Cloudflare WAN Configuration Generator

Connect to Cloudflare

Account ID Find your Account ID in the dashboard sidebar

API Token Create token with "Cloudflare WAN Read" permission

Configure

Select Tunnel

Type -

Cloudflare Endpoint -

Interface Address -

Tunnel Source

Your device's WAN IP address or source interface name

Pre-Shared Key (PSK)

Target Device View official device configuration guides

Behind NAT

Router has a private WAN IP / sits behind NAT or CGNAT. Forces UDP 4500 encapsulation. Set Router WAN IP in Advanced if your IPsec daemon needs to bind to the inside-NAT address.

Strip Comments

Remove comment lines and section headers from output

Use AI Generation

Generate config using Workers AI with current documentation context

Advanced

Router WAN IP (optional)

Private/inside-NAT IP the router actually has on its WAN. strongSwan and similar daemons need this to bind.

WAN Interface (optional)

Override per-device default WAN interface name (e.g. wan2, eth1).

Tunnel Index (optional)

Per-tunnel suffix (Juniper st0.<N>, Cisco Tunnel<N>, vti<N>). Defaults to a stable hash of the tunnel name.

Configuration Output

No configuration generated

Connect and select a tunnel to generate device configuration

Troubleshooting Assistant

Paste your device logs, error messages, or describe the issue you're experiencing with your Cloudflare WAN tunnel.