Connect client devices

Client devices — laptops, phones, and desktops — join your Mesh network by installing the Cloudflare One Client and enrolling. Each device receives a Mesh IP and can immediately communicate with every other enrolled device and Mesh node.

Use the Mesh dashboard to find the Cloudflare One Client installer and organization name for your device:

The Add device workflow does not enroll the device or verify connectivity. For manual installation and enrollment instructions, refer to Download the Cloudflare One Client and Enroll a device.

Do not use interactive CLI enrollment on a device without a browser. Instead, create a Service Auth enrollment policy. Configure the organization, auth_client_id, and auth_client_secret managed deployment parameters.

For platform-specific installation methods and configuration file locations, refer to Managed deployment. For a complete Linux example, refer to Deploy the Cloudflare One Client on headless Linux machines.

This method works on supported Windows, macOS, and Linux systems. Service-token devices use the shared identity non_identity@<team-name>.cloudflareaccess.com. Policies based on identity provider users or groups do not apply to these devices. To assign device profiles, use the expression identity.service_token_uuid == "<SERVICE_TOKEN_ID>", where <SERVICE_TOKEN_ID> is the service token resource UUID (id), not its auth_client_id. Place this Service Token selector before broader OS or email profiles. Use the shared non-identity email only when all Service Auth devices should match the profile.

After enrollment, the device receives a Mesh IP and connects to your Mesh network.

The device then appears with Mesh nodes in the participant table under Networking > Mesh. Use the table to search for devices, filter participants by type or status, and open a device's Zero Trust details page. If more results are available, select Load more participants, Load more nodes, or Load more devices. New results append without replacing the participants already shown.

From a Windows, macOS, or Linux device, test TCP connectivity to a Mesh node or another client device. For example, test SSH:

nc -vz <MESH-IP> 22

Test-NetConnection <MESH-IP> -Port 22

Replace <MESH-IP> with the Mesh IP of a node (visible on the Mesh overview page ↗︎) or another enrolled device. Replace port 22 with the port used by your service. You can test HTTP services from a mobile browser. If you turned on the ICMP Gateway proxy, you can also run ping <MESH-IP> as a diagnostic check.

If the device profile routes www.cloudflare.com through WARP, verify the data path:

curl --silent https://www.cloudflare.com/cdn-cgi/trace | grep '^warp=on$'

if (-not (curl.exe --silent https://www.cloudflare.com/cdn-cgi/trace | Select-String '^warp=on$')) { exit 1 }

In Include mode, expect warp=off for destinations that are not in the include list. Use the successful connection to an included Mesh IP as the data-path check. Do not rely only on the success message from warp-cli: Mesh connectivity requires Traffic and DNS mode. In DNS-only mode, use warp-cli registration show only to verify enrollment. DNS-only mode cannot carry Mesh traffic.

Once connected, a client device can:

• Other client devices — Reach any enrolled device by its Mesh IP. No Mesh nodes involved.
• Mesh nodes — Reach any online node by its Mesh IP. SSH, database connections, API calls all work.
• Subnets behind nodes — Access hosts on private networks that a node advertises via CIDR routes (for example, printers, databases, or servers that cannot run the client).

All traffic is subject to your Gateway network policies, so you can control which users and devices can reach specific resources.

For client devices to reach Mesh IPs, the Mesh IP range must route through Cloudflare. How you configure this depends on your Split Tunnel mode.

The Mesh setup wizard updates the default device profile to route the Mesh IP range through Cloudflare. If you did not use the wizard, or if another profile applies to the device, verify that 100.96.0.0/12 (or your custom device IP range) is not in the exclude list or contained by a broader exclusion.

Depending on your Cloudflare networking configuration, you may need to remove additional IPs from your exclude list. For a list of IPs to check, refer to Reserved IP addresses.

In Include mode, add the following to your include list:

• 100.96.0.0/12 — Mesh IPs (device IPs)
• Any CIDR routes you have configured for your Mesh nodes

The IPv4 range used for hostname routing (172.64.128.0/20; requires MASQUE) and all Cloudflare One IPv6 ranges are automatically routed through Cloudflare and do not need to be added manually.

Some operating systems block inbound traffic from the Mesh IP range by default:

• Windows — Windows Firewall blocks inbound traffic from 100.96.0.0/12. Add a firewall rule that allows incoming requests from 100.96.0.0/12 for your desired protocols and ports.
• macOS / Linux — Most configurations allow this traffic by default. If you have custom firewall rules, ensure 100.96.0.0/12 is permitted.