Cloudflare One Client Connected but Private Service Unreachable: Check Split Tunnels and DNS

Cloudflare One Client can show Connected while a particular internal service remains unreachable. The indicator reports client status; it does not prove that DNS, routing, and access policy all succeed for that destination. Check the applied client mode and Split Tunnel first, then isolate DNS, the private network route, and policy.

Conceptual illustration of a device with separate paths to a private server and the internet. It is not a product screenshot.

This article applies to devices enrolled in an organization's Cloudflare Zero Trust. Users without dashboard access should share the symptoms and time with their administrator. The explanation is based on official documentation as of 2026-11-10; it was not tested on an organization's network.

1. Separate installation, enrollment, and connection

Cloudflare One Client was previously called WARP. Installing it is not enough to apply organization policies: the device must also enroll in the organization's Zero Trust instance, and enrollment permissions must already be configured. On desktop, select Zero Trust security in the client, enter the team name, and complete the organization's authentication. After the success page, allow the client to open to finish enrollment. Labels can vary by client version. Manual deployment and enrollment

Check the client version, organization enrollment, and connection status. If connection itself fails, record the displayed error and consult the client errors documentation. If the client connects but one service fails, continue with the routing checks below.

2. Check the applied mode and profile

Traffic and DNS mode handles both traffic and DNS through the client. DNS only forwards DNS but does not route device traffic through the tunnel. Traffic only routes traffic while the operating system handles DNS, so domain-based Split Tunnels and Local Domain Fallback are unavailable. Traffic only is available on Windows, macOS, and Linux. Client modes

Use the following terminal command to inspect applied settings:

Compare Mode and Profile ID in the output with the intended profile. Organization MDM settings can override profile settings. The diagnostic warp-settings.txt also contains the applied configuration, while warp-status.txt records connection status at collection time. Logs can contain organization and network information; review them before sharing. Troubleshooting guide

3. Check Split Tunnels and DNS separately

Exclude mode sends specified destinations outside the tunnel and routes the rest through it. Include mode sends only specified destinations through the tunnel. Compare the applied settings with the dashboard and check whether the private IP or domain is in the expected list. Include mode must also account for domains and addresses required for authentication and policy features. Split Tunnels

For domain rules to be applied dynamically, the client must handle the DNS lookup. Browser secure DNS interception or an existing operating-system cache entry can prevent the expected route from being added. example.com matches that exact name, while *.example.com matches subdomains; neither substitutes for the other. Where services share an IP address, excluding a domain can also affect other hosts.

4. Check the private route and policy

First verify that the name resolves to the expected IP, then check whether that IP is included in the tunnel. Inclusion alone does not create a route to the destination or grant access. The administrator should separately inspect the Cloudflare Tunnel or supported route connected to the private network, the destination service's listening state, and the organization's Gateway and Access policies. Connect a private network

Do not exclude an entire private range from the tunnel or disable security policies without identifying the cause. Excluded traffic can lose Cloudflare protection and visibility along that path. When another VPN is also in use, check the actual route for each destination and the organization policy.

5. Verify again under the same conditions

An administrator can compare the applied Profile ID and Split Tunnel list with the dashboard. If they differ, disconnecting and reconnecting can refresh the settings when organization policy permits it. A locked switch requires administrator action. After reconnecting, check DNS and actual access using the same device, network, and destination, and record what succeeded and what still failed. Diagnose configuration mismatches

If the issue persists, give the administrator the time, target host, connection status, applied mode and profile, error message, and steps already attempted. Review diagnostic files for sensitive information and follow the organization's sharing process.

한국어 버전: Cloudflare One Client 연결됐지만 사내 서비스에 접속되지 않을 때: Split Tunnel과 DNS 점검