Enroll the remote device and route traffic

Install the Cloudflare One Client on the remote device — the laptop playing the role of your remote worker. Log in to Cloudflare Zero Trust with the team name and allowed identity. The client asks for the team name first, then opens a browser window for the identity check. Only the email your enrollment rule allows gets through, which is the rule doing its job.

Use Traffic and DNS mode for the complete lab. The client has several operating modes, and some of them only filter DNS queries without carrying packets. This lab needs both traffic and name resolution flowing through Cloudflare, so anything less will produce confusing half-working behavior.

Now the routing question. Cloudflare excludes RFC 1918 private ranges by default. That default exists for a good reason: it keeps home printers, NAS boxes, and local networks working for every enrolled device. But your lab resource lives inside one of those excluded ranges, so right now its traffic never leaves the laptop’s local network.

Adjust Split Tunnels so the exact lab IP or CIDR goes through the client. In the default Exclude mode, that means editing the entry covering your lab range — remove the broad 10.0.0.0/8 exclusion and re-add the narrower pieces you still want excluded, leaving your lab address routed.

Then verify from the remote device, ideally on a different network than the resource — a phone hotspot makes the test honest:

ping -c 2 10.0.1.100
# 64 bytes from 10.0.1.100: icmp_seq=1 ttl=63 time=42.1 ms

Keep the routed range narrow. A broad private range can overlap the user’s home network and send local devices to the wrong place — the laptop suddenly cannot print at home because 192.168.1.9 is being shipped into the tunnel.

When a routed IP is unreachable from an enrolled device, check the Split Tunnels list before anything else. Forgetting this adjustment is the single most common failure in the whole lab: the device is connected, the connector is healthy, every dashboard light is green, and the packets quietly stay local.