gRPC

import { DashButton, GlossaryTooltip, Render } from "~/components";

gRPC is a Remote Procedure Call (RPC) framework that allows client applications to call methods on a remote server as if they were running on the same local machine. You can connect gRPC servers and clients to Cloudflare's global network, making it easier to build applications that use services across different data centers and environments.

In this example, we will connect a gRPC server to Cloudflare using the cloudflared daemon, secure the server with Gateway policies, and open a gRPC channel to the server using the Cloudflare One Client.

1. Set up a gRPC server

1. To set up a gRPC Python application, follow this quick start guide.

2. Start the server:

~/grpc/examples/python/helloworld $ python3 greeter_server.py
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
I0000 00:00:1721770418.373806    3677 config.cc:230] gRPC experiments enabled: call_status_override_on_cancellation, event_engine_dns, event_engine_listener, http2_stats_fix, monitoring_experiment, pick_first_new, trace_record_callops, work_serializer_clears_time_cache
Server started, listening on 50051

2. Connect the server to Cloudflare

To establish a secure, outbound-only connection to Cloudflare:

3. In the Cloudflare dashboard, go to Networking > Routes.

4. Select Create route > Tunnel CIDR. Select the tunnel you just created, enter the private IP or CIDR address of your server, and select Create route.

3. Route private network IPs through the Cloudflare One Client

<Render file="tunnel/warp-to-tunnel-route-ips" product="cloudflare-one" params={{ one: "private network" }} />

4. (Recommended) Create a Gateway policy

You can configure Gateway network policies to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass device posture checks, and the second blocks all other traffic. Make sure that the Allow policy has higher priority.

1. Allow secured devices

2. Block everything else

For more details on setting up the Gateway proxy, refer to Filter network traffic with Gateway.

5. Set up the client

gRPC clients can connect to the server by installing the Cloudflare One Client on the device and enrolling in your Zero Trust organization. When the client makes a request to a private IP exposed through Cloudflare Tunnel, WARP routes the connection through Cloudflare's network to the corresponding tunnel.

To set up the gRPC client:

1. Deploy the Cloudflare One Client on your device in Traffic and DNS mode.
2. Create device enrollment rules to determine which devices can enroll to your Zero Trust organization.
3. Install gRPC on the device by following this quick start guide.
4. Modify greeter.py to point to the private IP of your gRPC server. This is the same private IP configured in your Cloudflare Tunnel routes. For example,

def run():
    # NOTE(gRPC Python Team): .close() is possible on a channel and should be
    # used in circumstances in which the with statement does not fit the needs
    # of the code.
    print("Will try to greet world ...")
    with grpc.insecure_channel("172.31.0.133:50051") as channel:
        stub = helloworld_pb2_grpc.GreeterStub(channel)
        response = stub.SayHello(helloworld_pb2.HelloRequest(name="you"))
    print("Greeter client received: " + response.message)

6. Test the connection

1. On the client device, ensure that the Cloudflare One Client is Connected.
2. Run the gRPC client application:

~/grpc/examples/python/helloworld $ python3 greeter_client.py
Will try to greet world ...
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
I0000 00:00:1721771484.489711 4414247 config.cc:230] gRPC experiments enabled: call_status_override_on_cancellation, event_engine_dns, event_engine_listener, http2_stats_fix, monitoring_experiment, pick_first_new, trace_record_callops, work_serializer_clears_time_cache
Greeter client received: Hello, you!

You can view Tunnel logs to validate that requests are coming into the tunnel and reaching the gRPC server as intended.