Enterprise network-edge connectivity. Extend your existing routers and firewalls into Cloudflare using GRE/IPsec, CNI, or an appliance; replace tunnel sprawl with one global routing and security fabric.
Ideal for: offices, data centers, cloud networks, high-throughput sites, resilient tunnel pairs, BGP routing, and MPLS or traditional WAN replacement.
Software-defined private connectivity. Run the
Cloudflare One Client (warp-cli) on a Linux host; it
connects outbound from behind NAT, receives a Mesh IP, and can route
the subnet behind it without edge-router integration.
Ideal for: device-to-device access, small branches, VPCs, DevOps networks, source-IP-sensitive applications, and fast deployments where router changes are impractical.
See the Cloudflare Mesh showcase ↗Same private-routing goal, different on-ramp: Magic WAN joins network edges; Mesh joins software nodes. They can share Unified Routing when deployed in the same account. These lab showcases use separate accounts, so their routes are intentionally isolated.