Skip to content
Cloudflare Docs

Tips and best practices

VPC deployments

When setting up WARP Connector on a virtual private cloud (VPC), you may need to configure additional settings in the cloud service provider.

GCP

For Google Cloud Project (GCP) deployments, enable IP forwarding ↗ on the VM instance where you installed WARP Connector.

AWS

For Amazon Web Services (AWS) deployments:

  • Stop source/destination checking ↗ on the EC2 instance where you installed WARP Connector.

  • In your subnet route table ↗, route all IPv4 traffic to the EC2 instance where you installed WARP Connector. For example:

    DestinationTarget
    0.0.0.0/0eni-11223344556677889

WARP Connector with cloudflared

WARP Connector and cloudflared can run together on the same Linux host. This configuration is useful when you want to use WARP Connector as a gateway for your private network, while also using the cloudflared daemon to expose specific applications.

By design, WARP Connector captures all outbound traffic and routes it through Cloudflare's network. This prevents cloudflared from making its own required outbound connections to Cloudflare, causing the tunnel to fail with connection timeouts.

To allow cloudflared to connect, use Split Tunnels to explicitly exclude the Cloudflare Tunnel destinations from the WARP tunnel. For example, if you are using Split Tunnels in Exclude mode, add the following hostnames (or their corresponding IP ranges) to your Split Tunnel exclusion list:

  • region1.v2.argotunnel.com
  • region2.v2.argotunnel.com