Enroll the remote device and route traffic

Install the Cloudflare One Client on the remote device. In our lab that is the laptop playing the role of your remote worker.

Log in to Cloudflare Zero Trust with the team name and the allowed identity. The client asks for the team name first, then opens a browser window for the identity check. Only the email your enrollment rule allows gets through. If a different email fails here, that is the rule doing its job.

Use Traffic and DNS mode for the complete lab. The client has several operating modes, and some of them only filter DNS queries without carrying packets. This lab needs both traffic and name resolution flowing through Cloudflare. Anything less produces confusing half-working behavior, where names resolve but connections time out.

Now the routing question. Cloudflare excludes RFC 1918 private ranges by default. That default exists for a good reason. It keeps home printers, NAS boxes, and local networks working for every enrolled device. But your lab resource lives inside one of those excluded ranges, so right now its traffic never leaves the laptop’s local network.

Open Split Tunnels and make the exact lab IP or CIDR go through the client. In the default Exclude mode, that means editing the entry that covers your lab range. Remove the broad 10.0.0.0/8 exclusion, then re-add the narrower pieces you still want excluded, leaving your lab address routed.

Here is what the exclude list looks like before and after, for a lab host at 10.0.1.100:

before   10.0.0.0/8       excluded (covers the lab host too)

after    10.0.0.0/24      excluded
         10.0.1.0/26      excluded
         10.0.2.0/23      excluded
         ...              (every other piece of 10.0.0.0/8, up to 10.128.0.0/9)
         10.0.1.100/32    routed, because nothing excludes it anymore

You don’t have to compute those pieces by hand. Any CIDR calculator can split a range around one address.

Then verify from the remote device. Do it on a different network than the resource, because a phone hotspot makes the test honest:

ping -c 2 10.0.1.100
# 64 bytes from 10.0.1.100: icmp_seq=1 ttl=63 time=42.1 ms

A reply from a hotspot proves the packet went through Cloudflare and the connector. A reply from the office Wi-Fi proves nothing, since the laptop could reach the host directly.

Keep the routed range narrow. A broad private range can overlap the user’s home network and send local devices to the wrong place. The laptop suddenly cannot print at home because 192.168.1.9 is being shipped into the tunnel.

When a routed IP is unreachable from an enrolled device, check the Split Tunnels list before anything else. Forgetting this adjustment is the single most common failure in the whole lab. The device is connected, the connector is healthy, every dashboard light is green, and the packets quietly stay local.