Install one Cloudflare Mesh node on each Linux server. Each server receives a private Mesh IP, so it can reach services on the other server through Cloudflare. Neither server needs a public IP address or a service exposed to the public Internet.
This setup reaches services running on the nodes themselves. To connect hosts behind the nodes instead, follow Connect two sites.
- Two servers running a supported Linux distribution, with administrator access
- A service listening on each server if you want to test both directions, such as SSH on TCP port
22 - Netcat (
nc) installed on the servers where you will run the TCP tests - Outbound access from both servers to the Cloudflare One Client IPs and ports
Before you begin, set up Cloudflare Mesh for your account. The setup wizard configures device enrollment, Mesh IP assignment, enrolled-device reachability, and Gateway proxying.
If your account already uses Cloudflare One, verify the required account settings. Existing settings are not overwritten by the setup wizard.
To run a node in a container, refer to Run Mesh in Docker or Kubernetes.
-
In the Cloudflare dashboard, go to Networking > Mesh.
Go to Mesh ↗ -
Select Add participant > Add node.
-
Name the node
server-a, then select Create node. -
Select Linux and run the displayed installation and registration commands on the first server. Keep the node token private.
-
Confirm that
server-aappears as Online in the Mesh dashboard. Record its Mesh IP.
-
In Networking > Mesh, select Add participant > Add node.
Go to Mesh ↗ -
Name the new node
server-b, select Create node, then select Linux. -
Run the new installation and registration commands on the second server. Do not reuse the first node token: each server needs its own node identity.
-
Confirm that
server-bappears as Online and record its Mesh IP.
When a service runs on the node itself, you do not need a CIDR route, router changes, or IP forwarding. IP forwarding is only needed when a node routes traffic for other hosts.
On each destination server, confirm the service listens on the Mesh IP or on all interfaces. A service bound only to a separate local-network IP cannot accept connections to its Mesh IP. Allow the required port from the other server's Mesh IP in the host firewall, and check any cloud firewall or security group. Scope these rules to Mesh IPs instead of opening the port to the public Internet.
Confirm that the Gateway proxy handles the service protocol and that any Gateway network policies permit the connection.
If both servers run SSH, test each direction using the other server's Mesh IP:
-
On
server-a, test TCP port22onserver-b:nc -vz <SERVER-B-MESH-IP> 22 -
On
server-b, test TCP port22onserver-a:nc -vz <SERVER-A-MESH-IP> 22
Replace the Mesh IP placeholders with the addresses shown in the dashboard. If you use another service, substitute its port. Online means the node is connected to Cloudflare. A successful service test confirms that traffic reaches the destination. ping is only useful when the ICMP Gateway proxy is turned on.
If a test fails, refer to Troubleshoot Cloudflare Mesh connectivity.
Use Gateway network policies to control which sources can reach each destination IP and port. You can combine network policies with device posture checks for enrolled client devices.
Review allowed and blocked connections in Gateway network logs. Client device traffic includes the enrolled user identity. Mesh node traffic uses the identity warp_connector@<your-team-name>.cloudflareaccess.com.
- Connect two private networks through routed subnets.
- Connect two devices by Mesh IP.
- Connect Workers to Mesh with a VPC Network binding.