---
title: "How to Expose Hermes Agent Privately with Cloudflare WARP"
canonical_url: "https://techvoyage.dev/article/exposing-hermes-agent-to-private-network-using-cloudflare-warp"
last_updated: "2026-10-20T09:53:39.523Z"
meta:
description: "Learn how to securely expose and access your Hermes Agent globally using Cloudflare WARP and Zero Trust without opening inbound firewall ports."
"og:description": "Learn how to securely expose and access your Hermes Agent globally using Cloudflare WARP and Zero Trust without opening inbound firewall ports."
"og:title": "How to Expose Hermes Agent Privately with Cloudflare WARP"
"twitter:description": "Learn how to securely expose and access your Hermes Agent globally using Cloudflare WARP and Zero Trust without opening inbound firewall ports."
"twitter:title": "How to Expose Hermes Agent Privately with Cloudflare WARP"
---
[Home](https://techvoyage.dev/)
 # **How to Expose Hermes Agent Privately with Cloudflare WARP**
Learn how to securely expose and access your Hermes Agent globally using Cloudflare WARP and Zero Trust without opening inbound firewall ports.
Jul 9, 2026 -Updated Sep 28, 2026 -8 MIN READ
[**AI & Agents**](https://techvoyage.dev/category/ai-agents) [**Security**](https://techvoyage.dev/category/security)
Table of contents
A common challenge arises when you want to access your **Hermes Agent** from other devices such as laptops, tablets, or phones without exposing it to the public internet. Utilizing **Cloudflare WARP** with **Cloudflare Zero Trust** allows you to expose the Hermes Agent globally without opening a single inbound port on your firewall.
If you followed our previous guide, ' [**How to Deploy Hermes Agent on a Linux VPS**](https://techvoyage.dev/article/how-to-setup-hermes-on-remote-server)', a Hermes Agent is already up and running 24/7. Instead of dealing with the overhead of traditional VPNs, we will use the **Cloudflare WARP** client to expose the Hermes Agent to a private network over the internet.
## Understanding the Architecture
The components at play: 1. **Cloudflare Zero Trust**: The dashboard at Cloudflare where you define routing rules and access policies. 2. **Cloudflare WARP**: The client application installed on your devices (VPS, laptops, phones). It intercepts traffic destined for your private network and routes it securely. ### Prerequisites
- A running Hermes Agent on your VPS. - A free Cloudflare account. ## Step-by-Step Guide
### Step 1: Set Up Cloudflare Zero Trust 1. Log in to your [**Cloudflare Dashboard**](https://dash.cloudflare.com/). 2. Click on 'Zero Trust' from the left menu.  3. If this is your first time, you will be prompted to choose a plan (the Free tier is perfectly fine for this setup) and name your team (e.g., `**ai-team**`).  4. Click on 'Access' then 'Policies' to create an access policy defining who has access to the network.  5. Click on 'Create new policy'.  6. Select 'Emails' and enter your email under 'Policy rules'.  ### Step 2: Set Up Cloudflare WARP Client on VPS 1. Run `**sudo apt update**` and `**sudo apt install cloudflare-warp**` in the terminal on your VPS. 2. Run `**warp-cli registration new **` in the terminal on your VPS, which will print out a URL. 3. Copy the printed URL, which will look like `**https://.cloudflareaccess.com/warp**`, and paste it in your browser for authentication. 4. Since email authentication is used in the policy rule setup above, enter your email to authenticate. 5. On the '**Success**' page in the browser, right-click and select '**Inspect**' on the blue '**Open Cloudflare WARP**' button. 6. Copy the long token that is shown in the button's link. 7. Run `**warp-cli --accept-tos registration token "https://.cloudflareaccess.com/auth?token="**` in the terminal on your VPS to connect it to Cloudflare Zero Trust.If the 'Error: Failed to communicate with the WARP API' is encounter on Ubuntu 26, run the following commands:
```
sudo systemctl restart warp-svc.service
# Check status
sudo systemctl status warp-svc.service
# Run the warp-cli registration token again
warp-cli --accept-tos registration token "https://.cloudflareaccess.com/auth?token="
```
8. Head back to the Cloudflare Zero Trust dashboard, and click on 'Devices'. Your VPS device should now be displayed.  ### Step 3: Set Up Traffic Routing 1. Click the profile for your VPS on the Devices dashboard.  2. Scroll down to the 'Split Tunnels' section.  3. Click the 'Manage' button and configure the settings as shown below. Replace the IP address if necessary.  4. Exposing the `**address**` and `**host**` will route traffic to your services over the same private network. ### Step 4: Configure Firewall on the VPS Enable the firewall to allow the '100.96.0.0/12' subnet only, blocking all other public incoming access.```
sudo ufw enable
sudo ufw default allow outgoing
sudo ufw default deny incoming
sudo ufw allow in from 100.96.0.0/12
``` Allow loopback traffic to avoid breaking local services:```
sudo ufw allow in on lo
sudo ufw allow out on lo
