p/setup-cloudflare-warp-to-warp-on-mikrotik/

[giscus[bot]]

p/setup-cloudflare-warp-to-warp-on-mikrotik/

Setup Cloudflare Zero Trust and port forwarding on RouterOS

https://www.animmouse.com/p/setup-cloudflare-warp-to-warp-on-mikrotik/

[kijokobojong]

hi anim mouse

Thank you for the tutorial, quite interesting and I have tried it and it works. but there is a little problem, the question is:

1. How to ensure that the WG cfg that has been generated will be connected to our zerotrust (WARP) account?

because I have connected but not connected to my zerotrust account. This involves the following steps:

Generate Cloudflare Zero Trust WireGuard configuration

1. Download wgcf-teams.
2. Open wgcf-teams. wgcf-teams
3. Login to Cloudflare Zero Trust using this guide.
4. Paste the JWT token on the prompt.

in points number 3 and 4,

2. How do I enter the token into the WG config, so that it is connected to my zerotrust account?

I need this to remote from outside the network, assuming WARP to WARP.

[AnimMouse]

Thank you for the tutorial

You're welcome.

How to ensure that the WG cfg that has been generated will be connected to our zerotrust (WARP) account?

The WireGuard configuration that has been generated will be connected to your Zero Trust account unless revoked. The private key inside the WireGuard config that you got from wgcf-teams is the one that authenticates you to Cloudflare, and it will never change.

How do I enter the token into the WG config, so that it is connected to my zerotrust account?

It seems like wgcf-teams has changed its browser opening behavior, so I have edited this tutorial to reflect the new version of wgcf-teams.

After you opened wgcf-teams, a command prompt will appear, this is where you will input the JWT token, and then wgcf-teams will create a WireGuard config including the private key from that token. It is not the token to be entered directly to WireGuard config.

[zsbai]

Hi anim mouse, I've encounterd a problem when using wgcf-teams. After I successfully connecting to my zero trust, I am trying to find my internal IP in My Teams -> Devices. I found that all devices using wgcf-teams have the same device name "--" and Model "iPad13,8". It is hard to distinguish them and get the correct internal IP. Do you have any suggestions?

[AnimMouse]

For me, I use a unique email address for every device on my domain name using Cloudflare Email Routing, like for example [email protected] and [email protected].
There is also a new beta feature in Cloudflare WARP called "Override local interface IP" that assigns your internal IP directly to your device instead of 172.16.0.2. I'm currently testing this feature if this works on wgcf-teams.

[AnimMouse]

The "Override local interface IP" works on my MikroTik, you only have to assign your internal IP in the configuration like 100.96.0.1/12 instead of 172.16.0.2, and you don't need to specify the route since a dynamic route will automatically be created. Since this is still a beta feature, I will wait until it become GA and update this tutorial.

[zsbai]

"Override local interface IP" works fine for me. I thought I could change the internal IP to others, but it seems like only the assigned IP in webpage works. Thank you very much for your help. I look forward to your new update of this tutorial.

[pakkalin]

Hi Anim Mouse,
For this method can I route L2 network over Warp-to-Warp like tailscale or zerotier?

[AnimMouse]

Yes, it is possible to route an L2 network like Tailscale or ZeroTier over Cloudflare Warp-to-Warp, but that is nonsense, you are essentially tunneling a tunnel inside a tunnel. Cloudflare Warp-to-Warp works just like Tailscale or ZeroTier, no need to tunnel inside a tunnel.

[pakkalin]

Thankyou for your reply
But I mean routing Layer 2 network traffic like a VPN site-to-site
For rightnow on both site can ping together
I try to add the static route on both site but It's not works I'm not sure do we need to config anything else on Cloudflare Dashboard?

[AnimMouse]

Ahh, a VPN site-to-site, unfortunately, Cloudflare WARP-to-WARP is still a peer-to-peer network, so adding a static route on both site will not work, hence requiring you to port forward in order to access the devices behind the MikroTik router. But Cloudflare Zero Trust has a new product called WARP Connector, which still uses Wireguard, but unfortunately wgcf-teams does not support WARP Connector yet. For now, in order to have a VPN site-to-site, run a cloudflared container inside both MikroTik devices with warp-routing enabled in addition to this Cloudflare WARP-to-WARP tutorial (since cloudflared only accepts inbound connections, outbound connections to other site will be handled by Wireguard), and it will work like a VPN site-to-site.