Configure Split Tunnels
Feature availability
| Operating Systems | WARP mode required | Zero Trust plans |
|---|---|---|
| All systems | WARP with Gateway | All plans |
Split Tunnels mode can be configured to exclude or include IP addresses or domains from going through WARP. This feature is commonly used to run WARP alongside a VPN (in Exclude mode) or to provide access to a specific Tunnel (in Include mode).
You can add or remove items from the Split Tunnels list at any time, but note that changes made to your Split Tunnel configuration are immediately propagated to clients. Because this setting controls what Gateway has visibility on at the network level, please review and test all changes immediately after making every change.
Also, changing between Include and Exclude modes will immediately delete your existing Split Tunnel configuration. Be sure to make a copy of any IP addresses or domains in your existing configuration, as they will be reverted to the default upon switching modes.
Domains included in your Split Tunnel configuration are still resolved by Gateway. If you want another DNS Server to handle domain name resolution, add the domain to your Local Domain Fallback configuration.
To set up Split Tunnels:
In the Zero Trust dashboard, go to Settings > Network.
Under Split Tunnels, choose a Split Tunnel mode:
- (default) Exclude IPs and domains — All traffic will be sent to Cloudflare Gateway except for the IPs and domains you specify.
- Include IPs and Domains — Only traffic destined to the IP address or domains you specify will be sent to Cloudflare Gateway.
If you want to add or remove items from your Split Tunnels configuration, select Manage.
On this page, you will find a list of the IPs and domains Cloudflare Zero Trust excludes or includes, depending on the mode you have selected.
Add an IP address
- In the Zero Trust dashboard, go to Settings > Network.
- Scroll down to Split Tunnels and select Manage.
- In the Selector dropdown, select IP Address.
- Enter the IP address or CIDR you want to exclude or include.
- Enter an optional description and then select Save destination.
The IP address will appear in the list of Split Tunnel entries.
Add a domain
- In the Zero Trust dashboard, go to Settings > Network.
- Scroll down to Split Tunnels and select Manage.
- In the Selector dropdown, select Domain.
- Enter a valid domain to exclude or include.
- Enter an optional description and then select Save destination.
The domain will appear in the list of Split Tunnel entries.
Valid domains
| Split tunnel domain | Matches | Does not match |
|---|---|---|
example.com | exact match of example.com | subdomains such as www.example.com |
example.example.com | exact match of example.example.com | example.com or subdomains such as www.example.example.com |
*.example.com | subdomains such as www.example.com | example.com |
Cloudflare Zero Trust domains
Many Cloudflare Zero Trust services rely on traffic going through WARP, such as device posture checks and WARP sesssion durations. If you are using Split Tunnels in Include mode, you will need to manually add the following domains in order for these features to function:
- The IdP used to authenticate to Cloudflare Zero Trust
<your-team-name>.cloudflareaccess.com- The application protected by the Access or Gateway policy
Important platform differences
Domain-based Split Tunnels work differently on mobile clients than on desktop clients. If both mobile and desktop clients will connect to your organization, it is recommended to use Split Tunnels based on IP addresses or CIDR, which work the same across all platforms.
Windows, Linux and macOS behavior
Clients on these platforms work by dynamically inserting the IP address of the domain immediately after it is resolved into the routing table for split tunneling. This allows the desktop clients to support wildcard domain prefixes (for example, *.example.com), not just a singular domain (like example.com or www.example.com).
iOS, Android and ChromeOS behavior
Due to platform differences, mobile clients can only apply Split Tunnels rules when the tunnel is initially started. This means:
Domain-based Split Tunnels rules are created when the tunnel is established based on the IP address for that domain at that time. The route is refreshed each time the tunnel is established.
Wildcard domain prefixes (for example,
*.example.com) are supported only if they have valid wildcard DNS records. Other wildcard domains are not supported because the client is unable to match wildcard domains to hostnames when starting up the tunnel. Unsupported wildcard domain prefixes can still exist in your configuration, but they will be ignored on mobile platforms.
Remove an item from Split Tunnels
On the Split Tunnels page, locate the IP address or hostname in the list and then click Delete.