[Hostname routing] Point to Custom IPs dashboard UI; document automatic Split Tunnel inclusion for initial resolved IPs - #32754
Open
nikitacano wants to merge 1 commit into
Conversation
nikitacano
requested review from
a team,
cf-rhett,
csujedihy,
elithrar,
hoan-pom,
jiulingz and
lpraneis
as code owners
August 14, 2026 11:12
Contributor
Review
👉 Fix in your agent 👈Fix the following review findings in PR #32754 (https://github.com/cloudflare/cloudflare-docs/pull/32754).
Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.
The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.
---
## Code Review
### Warnings (1)
#### CR-f531142c68cf · Imprecise IPv6 Split Tunnel auto-management claim
- **File:** `src/content/docs/cloudflare-one/networks/connectors/cloudflare-mesh/routes.mdx` line 238
- **Issue:** Line 238 states that "all Cloudflare One IPv6 ranges" are automatically routed through Cloudflare. However, the linked Split Tunnels page only identifies the single prefix `2606:4700:0cf1::/48` as automatically managed, covering device IPs, Cloudflare source IPs, and Gateway initial resolved IPs. The broader wording could mislead readers into thinking any additional or custom Cloudflare One IPv6 ranges are also auto-managed.
- **Fix:** Change "all Cloudflare One IPv6 ranges" to the specific automatically managed IPv6 prefix `2606:4700:0cf1::/48`, consistent with the referenced Split Tunnels documentation.
---
## Style Guide Review
### Warnings (1)
#### SG-bf7c449b1967 · Directional words
- **File:** `src/content/docs/cloudflare-one/networks/routes/reserved-ips.mdx` line 85
- **Issue:** Uses the directional word `below` (`the other CGNAT-based ranges below`)
- **Fix:** Replace `below` with a direct reference by name or link, for example `the other CGNAT-based ranges` or `the other CGNAT-based ranges in this section`
Code ReviewThis code review is in beta and may not always be helpful — use your judgment. Warnings (1)
ConventionsNo convention issues found. Style Guide ReviewWarnings (1)
CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
github-actions
Bot
assigned
hoan-pom,
elithrar,
cf-rhett,
csujedihy,
jiulingz and
lpraneis
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
Contributor
nikitacano
changed the title
nikitacano
enabled auto-merge (squash)
August 14, 2026 11:44
Contributor
Author
|
/rebase |
cloudflare-docs-bot
Bot
force-pushed
the
ncano/initial-resolved-ip-custom-ips-auto-split-tunnel
branch
from
August 17, 2026 09:35
4142025 to
90c8aaa
Compare
hoan-pom
approved these changes
Aug 17, 2026
…lusion Two related fixes for initial resolved IPs now that the Networking > IP addresses > Address space > Custom IPs UI (stratus MR !41739) is live in production: - Swap the Zero Trust > Team & Resources > Devices > Device profiles UI instructions back to Networking > IP addresses > Address space > Custom IPs, with a Go button, in configure-initial-resolved-ips.mdx and the GA changelog. Re-add the dash-route entry for this deeplink to core-manually-defined.json. - Per WDAPI-4489, the Cloudflare One Client now automatically includes the default initial resolved IP range (172.64.128.0/20) in Split Tunnels Include mode, and automatically excludes it (along with the entire 2606:4700:0cf1::/48 IPv6 range, which also covers device IPs and Cloudflare source IPs on IPv6) from Exclude mode exclusions, at runtime on the device. This is not stored in the device profile and is not returned via the public API. Added a new 'Automatically managed ranges' section to split-tunnels.mdx as the canonical explanation, and updated reserved-ips.mdx, configure-initial-resolved-ips.mdx, and the Cloudflare Mesh routes.mdx / client-devices.mdx docs to stop instructing manual Split Tunnel configuration for these ranges. Custom (non-default) initial resolved IP ranges still require manual Split Tunnel configuration, since it is not confirmed whether the automatic behavior tracks a custom range.
nikitacano
force-pushed
the
ncano/initial-resolved-ip-custom-ips-auto-split-tunnel
branch
from
August 17, 2026 17:31
90c8aaa to
12e54bd
Compare
abelinkinbio
self-requested a review
August 17, 2026 17:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related fixes for initial resolved IP documentation, now that the Networking > IP addresses > Address space > Custom IPs UI is live in production.
1. Point to the live Custom IPs dashboard UI
Previously documented as Zero Trust > Team & Resources > Devices > Device profiles (the only UI available at the time). Now that Custom IPs is live, changed to Networking > IP addresses > Address space > Custom IPs, with a Go button:
configure-initial-resolved-ips.mdx— Prerequisites, "Check your current range", "Update your range"core-manually-defined.jsonfor the deeplink2. Document automatic Split Tunnel inclusion (WDAPI-4489)
Per WDAPI-4489, the Cloudflare One Client automatically:
172.64.128.0/20) and the entire2606:4700:0cf1::/48IPv6 rangeThis happens at runtime on the device — it's not stored in the device profile and not returned via the public API (same pattern as Microsoft 365 IP exclusions). The
2606:4700:0cf1::/48IPv6 range also covers device IPs and Cloudflare source IPs on IPv6, so all Cloudflare One IPv6 Split Tunnel configuration for these features is now unnecessary.Changes:
split-tunnels.mdx— the canonical explanation, cross-referenced everywhere else belowreserved-ips.mdx— updated both the Exclude mode and Include mode sectionsconfigure-initial-resolved-ips.mdx— replaced the blanket "update your Split Tunnel configuration" instruction with "not required for the default range; only for custom ranges"routes.mdx(Hostname routes prerequisites) andclient-devices.mdx(Split Tunnel Include mode list) — removed the token IP / IPv6 rows from the manual-configuration instructions