Cloudflare Zero Trust
Complete Setup Guide

How Everything Connects

Cloudflare Zero Trust is a free service that creates a secure, encrypted tunnel between your office network and Cloudflare's global servers. Laptops running the WARP client connect to that same tunnel — giving them secure access to your office as if they were physically plugged into the LAN.

Create Your Cloudflare Account

Done once — takes about 5 minutes. Use any computer with a browser.

1 Go to Cloudflare and sign up

Open your browser and go to https://dash.cloudflare.com/sign-up. Enter your email address and create a password. Use a real email — you'll need to verify it.

After submitting, Cloudflare will send a verification email. Open it and click the verification link. You'll be taken to the Cloudflare dashboard.

2 Navigate to Zero Trust

After logging in, you'll see the main Cloudflare dashboard. In the left sidebar, scroll down and click Zero Trust.

If this is your first time, Cloudflare will ask you to choose a plan. Select Free and click Next.

3 Set your team name (your organization domain)

Cloudflare will ask you to choose a team name. This becomes the domain that your staff use to log in to WARP. Choose something short and related to your organization — it cannot be changed easily later.

After saving, you'll land on the Zero Trust dashboard at one.dash.cloudflare.com. This is your control center for everything going forward.

Create the Tunnel on the Server Room PC

This is done on the PC in your server room that stays powered on 24/7. This PC becomes the bridge between your office network and Cloudflare.

4 Create a new tunnel in the dashboard

In the Zero Trust dashboard, go to Networks → Tunnels in the left sidebar, then click Create a tunnel.

Choose Cloudflared as the connector type (this is the recommended option). Click Next.

On the next screen, type the tunnel name. Use main-office (or any name that identifies your office location). Click Save tunnel name.

5 Download and install cloudflared on the server room PC

After naming the tunnel, Cloudflare shows you the installation page. Make sure Windows is selected. You'll see two commands — run both on the server room PC.

Go to the server room PC, open PowerShell as Administrator (right-click the Start button → Windows PowerShell (Admin)), and run:

6 Authenticate cloudflared with your Cloudflare account

This step links the cloudflared program to your Cloudflare account. Run this command — it will open a browser window automatically.

In the browser window that opens, you'll see your Cloudflare account. Click Authorize to allow cloudflared access.

7 Create the tunnel configuration file

Create a folder called C:\cloudflared\ and inside it create a file named config.yml. This file tells cloudflared which tunnel to run and what network to share.

First — find your Tunnel ID

Go back to the Zero Trust dashboard → Networks → Tunnels → main-office. The Tunnel ID is shown at the top — it looks like xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Copy it.

Create the config file

Open Notepad on the server room PC, paste the content below, and save as C:\cloudflared\config.yml. Replace the tunnel ID with the one you copied.

8 Install as a Windows Service and start it

Installing as a service makes cloudflared start automatically every time the PC boots — even without anyone logging in.

Test it manually first

Install and start the service

Verify it's running: press Win + R, type services.msc, press Enter, and find Cloudflare Tunnel: cloudflared — it should show Status: Running, Startup Type: Automatic.

Go back to the Cloudflare dashboard → Networks → Tunnels. The tunnel should now show ● Healthy.

Configure Private Network Access

This tells Cloudflare which IP range is your office network, and configures WARP-connected laptops to route office traffic through the tunnel.

9 Add your office network as a private route

Go to Networks → Routes in the Zero Trust sidebar, then click Create route.

After saving, the route appears in the list:

10 Configure WARP device settings

Go to Settings → WARP Client in the sidebar. This is where you control how WARP behaves on laptops.

Set device enrollment to allow your organization

Click Edit on "Device enrollment permissions". Set the rule to allow enrollment by email domain — this lets staff enroll by logging in with their email.

11 Configure split tunnels so office traffic routes correctly

Click Edit on the Default Profile. Scroll down to find Split Tunnels. This controls what traffic goes through WARP and what goes directly to the internet.

Install WARP on Each Laptop

Repeat these steps on every laptop that needs outside access. Takes about 3 minutes per laptop.

12 Download and install the WARP client

On the laptop, open a browser and go to https://one.one.one.one. Click Download for Windows and run the installer.

Run the downloaded .exe installer. It installs like any normal Windows program — click through Next → Install → Finish. After installing, the WARP icon (orange cloud) appears in the system tray at the bottom-right of the screen.

13 Log in to your Zero Trust organization

Click the WARP icon in the system tray. The WARP window opens. Click the gear icon ⚙️ at the bottom, then go to Preferences → Account.

Type your team name (your-org) and click Login. A browser window will open asking for your email. Enter your email (it-admin@yourcompany.com or any @yourcompany.com email) and approve the login.

14 Connect WARP and confirm it works

After login, the WARP window shows your organization name. Click the toggle to connect. The button turns green and shows Connected.

Open Command Prompt on the laptop and do a quick ping test to confirm the office network is reachable:

Accessing Office Files and Systems Remotely

With WARP connected, your laptop behaves as if it's plugged into the office LAN. All of these work using the office's normal internal IP addresses.

15 Access shared folders (file server)

Press Win + R to open the Run dialog. Type the UNC path to the file server share and press Enter.

A File Explorer window will open showing the shared folder — just like being in the office.

16 Remote desktop into any office PC

Press Win + R, type mstsc, and press Enter. Enter the office PC's internal IP address.

17 Map the shared drive as a permanent network drive

To make the file server always appear in File Explorer (like a local drive), map it as a network drive. Open File Explorer, right-click This PC, and select Map network drive.

After clicking Finish, the shared folder appears as drive Z: in File Explorer — and reconnects automatically every time you log in (when WARP is connected).

Complete Setup Checklist

Phase 1 — Cloudflare Account

• ✓
  Cloudflare account created at dash.cloudflare.com
• ✓
  Email verified
• ✓
  Zero Trust enabled — Free plan selected
• ✓
  Team name set (e.g. your-org) — full domain: your-org.cloudflareaccess.com

Phase 2 — Tunnel on Server Room PC

• ✓
  Tunnel named main-office created in Networks → Tunnels
• ✓
  cloudflared downloaded and installed on server room PC
• ✓
  cloudflared tunnel login completed — cert.pem saved
• ✓
  C:\cloudflared\config.yml created with correct tunnel ID
• ✓
  Manual test passed — tunnel shows "Tunnel is ready!"
• ✓
  cloudflared installed as Windows Service — Startup: Automatic
• ✓
  Dashboard shows main-office as ● Healthy

Phase 3 — Network Route

• ✓
  Private route 192.168.1.0/24 → main-office added in Networks → Routes
• ✓
  Device enrollment permissions set (email domain or Everyone)
• ✓
  Split tunnel configured — office network included

Phase 4 — Laptops

• ✓
  WARP client downloaded from one.one.one.one
• ✓
  WARP installed on laptop
• ✓
  Logged in to Zero Trust org using team name + email
• ✓
  WARP shows Connected with 192.168.1.0/24 private network
• ✓
  Ping test to office IP successful from outside network

Phase 5 — File & System Access

• ✓
  Can access shared folders via \\192.168.1.xxx\ShareName
• ✓
  Can RDP to office PCs using internal IP
• ✓
  Network drive mapped as Z: and reconnects automatically

Key Info at a Glance

Service management commands (run as Administrator)