``` Reload the firewall and verify status:```
sudo ufw reload
sudo ufw status verbose
```### Step 5: Expose Hermes Agent to the Private Network We will expose the **Hermes Agent Web Dashboard** to our private network and use the default authentication provider, **Nous Research**. #### Set Up the Auth Provider 1. Head to [**portal.nousresearch.com**](https://portal.nousresearch.com) to register an account. 2. Select 'Local Dashboards'.  3. Click 'Register Dashboard'.  4. Enter the private network IP address of your VPS as the 'Dashboard redirect URI' and click 'Save'.  5. Copy the 'OAuth client ID' and paste it in your `**config.yaml**` file:```
dashboard:
theme: default
show_token_analytics: false
oauth:
client_id: agent:cmq02x7ha0002jk0ba3kfnb
portal_url: https://portal.nousresearch.com
basic_auth:
username: ''
password_hash: ''
```#### Set Up Systemd to Autostart the Hermes Dashboard 1. Create a service file:```
sudo nano /etc/systemd/system/hermes-dashboard.service
```1. Paste the following configuration, ensuring `**--host 0.0.0.0**` is part of the command:```
[Unit]
Description=Hermes Dashboard
After=network.target
[Service]
User=hermes
WorkingDirectory=/home/hermes
ExecStart=/home/hermes/.local/bin/hermes dashboard --host 0.0.0.0
Restart=always
RestartSec=10
Environment=PATH=/home/hermes/.local/bin:/usr/local/bin:/usr/bin:/bin
[Install]
WantedBy=multi-user.target
```1. Enable and start the service:```
sudo systemctl daemon-reload
sudo systemctl enable hermes-dashboard
sudo systemctl start hermes-dashboard
sudo systemctl status hermes-dashboard
```### Step 6: Install Cloudflare WARP Client on Desktop 1. Download the Cloudflare WARP client from [**Cloudflare's portal**](https://developers.cloudflare.com/warp-client/get-started/). 2. Open and launch the Cloudflare WARP client after installation. 3. Log in when prompted.  4. A 'Success' page will be displayed after a successful login.  5. The WARP client should now show it is connected to your Zero Trust team.  6. Navigate to your web browser and enter your private IP (e.g., `**100.96.0.3**`). The Hermes Web Dashboard should load successfully.  > **Pro Tip for macOS Users:** If you are using the WARP client to access multiple Cloudflare accounts, check out our quick guide on **[**Switch Between Multiple Cloudflare WARP Orgs on Mac**](https://techvoyage.dev/article/switch-between-multiple-cloudflare-warp-orgs-on-mac)** to make switching between accounts seamless. ### Step 7: Install Cloudflare WARP Client on iOS Devices 1. Install **Cloudflare One** from the App Store. 2. Open the Cloudflare One app and enter your team name when prompted.  3. Log in using the same email address that was configured in the policy rule above.  4. Once it is connected, it should look like the following:  5. Navigate to your web browser and enter the private IP `**100.96.0.3**` to access the Hermes Web Dashboard on your mobile device.  ## Conclusion With **Cloudflare Zero Trust** handling identity policies and the **WARP** client routing traffic over an encrypted tunnel, your Hermes Agent is securely reachable from your devices globally. This setup lays a secure, robust foundation for building and accessing a fully remote, private AI infrastructure. [Share](https://api.whatsapp.com/send?text=https%3A%2F%2Ftechvoyage.dev%2Farticle%2Fexposing-hermes-agent-to-private-network-using-cloudflare-warp) [Share](https://www.reddit.com/submit?url=https%3A%2F%2Ftechvoyage.dev%2Farticle%2Fexposing-hermes-agent-to-private-network-using-cloudflare-warp) [Share](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ftechvoyage.dev%2Farticle%2Fexposing-hermes-agent-to-private-network-using-cloudflare-warp) [Share](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ftechvoyage.dev%2Farticle%2Fexposing-hermes-agent-to-private-network-using-cloudflare-warp) [Share](https://x.com/intent/post?url=https%3A%2F%2Ftechvoyage.dev%2Farticle%2Fexposing-hermes-agent-to-private-network-using-cloudflare-warp) ## **Related Articles**[**Security****Switch Between Multiple Cloudflare WARP Orgs on Mac**
Configure and switch multiple Cloudflare WARP organisations on macOS using a .mobileconfig file. A complete MDM guide for IT admins.**4 MIN READ **](https://techvoyage.dev/article/switch-between-multiple-cloudflare-warp-orgs-on-mac) [**AI & Agents****How to Deploy Hermes Agent on a Linux VPS**
Deploy the Hermes Agent on a remote VPS for 24/7 uptime. Follow our step-by-step guide to integrate it with a custom Telegram bot.**5 MIN READ **](https://techvoyage.dev/article/how-to-setup-hermes-on-remote-server) [**AI & Agents****Bringing Buzz to DeepSeek Harness: Taught to Speak Nostr**
Integrate DeepSeek Harness with Block Buzz using a Nostr bridge. Configure NIP-42 auth, in-place message streaming, and per-channel agent workspaces.**9 MIN READ **](https://techvoyage.dev/article/bringing-buzz-to-deepseek-harness) [](https://techvoyage.dev/article/sync-obsidian-across-devices) [](https://techvoyage.dev/article/bringing-buzz-to-deepseek-harness)