跳转到主要内容

Split Tunnels

import { Render } from "~/components";

Change Split Tunnels mode

Add a route

When to use Split Tunnels

Use Split Tunnels when you need to bypass Gateway entirely for a site or allow traffic through the firewall that the Cloudflare One Client creates. Common scenarios include:

  • Connect to a third-party application which requires the actual IP address of the end-user device (for example, Microsoft 365).
  • Optimize voice and video.
  • Connect to a third-party VPN endpoint.

When not to use Split Tunnels

Do not exclude a site from Split Tunnels if you want to see the traffic in your Gateway logs. In particular, we do not recommend using Split Tunnels to:

  • Solve connectivity issues with a specific website. For configuration guidance, refer to our troubleshooting guide.
  • Solve performance issues with a specific website. Since Cloudflare operates within 50 milliseconds of 95% of the Internet-connected population, it is usually faster to send traffic through us. If you are encountering a performance-related issue, it is best to first explore your Gateway policies or reach out to Support.

Routes for Split Tunnels Include mode

Many Cloudflare Zero Trust services rely on traffic going through the Cloudflare One Client, such as device posture checks and device client session durations. If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function.

Cloudflare Zero Trust domains

If you are using Split Tunnels in Include mode, you must include the following domains:

  • The IdP used to authenticate to Cloudflare Zero Trust
  • <your-team-name>.cloudflareaccess.com
  • The application protected by the Access or Gateway policy
  • edge.browser.run if using Browser Isolation

Cloudflare Zero Trust IP addresses

Block page

If you are using Split Tunnels in Include mode and have DNS policies with the block page enabled, you must include the IPs that blocked domains will resolve to. Unless you are using a dedicated or BYOIP resolver IP the block page will resolve to:

  • 162.159.36.12
  • 162.159.46.12

Team domain

In Traffic only mode, you cannot add domains to Split Tunnels. If you are using Split Tunnels in Include mode, you must include the IPs that resolve to <your-team-name>.cloudflareaccess.com instead:

  • 104.19.194.29
  • 104.19.195.29

Device IP ranges

In Exclude mode, default device profiles exclude the CGNAT range (100.64.0.0/10), which contains the default device IP range (100.96.0.0/12). The Mesh setup wizard updates the default profile to route the device IP range through Cloudflare. If you did not use the wizard, or if another profile applies to the device, verify that the profile does not exclude the device IP range or a parent range that contains it.

Automatically managed ranges

The Cloudflare One Client automatically includes the following ranges in Include mode, and automatically removes them from any exclusions configured in Exclude mode. This happens at runtime on the device: the ranges are not stored in your device profile, do not appear in the Split Tunnels list in the dashboard, and do not need to be added manually.

You do not need to add these ranges to your Split Tunnels configuration. If you are troubleshooting a feature that depends on one of these ranges (for example, hostname routing or Cloudflare Mesh), you can still add the range explicitly as a diagnostic step, but this should not be required for normal operation.

If your account uses a custom initial resolved IP range instead of the default 172.64.128.0/20, add that custom range to your Split Tunnels configuration.

Domain-based Split Tunnels

Domain-based split tunneling has a few ramifications you should be aware of before deploying in your organization:.

  • Routes excluded or included from Cloudflare One Client and Gateway visibility may change day to day, and may be different for each user depending on where they are.
  • You may inadvertently exclude or include additional hostnames that happen to share an IP address. This commonly occurs if you add a domain hosted by a CDN or large Internet provider such as Cloudflare, AWS, or Azure. For example, if you wanted to exclude a VPN hosted on AWS, do not add *.amazonaws.com as that will open up your devices to all traffic on AWS. Instead, add the specific VPN endpoint (*.cvpn-endpoint-<UUID>.prod.clientvpn.us-west-2.amazonaws.com).
  • Most services are a collection of hostnames. Until Split Tunnels mode supports App Types, you will need to manually add all domains used by a particular app or service.
  • The Cloudflare One Client must handle the DNS lookup request for the domain. If a DNS result has been previously cached by the operating system or otherwise intercepted (for example, via your browser's secure DNS settings), the IP address will not be dynamically added to your Split Tunnel.

Valid domains

Split tunnel domain Matches Does not match
example.com exact match of example.com subdomains such as www.example.com
example.example.com exact match of example.example.com example.com or subdomains such as www.example.example.com
*.example.com subdomains such as www.example.com and sub2.sub1.example.com example.com

Platform differences

Domain-based Split Tunnels work differently on mobile clients than on desktop clients. If both mobile and desktop clients will connect to your organization, it is recommended to use Split Tunnels based on IP addresses or CIDR, which work the same across all platforms.

Windows, Linux and macOS

Clients on these platforms work by dynamically inserting the IP address of the domain immediately after it is resolved into the routing table for split tunneling. This allows the desktop clients to support wildcard domain prefixes (for example, *.example.com), not just a singular domain (like example.com or www.example.com).

Cloudflare One Client versions 2026.8.1755.1 and above attempt to maintain name-based Split Tunnel rule results across tunnel connections. Earlier versions did not maintain these results, so access to these domains was not maintained while the client was disconnected or reconnecting. Before the first tunnel connection, however, the client firewall blocks these domains. This is because the client has not yet queried which IP addresses are associated with each domain and therefore defaults to blocking this traffic to avoid unintended leaks.

iOS, Android and ChromeOS

Due to platform differences, mobile clients can only apply Split Tunnels rules when the tunnel is initially started. This means:

  • Domain-based Split Tunnels rules are created when the tunnel is established based on the IP address for that domain at that time. The route is refreshed each time the tunnel is established.
  • Wildcard domain prefixes (for example, *.example.com) are supported only if they have valid wildcard DNS records. Other wildcard domains are not supported because the client is unable to match wildcard domains to hostnames when starting up the tunnel. Unsupported wildcard domain prefixes can still exist in your configuration, but they will be ignored on mobile platforms.

Remove a route

:::caution Removing default Split Tunnel entries may cause users to lose Internet connectivity or block their access to local resources. :::

  1. In the Cloudflare dashboard, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.
  2. Locate the device profile you would like to modify and select Edit.
  3. Under Split Tunnels, select Manage.
  4. Find the IP address or hostname in the list and select the Action button. From the dropdown, select Delete.

If you need to revert to the default Split Tunnel entries recommended by Cloudflare, select Restore default entries.

这篇文档对你有帮助吗？
想留言或继续讨论？请到 Cyberforums 赛博论坛参与。 参与讨论 / 回复