Private network access
Advertise a private network route
Route one narrow CIDR through cloudflared and understand the return path, overlap, and forwarding requirements.
8 minute lesson
A private route tells Cloudflare: packets for this CIDR go through this tunnel. Add the smallest private CIDR that contains the intended resource:
cloudflared tunnel route ip add 10.0.0.0/29 practice-app
cloudflared tunnel route ip showA /29 covers eight addresses. Resist advertising 10.0.0.0/8 because it is easier. A narrow route limits what a compromised client can even attempt to reach, and it keeps your routing table readable when you add more tunnels later.
The connector is a router now
The connector host must already reach that subnet, and the resource must have a valid return path. Test the first half from the connector host itself:
ping -c 2 10.0.0.5If the connector cannot reach the address, the tunnel cannot either. The return path is the half people forget: the target must route its replies back through the connector host. When the connector sits on the same subnet as the target, this works by itself. When it routes to a different subnet, the reply path needs a route or NAT, or you get requests that arrive and responses that vanish.
Watch for overlap
Avoid overlapping client-local networks during the first lab. If you advertise 192.168.1.0/24 and your test user’s home LAN uses the same range, their traffic never leaves the house. This is also why the client’s default configuration excludes common private ranges — you have to deliberately include the range you advertise, which is covered when you enroll clients.
Pick a range nobody’s home router uses.
Route is not permission
A route makes the destination available to Cloudflare’s private network path; it does not grant every user permission to use it. Authorization is a separate policy decision, and it comes in the next lesson. Keep the two ideas apart: routing answers “can packets get there,” policy answers “who may send them.”
Advertise a disposable prefix, enroll one test client, and trace packets in both directions before adding DNS. Run tcpdump on the target while the client connects: you should see the request arrive and the reply leave through the same path.
Lesson completed