Cloudflare Integration[old]

1. Navigate to Team & Resources→Devices→Management

• Enable Install CA to system certificate store in order to propagate CF certificate to your user devices. Critical before enabling Inspect HTTPS requests with TLS decryption in section #3.2

2. Navigate to Team & Resources→Devices→Devices profiles

• Click on your profile, and click on Edit (alternatively - click on the 3 dots to open and menu and then Configure)
• Scroll down to Split Tunnels → by clicking Manage you can view your split tunnel entries and verify the following:
⚠️ Critical: Check for CIDR Range Overlaps
Before configuring split tunnels, you must verify that your private network CIDR is not blocked by ANY existing exclude rules, including broader ranges that may encompass your specific network.
Configuration Options:
• If using "Exclude IPs and domains" mode:
• Ensure your private network CIDR (e.g., 172.20.0.0/16) is NOT in the exclude list
• Important: Also check for broader CIDR ranges that may include your network
• Example: If 172.16.0.0/12 is excluded, it includes ALL networks from 172.16.0.0 to 172.31.255.255, which would block 172.20.0.0/16
• Alternative: Use "Include IPs and domains" mode and add your private network CIDR to ensure traffic routing
Verification Steps:
1. List all excluded CIDR ranges in your split tunnel configuration
2. Check each range to confirm your network doesn't fall within it:
• Use an online CIDR calculator or subnet tool if needed
• Common overlapping ranges to watch for:
• 10.0.0.0/8 (includes all 10.x.x.x networks)
• 172.16.0.0/12 (includes 172.16.x.x through 172.31.x.x)
• 192.168.0.0/16 (includes all 192.168.x.x networks)
3. Test connectivity to your private network after configuration changes
4. Verify tunnel traffic is routing correctly through the expected path

3. Navigate to Traffic policies→Traffic settings

• Allow Secure Web Gateway to proxy traffic
• Inspect HTTPS requests with TLS decryption

Create Network Tunnel

1. Navigate to Networks → Connectors
2. Select Cloudflared
3. Create new tunnel with:
1. Name: [client]-tunnel-[environment]
2. Click Save tunnel
3. Save the token and share it with Lumia Security alongside the selected name
4. Click Next
5. Add 172.20.0.0/16 under the CIDR tab

Create Access Application

1. Navigate to Access controls → Applications
2. Click on Add Application
3. Select Self-Hosted application:
• Name: [Client] Security Access App
• Session duration: According to security requirements
• Click on Add private hostname and enter 172.20.0.0/16 in the Hostname and 443 as the Port
4. Click Next, and Next again and Save
5. After saving the application:
1. Navigate to Access controls → Applications
2. Select the application you created
3. Go to the Advanced settings tab
Verify the following:
CORS Settings:
• Bypass options requests to origin — ON (enabled)
Service Auth Behavior:
• Return 401 Response — OFF (disabled)

1. Create Managed Domain List

1. Download Lumia’s domain list

curl https://downloads.lumiasecurity.com/feed/cacff052-3517-4d9d-ba7a-96065f8cf52e/domains.list > domains.list

2. Create the list
Replace <account_id>

curl -X POST "https://api.cloudflare.com/client/v4/accounts/<account_id>/gateway/lists" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "LUMIA_HOSTS",
    "type": "DOMAIN",
    "description": "Managed via API"
  }'

Response:

{
  "result": {
    "id": "b3c66255-85bf-425f-8f10-32f8abbc296c", # <-- use this in the next call
    "name": "LUMIA_HOSTS-1",
    "description": "Lumia Hosts",
    "type": "DOMAIN",
    "created_at": "2025-12-31T15:58:06Z",
    "updated_at": "2025-12-31T15:58:06Z"
  },
  "success": true,
  "errors": [],
  "messages": []
}

3. Update the list with actual file using the ID in the response from previous call

curl -X PUT "https://api.cloudflare.com/client/v4/accounts/<account_id>/gateway/lists/<list_id>" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  --data-binary "@domains.list"

Response:

{
  "result": {
    "id": "2aea1f29-f829-4e17-9063-f99056365f12",
    "name": "LUMIA_HOSTS",
    "description": "Lumia Hosts",
    "type": "DOMAIN",
    "created_at": "2025-12-31T15:40:04Z",
    "updated_at": "2025-12-31T15:42:25Z",
    "count": 826
  },
  "success": true,
  "errors": [],
  "messages": []
}

2. Create DNS Policy

1. Navigate to Traffic policies → Firewall policies
2. Enter to the DNS tab
3. Click on Add a policy
4. On Step 1: Enter name “Lumia Host Override Policy”
5. On Step 2: In Traffic section set the following condition:
1. Selector: Domain
2. Operator: in list
3. Value: Select LUMIA_HOSTS list
6. (Optional) In Identity section: if deployment is restricted to specific users, list them here
7. On Step 3: set the action with the following details:
1. Action: Override
2. Override Hostname: 172.20.0.242

3. Create HTTP Policy

1. On the same location from the previous section (Traffic policies → Firewall policies)
2. Enter to the HTTP tab
3. Click on Add a policy
4. On Step 1: Enter name “Allow no-TLS Validation for Access App”
5. On Step 2: In Traffic section choose the following condition
1. Selector: Self-hosted Access App with Private Address
2. Operator: is
3. Value: Present
6. (Optional) In Identity section: if deployment is restricted to specific users, list them here
7. On Step 3: set the action with the following details:
1. Action: Allow
2. Untrusted certificate action: Pass Through
8. On Step 4: Click on Add a header and enter the following details:
1. Custom header name: Ls-Tenant
2. Custom header value: Your tenant UUID supplied by Lumia Security

DNS Resolution Testing

# Test DNS resolution for a domain in your list
nslookup chatgpt.com
# Should resolve to tunnel IP

Traffic Flow Validation

# Test connection (using -k to ignore certificate warnings)
curl -v -k https://chatgpt.com

Service Monitoring

• Check tunnel connection status in Cloudflare dashboard
• Monitor traffic flow through logs

curl https://api.cloudflare.com/client/v4/accounts/<account_id>/gateway/lists/<list_id> \
-X 'PUT' \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer <api_token>" \
--data-binary "@<path_to_file>"

• <account_id> — Your Cloudflare account ID, found in the dashboard URL or under Account Home, Overview.
• <list_id> — The unique identifier for the Gateway list created during initial setup.
• <api_token> — A Cloudflare API token with Zero Trust Edit permissions.
• <path_to_file> — Path to a JSON file containing the updated domain list (e.g., domains.json).

Connection Issues

• Verify WARP client is connected with Gateway enabled
• Double-check that no broader CIDR ranges are inadvertently excluding your specific network range
• Ensure DNS policy uses Domain selector (not Host)
• Check tunnel connector health

DNS Resolution Failures

• Confirm DNS policy is properly configured
• Verify policy priority order
• Test direct access to tunnel hostname

TLS Certificate Errors

• Verify the "Allow no-TLS Validation for Access App" policy is properly configured
• Check that private IPs are correctly defined in the Access app