Private network access
Advertise a private network route
Route one narrow CIDR through cloudflared and understand the return path, overlap, and forwarding requirements.
A private route tells Cloudflare: packets for this range of addresses go through this tunnel. Add the smallest range that contains the resource you need:
cloudflared tunnel route ip add 10.0.0.0/29 practice-app
cloudflared tunnel route ip showA /29 covers eight addresses. Resist advertising 10.0.0.0/8 because it’s easier. A narrow route limits what a compromised client can even try to reach. It also keeps your routing table readable when you add more tunnels later.
The connector is a router now
Once you advertise a route, the connector host forwards packets. So it must already reach that subnet itself, and the target must know how to send replies back. Test the first half from the connector host:
ping -c 2 10.0.0.5If the connector can’t reach the address, the tunnel can’t either. No amount of Cloudflare configuration fixes a host that has no path to the target.
The return path is the half people forget. The target must route its replies back through the connector host. When the connector sits on the same subnet as the target, this works by itself. When it sits on a different subnet, the reply needs a route or NAT on the target side. Otherwise you get requests that arrive and responses that vanish, which is a confusing thing to debug the first time.
Watch for overlap
Avoid ranges that overlap with your test user’s local network. If you advertise 192.168.1.0/24 and their home router uses the same range, their traffic never leaves the house. This is also why the client excludes common private ranges by default. You have to include the range you advertise on purpose, which we do when we enroll clients.
Pick a range nobody’s home router uses.
Route is not permission
A route makes the destination reachable through Cloudflare’s private network path. It does not grant every user permission to use it. Authorization is a separate policy decision, and it comes in the next lesson. Keep the two ideas apart: routing answers “can packets get there”, policy answers “who may send them”.
Advertise a disposable prefix, enroll one test client, and trace packets in both directions before you add DNS. Run tcpdump on the target while the client connects. You should see the request arrive and the reply leave through the same path.
Lesson completed