WireGuard on Cloudflare

Understanding the main patterns

WireGuard is a fast, modern VPN protocol that creates a secure tunnel between peers. Cloudflare offers two primary tools that can carry or assist WireGuard traffic:

• Cloudflare Tunnel: A reverse-proxy-like service that exposes a private service behind a firewall to the internet via Cloudflare’s edge. It can terminate TLS, provide authentication, and offer a stable endpoint for your WireGuard peers to connect through.
• Cloudflare Warp (and Warp Teams): A client-side VPN for end devices that routes device traffic through Cloudflare’s network. Warp can be used to route WireGuard traffic from clients, but it’s typically configured for client traffic rather than acting as a WireGuard server itself.

In practice, you typically run WireGuard on your own server or device, then present a Cloudflare-managed path for clients or peers to reach that server securely. This can be achieved via a Cloudflare Tunnel to a WireGuard endpoint, or by placing a WireGuard server inside a private network that Cloudflare accesses via tunnel. The bottom line: Cloudflare provides the secure, scalable edge you may want to leverage, but you still run WireGuard on your own infrastructure.

Typical deployment architectures

Here are common architectures you’re likely to encounter:

• WireGuard server behind Cloudflare Tunnel: Your WireGuard server runs inside a private network (e.g., a home server or cloud VM). You configure Cloudflare Tunnel to expose the WireGuard port (usually UDP 51820) through a Cloudflare-generated hostname. Users connect to that hostname, and Tunnel forwards UDP to your WireGuard endpoint.
• WireGuard as a service enabled by Cloudflare Spectrum (where available): For UDP traffic, Cloudflare Spectrum can proxy certain UDP services. This is more enterprise-focused and may require specific plans. If Spectrum is in use, you can present a UDP proxy for a WireGuard port to your server.
• Client traffic routed through Warp + WireGuard: On client devices, you can use Warp to route general traffic, and in some setups, configure a private WireGuard peer that the client connects to through a Cloudflare Tunnel endpoint. This lets devices leverage Cloudflare’s network while keeping WireGuard tunnels intact.
• Zero-trust or access app integration: If you’re aiming for identity-based access, you can use Cloudflare Access with tunnel endpoints to require authentication before a WireGuard connection is allowed to reach your server.

Each pattern has different requirements around ports, UDP handling, MTU considerations, and firewall rules. The simplest for many users is: run WireGuard on a VM or NAS, create a Cloudflare Tunnel that routes to the WireGuard UDP port, and distribute the tunnel’s hostname to clients.

Step-by-step setup sketch: WireGuard server behind a Cloudflare Tunnel

Note: exact commands vary by OS and Cloudflare tooling version. This is a high-level workflow. WireGuard on Hetzner

1. Prepare the WireGuard server
   • Install WireGuard (kernel module for Linux: wireguard-tools and wireless kernel support, etc.)
   • Create a private/public key pair for the server
   • Configure wg0 with a private network (e.g., 10.0.0.0/24) and a server listening port (51820/UDP)
   • Create client peer configurations as needed
2. Install and configure Cloudflare Tunnel
   • Install cloudflared on the server
   • Authenticate cloudflared with your Cloudflare account
   • Create a tunnel: cloudflared tunnel create wg-tunnel
   • Create a tunnel route to a local UDP port (the WireGuard port)
   • You’ll typically configure a websocket or a TCP over UDP translation, depending on current capabilities
   • Create a tunnel ingress rule in Cloudflare to route traffic to the local WireGuard port
3. Expose a hostname for clients
   • Create a CNAME or an A-record in Cloudflare DNS pointing to the tunnel
   • Use the tunnel’s URL as the endpoint for the WireGuard client configuration
   • Ensure the firewall on the WireGuard server allows UDP 51820 from Cloudflare’s egress IP ranges if applicable
4. Client configuration
   • On client devices, configure WireGuard to use the Cloudflare-hosted endpoint
   • Use the server’s public key and assign a client IP (e.g., 10.0.0.2/32)
   • Add peer config and allowed IPs to route traffic through the VPN
5. Security and maintenance
   • Regularly rotate keys
   • Lock down firewall to only allow Cloudflare’s ports, if you’re restricting access
   • Monitor Cloudflare tunnel status and WireGuard handshake activity

Important caveats:

• UDP through Cloudflare: Cloudflare’s standard HTTP/HTTPS services don’t proxy UDP traffic. Cloudflare Tunnel can forward TCP connections and, in some setups, UDP via Spectrum or other features. Direct UDP proxying for WireGuard requires the right plan and configuration. Verify current capabilities in your Cloudflare plan.
• MTU and fragmentation: WireGuard’s UDP packets can be sensitive to MTU changes when routed through tunnels. Start with an MTU of 1420 or 1422 and tune as needed to avoid fragmentation.
• Latency considerations: Introducing Cloudflare’s edge routing can add hops. For latency-sensitive use cases, test end-to-end performance and adjust where possible (e.g., select a closer tunnel exit point).

Security considerations and best practices

• Principle of least privilege: Only expose the WireGuard UDP port to Cloudflare and limit source IPs where possible. Use firewall rules to block direct public access to the WireGuard port if you’re relying on Cloudflare to gate the connection.
• Authentication and access control: If you’re using a Cloudflare Access-based flow to require authentication before traffic is allowed, ensure the WireGuard endpoint behind the tunnel is still reachable by the authenticated client path.
• Key management: Regularly rotate server and client keys, and publish new client configurations as needed. Consider revoking compromised keys promptly.
• Logging and observability: Enable logs on both WireGuard and Cloudflare to monitor handshake failures, failed tunnel connections, or unusual traffic patterns. Cloudflare’s event logs can complement server-side WireGuard logs.
• Redundancy and failover: If you rely on a single Cloudflare tunnel, plan for failover. You can deploy multiple tunnels to different endpoints or different cloud regions to improve resilience.

A quick comparison table: key options for integrating WireGuard with Cloudflare

Troubleshooting quick tips

• If clients cannot connect: verify the Cloudflare Tunnel is up and routing correctly. Check for UDP forwarding support on your plan.
• If you see handshake failures: confirm keys are correct on both server and clients. Ensure the server’s port is listening and not blocked by a firewall.
• If latency is high: test direct WireGuard without Cloudflare to compare, then consider a closer tunnel exit point or different Cloudflare feature (Spectrum vs. Tunnel).
• If you can connect but traffic doesn’t route: ensure AllowedIPs are set correctly on the client (typically 0.0.0.0/0 for full-tunnel or specific subnets for split-tunnel).

Final recommendation

If your goal is to gain Cloudflare’s edge presence while using WireGuard, start with a straightforward approach: run a WireGuard server in a private network, set up a Cloudflare Tunnel to forward the WG port, and point clients at the tunnel hostname. This gives you the benefits of Cloudflare’s edge security and potential DDoS protection without overcomplicating the setup. If you need robust UDP proxying or enterprise-grade UDP Spectrum support, evaluate Cloudflare Spectrum and compare it to your performance and cost targets. Keep security best practices in mind: limit exposure, rotate keys, and monitor both ends of the tunnel. With careful planning, WireGuard and Cloudflare can complement each other to deliver a fast, secure, and manageable remote-access experience.