![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Overview
- Replace your VPN
- Secure private apps
- Videos
- Insights
- Overview
- Analytics overview
- Network visibility
- Diagnostics
- Logs
- Overview
- Dashboard logs
- Logpush integration
- Team and resources
- Application Library
- Devices
- Overview
- Cloudflare One Client
- Device registration
- Networks
- Connectivity options
- Connectors
- Cloudflare Tunnel
- Overview
- Configure a tunnel
- Private networks
- Overview
- Connect with cloudflared
- Published applications
- Monitor tunnels
- Other tunnel types
- Overview
- Locally-managed tunnels
- Quick Tunnels
- Cloudflare WAN
- Overview
- WAN transformation
- Get started
- On-ramps
- Configuration
- Configure with Connector
- Overview
- Configure hardware Connector
- Configure Virtual Appliance
- Network options
- Device metrics
- Reference
- Troubleshooting
- Third-party integration
- Alibaba Cloud VPN Gateway
- Amazon AWS Transit Gateway
- Aruba EdgeConnect Enterprise
- Cisco IOS XE
- Cisco Meraki MX (static routing)
- Cisco SD-WAN
- Fortinet
- Furukawa Electric FITELnet
- Google Cloud VPN
- HPE Juniper Networking SRX Series Firewalls
- Microsoft Azure
- Oracle Cloud
- Palo Alto Networks NGFW
- pfSense
- SonicWall
- Sophos Firewall
- strongSwan
- Ubiquiti
- Velocloud
- VyOS
- Yamaha RTX Router
- Security filters
- Cloudflare One integration
- Network Interconnect (CNI)
- Load Balancing
- Public to private via Cloudflare WAN Beta
- Legal
- Granular permissions for Tunnels and Mesh nodes
- Resolvers and proxies
- Virtual networks
- Access controls
- Overview
- Applications
- Overview
- Choose an application type
- Add web applications
- Overview
- SaaS applications
- Overview
- Generic OIDC application
- Generic SAML application
- Adobe Acrobat Sign
- Area 1
- Asana
- Atlassian Cloud
- AWS
- Braintree
- Coupa
- Digicert
- DocuSign
- Dropbox
- GitHub Enterprise Cloud
- Google Cloud
- Google Workspace
- Grafana
- Grafana Cloud
- Greenhouse Recruiting
- Hubspot
- Ironclad
- Jamf Pro
- Miro
- PagerDuty
- Pingboard
- Salesforce (OIDC)
- Salesforce (SAML)
- ServiceNow (OIDC)
- ServiceNow (SAML)
- Slack
- Smartsheet
- SparkPost
- Tableau Cloud
- Workday
- Zendesk
- Zoom
- Self-hosted public application
- Managed OAuthBeta
- Authorization cookie
- Linked App Token
- Add bookmarks
- Service credentials
- Authenticate coding agents
- Event subscriptions
- Troubleshoot Access
- Traffic policies
- Cloud and SaaS findings
- Email security
- Overview
- Retro Scan
- Setup
- Before you begin
- Post-delivery deployment
- API deployment
- BCC/Journaling
- Pre-delivery deployment
- Manage domains
- Monitoring
- Investigation
- Settings
- Domain management
- Auto-move events
- Directories
- Overview
- Manage integrated directories
- Manage Email security directories
- PhishGuard
- Outbound Data Loss Prevention (DLP)
- Troubleshoot Email security
- Email security API API
- Data loss prevention
- Overview
- Data classification
- DLP settings
- Scan HTTP traffic
- Scan SaaS apps
- Scan AI Gateway traffic
- Troubleshoot DLP
- Reusable components
- Integrations
- Cloud and SaaS integrations
- Identity providers
- Overview
- Cloudflare as identity provider
- One-time PIN login
- Generic OIDC
- Generic SAML 2.0
- IdP federation
- Active Directory (SAML)
- Amazon Cognito
- AWS IAM (SAML)
- Centrify
- Centrify (SAML)
- Citrix ADC (SAML)
- GitHub
- Google Workspace
- JumpCloud (SAML)
- Keycloak (SAML)
- Microsoft Entra ID
- Okta
- Okta (SAML)
- OneLogin
- OneLogin (SAML)
- PingFederate
- PingOne
- PingOne (SAML)
- Signed AuthN requests (SAML)
- Yandex
- Roles and permissions
- Tutorials
- Reference architecture
- Account limits
- FAQ
- API and Terraform
- Glossary
- Home
- /Cloudflare One
- /Get started
- /Replace your VPN
Replace your VPN
Cloudflare One uses Cloudflare's global network and Zero Trust Network Access (ZTNA) to replace traditional VPNs. After you securely connect your devices and resources to Cloudflare, you can set policies to verify every request based on identity and context, reducing your attack surface and improving performance for remote users. For more background, refer to Why should you replace your VPN?
How you set this up depends on what needs to connect to what. Choose the scenario that matches your use case:
Device to network
Connect remote users to internal applications and services through a secure connection. Best for remote access to private networks.
Device to device
Create secure, direct connections between two or more devices through Cloudflare's network using Mesh IPs. Best for device-to-device communication.
Network to network
Connect two or more private networks bidirectionally through Cloudflare. Best for linking offices, data centers, or cloud environments.
Note
For in-depth guidance on policy design and device posture checks, refer to the Replace your VPN learning path.
On this page
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}