes in Include mode, use the include argument:

    resource "cloudflare_zero_trust_device_custom_profile" "include_example" {
	account_id            = var.cloudflare_account_id
	name                  = "Custom profile in Split Tunnels Include mode"
	enabled               = true
	precedence            = 101
	service_mode_v2       = {mode = "warp"}
	match 								=  "identity.email == \"[email protected]\""

	include = [{
			address = "10.0.0.0/8"
			description = "Example route to include in WARP tunnel"
	}]
}

    In this example, only traffic destined to 10.0.0.0/8 will be sent to Cloudflare Gateway.

All clients with this device profile will now switch to the new mode and its default route configuration. Next, add or remove routes from your Split Tunnel configuration.

Add a route

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.

  2. Locate the device profile you would like to modify and select Configure.

  3. Under Split Tunnels, check whether your Split Tunnels mode is set to Exclude or Include.

  4. Select Manage.

  5. You can exclude or include routes based on either their IP address or domain. When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to Domain-based Split Tunnels.

    To add an IP address to Split Tunnels:

    1. Select IP Address.
    2. Enter the IP address or CIDR you want to exclude or include.
    3. Select Save destination.

    Traffic to this IP address is now excluded or included from the WARP tunnel.

    To add a domain to Split Tunnels:

    1. Select Domain.
    2. Enter a valid domain to exclude or include.
    3. Select Save destination.
    4. (Optional) If your domain does not have a public DNS record, create a Local Domain Fallback entry to allow a private DNS server to handle domain resolution.

    When a user goes to the domain, the domain gets resolved according to your Local Domain Fallback configuration (either by Gateway or by your private DNS server). Split Tunnels will then dynamically include or exclude the IP address returned in the DNS lookup.

  1. Add the following permission to your cloudflare_api_token ↗:

    • Zero Trust Write

  2. Choose a cloudflare_zero_trust_device_default_profile ↗ or cloudflare_zero_trust_device_custom_profile ↗ resource to modify, or create a new device profile.

  3. (Optional) Create a list of split tunnel routes that you can reuse across multiple device profiles. For example, you can declare a local value in the same module as your device profiles:

    split-tunnels.local.tf
    locals {
	global_exclude_list = [
		# Default Split Tunnel entries recommended by Cloudflare
		{
			address     = "ff05::/16"
		},
		{
			address     = "ff04::/16"
		},
		{
			address     = "ff03::/16"
		},
		{
			address     = "ff02::/16"
		},
		{
			address     = "ff01::/16"
		},
		{
			address     = "fe80::/10"
			description = "IPv6 Link Local"
		},
		{
			address     = "fd00::/8"
		},
		{
			address     = "255.255.255.255/32"
			description = "DHCP Broadcast"
		},
		{
			address     = "240.0.0.0/4"
		},
		{
			address     = "224.0.0.0/24"
		},
		{
			address     = "192.168.0.0/16"
		},
		{
			address     = "192.0.0.0/24"
		},
		{
			address     = "172.16.0.0/12"
		},
		{
			address     = "169.254.0.0/16"
			description = "DHCP Unspecified"
		},
		{
			address     = "100.64.0.0/10"
		},
		{
			address     = "10.0.0.0/8"
		}
	]
}

  4. In the device profile, exclude or include routes based on either their IP address or domain:

    device-profiles.tf
    resource "cloudflare_zero_trust_device_custom_profile" "example" {
	account_id            = var.cloudflare_account_id
	name                  = "Example custom profile with split tunnels"
	enabled               = true
	precedence            = 101
	service_mode_v2       = {mode = "warp"}
	match                 =  "identity.email == \"[email protected]\""

	exclude = concat(
		# Global entries
		local.global_exclude_list,

		# Profile-specific entries
		[
			{
				address = "192.0.2.0/24"
				description = "Example IP to exclude from WARP"
			},
			{
				host = "example.com"
				description = "Example domain to exclude from WARP"
			}
		]
	)
}

    When possible we recommend adding an IP address instead of a domain. To learn about the consequences of adding a domain, refer to Domain-based Split Tunnels.

It may take up to 10 minutes for newly updated settings to propagate to devices.

We recommend keeping the Split Tunnels list short, as each entry takes time for the client to parse. In particular, domains are slower to action than IP addresses because they require on-the-fly IP lookups and routing table / local firewall changes. A shorter list will also make it easier to understand and debug your configuration. For information on device profile limits, refer to Account limits.

When to use Split Tunnels

Use Split Tunnels when you need to bypass Gateway entirely for a site or allow traffic through the firewall that the Cloudflare One Client creates. Common scenarios include:

When not to use Split Tunnels

Do not exclude a site from Split Tunnels if you want to see the traffic in your Gateway logs. In particular, we do not recommend using Split Tunnels to:

Routes for Split Tunnels Include mode

Many Cloudflare Zero Trust services rely on traffic going through the Cloudflare One Client, such as device posture checks and device client session durations. If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function.

Cloudflare Zero Trust domains

If you are using Split Tunnels in Include mode, you must include the following domains:

Cloudflare Zero Trust IP addresses

Block page

If you are using Split Tunnels in Include mode and have DNS policies with the block page enabled, you must include the IPs that blocked domains will resolve to. Unless you are using a dedicated or BYOIP resolver IP the block page will resolve to:

Team domain

In Traffic only mode, you cannot add domains to Split Tunnels. If you are using Split Tunnels in Include mode, you must include the IPs that resolve to <your-team-name>.cloudflareaccess.com instead:

Automatically managed ranges

The Cloudflare One Client automatically includes the following ranges in Include mode, and automatically removes them from any exclusions configured in Exclude mode. This happens at runtime on the device: the ranges are not stored in your device profile, do not appear in the Split Tunnels list in the dashboard, and do not need to be added manually.

You do not need to add these ranges to your Split Tunnels configuration. If you are troubleshooting a feature that depends on one of these ranges (for example, hostname routing or Cloudflare Mesh), you can still add the range explicitly as a diagnostic step, but this should not be required for normal operation.

If your account uses a custom initial resolved IP range instead of the default 172.64.128.0/20, add that custom range to your Split Tunnels configuration.

Domain-based Split Tunnels

Domain-based split tunneling has a few ramifications you should be aware of before deploying in your organization:.

Valid domains

Split tunnel domain Matches Does not match
example.com exact match of example.com subdomains such as www.example.com
example.example.com exact match of example.example.com example.com or subdomains such as www.example.example.com
*.example.com subdomains such as www.example.com and sub2.sub1.example.com example.com

Platform differences

Domain-based Split Tunnels work differently on mobile clients than on desktop clients. If both mobile and desktop clients will connect to your organization, it is recommended to use Split Tunnels based on IP addresses or CIDR, which work the same across all platforms.

Windows, Linux and macOS

Clients on these platforms work by dynamically inserting the IP address of the domain immediately after it is resolved into the routing table for split tunneling. This allows the desktop clients to support wildcard domain prefixes (for example, *.example.com), not just a singular domain (like example.com or www.example.com).

iOS, Android and ChromeOS

Due to platform differences, mobile clients can only apply Split Tunnels rules when the tunnel is initially started. This means:

Remove a route

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.
  2. Locate the device profile you would like to modify and select Edit.
  3. Under Split Tunnels, select Manage.
  4. Find the IP address or hostname in the list and select the Action button. From the dropdown, select Delete.

It may take up to 10 minutes for newly updated settings to propagate to devices.

If you need to revert to the default Split Tunnel entries recommended by Cloudflare, select Restore default entries.