How do you handle split tunneling for developers who need localhost access?

Hello everyone,

I've been deep in the weeds configuring Cloudflare One for our engineering teams over the last quarter, and a recurring, thorny issue has been split tunneling—or more specifically, the *lack* of it for developer workflows. While I adore the security model of a full tunnel for corporate traffic, it completely breaks a developer's ability to run local services (like an API on `localhost:3000` or a local database) and access them from their machine or for local debugging tools.

Cloudflare One's default posture routes *all* traffic through the WARP client to the Cloudflare network. This is fantastic for security, but it means `localhost` and local network resources become unreachable. For our product development team relying on localhost development, feature flagging with local servers, and personalization engines they need to test, this was a significant roadblock.

After a lot of experimentation and support tickets, we've arrived at a few patterns. I'm sharing them here, hoping to save someone else the headache. The core of the solution lies in the **Cloudflare Zero Trust dashboard > Settings > WARP Client > Split Tunnels**.

**Our approach was a hybrid model:**

* **Exclude IP/CIDR ranges:** We added our internal corporate IP ranges (like `10.0.0.0/8`) to the *Include* list to ensure they're protected. Crucially, we then set the split tunnel mode to **"Exclude IPs and domains."**
* **Critical Domain Exclusions:** In the exclude list, we added:
* `localhost`
* `*.local` (for Bonjour/Avahi discovery)
* `127.0.0.1/32`
* Our internal `.dev` domain for local development
* The specific IP ranges of our on-premise development environments.

**But here's the catch for a pure SaaS setup:** If you have no on-premise IPs and everything is in the cloud, you might need a more nuanced, domain-based rule. We also created Device Posture rules that are a bit more lenient when on our office network, allowing broader exclusions.

I'd love to compare notes with others facing this. How have you balanced the "Zero Trust" mandate with the practical need for localhost access?

* Do you use a different WARP client configuration profile for developers?
* Have you found a way to make dynamic, user-based split tunneling decisions (e.g., only the "Engineering" group gets these exclusions)?
* What are the security implications you've considered? We're auditing this closely.

The documentation is a bit sparse on this specific use case, so real-world workflows are gold. Let's pool our knowledge.