[Script request]: Cloudflare Mesh

[frontend-report[bot]]

Application

• Name: Cloudflare Mesh
• Website: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/

Description

we have cf tunnels this is their newest offering

Due diligence

• Searched existing scripts, no duplicates: Yes
• Searched existing discussions, no duplicate requests: Yes
• Application meets criteria (600+ stars if applicable, 6+ months old, maintained, release tarballs): Yes
• Understand not all applications will be accepted: Yes

[aashishvanand]

+1. I've tested a working setup on PVE 9 with an unprivileged Debian 13 LXC, and the PR is open in DevScripts: community-scripts/DevScripts#2431.

What it needs:

• TUN passthrough: /dev/net/tun, via var_tun=yes like netbird/tailscale. With it, the container runs unprivileged.
• Install and enroll: add cloudflare-warp from pkg.cloudflareclient.com, then run warp-cli --accept-tos connector new <token> && warp-cli --accept-tos connect.
• Forwarding gotcha: if you advertise subnets, apply the sysctl file with sysctl -p <file>. sysctl --system fails in unprivileged CTs.
• Same-host gotcha: don't put it in the same CT as cloudflared. The Mesh node captures outbound traffic and breaks cloudflared's connections.

Results: two Mesh nodes reached each other through Cloudflare over TCP, UDP and ICMP in both directions.

Mesh vs. cloudflared: cloudflared's private-network routing over QUIC already carries client→LAN UDP. Mesh's real gain is LAN/site-initiated and device-to-device traffic.