Overview
The cloud connector enables client’s MyWorkDrive Servers to be reached from the internet without installing a local SSL Certificate, creating a host name or opening any inbound firewall ports through Cloudflare's tunnel service.
These same relays are also used to enable Office 365 document editing online through our Microsoft Cloud Storage Provider partnership. The cloud connector or Office 365 Editing can be enabled independently but they both use the Cloudflare Argo tunnel reverse proxy system.
Each server connects to our back end through the “Argo Tunnel” service. This service must be running to allow connectivity for end users through our relay service. Our service is designed to monitor connectivity, log any errors and automatically reconnect as needed should there any loss of connectivity. All errors are logged under C:\wanpath\wanpath.data\logs\cloudflared
Troubleshooting
Step 1
Ensure your MWD server license is valid and licensed - this feature requires a licence or active trial - you can confirm your license in Settings on the Admin Panel. Make sure the "MyWorkDrive Service" is running in services.msc
Step 2
Ensure the local site is running by connecting to http://127.0.0.1:8357 If there are any issues check and restart IIS services as needed or run “IISreset” from the command line. If the site still does not open after running IISreset, open sites in IIS Manager, browse to Wanpath.webclient site. Check to see if site is not started. If not, check bindings on the webclient site. Make sure other sites - such as default website do have have conflicting bindings. Typically this would be port 80. Remove port 80 from the Web Client site or from default website is not used there. Then start the WebClient site. This should fix the issue.
Step 3
Ensure the Cloudflare "Cloudflared" service is up and running – start or restart as needed - this will only start if Office 365 editing or cloud connector is enabled on the MWD admin panel
Step 4
Review the cloud connector status on the admin panel. Click the settings tab, under Cloud web Connector click Refresh – note any change in status
Other items to review
If Office Online shows as up, but Edit in Office Online is not available in the web client, and you have DLP enabled, check that Office Online Edit has been enabled on the shares. If you have DLP enabled without Office Online, that setting will be disabled when Office Online is enabled. See Granular Permission settings on Shares
Review the server system and application logs for errors – check for any server or service shutdowns.
Review the LAN interface card settings on the server – ensure sleep is disabled on the card.
Review your ISP connectivity – check for any outage in your area.
Review Antivirus software – ensure any antivirus software is not blocking our service. Review our Antivirus Settings Article.
Review and Firewalls and ensure outbound ports are not blocking Cloudflare Argo tunnel communications on ports: 443, 7844
Test communications on port 7844 outbound to Cloudflare Argo tunnel service:
Launch powershell on the MyWorkDrive server and type the following command to test connecting on TCP port 7844 one of the Cloudflare IP’s:
test-netconnection -computername 198.41.192.7 -port 7844
The results should come back like below with
TcpTestSucceeded:True:
ComputerName : 198.41.192.7
RemoteAddress : 198.41.192.7
RemotePort : 7844
InterfaceAlias : Lan
SourceAddress : 10.10.200.20
TcpTestSucceeded : True
If TcpTestSucceeded returns false a firewall or antivirus is blocking TCP port 7844 outbound from the MyWorkDrive server and needs to be investigated.
Outgoing DNS Firewall
If you use outbound DNS filtering, please note Cloudflare looks up what IPs it should use based on lookups on specific domains and edge discovery. Please allow these domains outbound.
Edge connections (TCP/UDP 7844)
- region1.v2.argotunnel.com and region2.v2.argotunnel.com (default)
- us-region1.v2.argotunnel.com and us-region2.v2.argotunnel.com (only when using --region us)
- fed-region1.v2.argotunnel.com and fed-region2.v2.argotunnel.com (FedRAMP)
Discovery and SNI
If the firewall enforces SNI, these hostnames must also be allowed on port 7844:
- **_v2-origintunneld._tcp.argotunnel.com** (SRV record used for edge discovery)
- cftunnel.com, h2.cftunnel.com, and quic.cftunnel.com
Supporting services
- api.cloudflare.com and update.argotunnel.com: software update checks
- github.com: release downloads
- <team-name>.cloudflareaccess.com: Access JWT validation (only if Access is enabled)
- pqtunnels.cloudflareresearch.com: post-quantum error reporting
- cfd-features.argotunnel.com: DNS TXT lookup used for UDP datagram version negotiation
DNS filtering
These names must also resolve normally through the server's DNS resolver. If a DNS filter blocks or rewrites them, cloudflared may fail to connect, or may log "You requested 4 HA connections but I can give you at most 2." Allow-list argotunnel.com and cftunnel.com as whole domains rather than individual hostnames.
Reference: Cloudflare: Tunnel with firewall
See our Firewall settings article for additional considerations regarding firewall settings.