
Cloudflare Mesh node and client can't reach each other at all (ICMP + TCP both dead, both directions)
I setup Cloudflare Mesh today with one node a MikroTik router (native WireGuard, registered via the connector flow), one client is my Linux laptop running the Cloudflare One client. Dashboard shows both online, one mesh node, one connected device, looks totally normal.
Problem: they can't ping or reach each other over TCP at all but just dead in both directions.
What I've already ruled out, because I went pretty deep on this:
- Client's split tunnel was excluding the whole 100.64.0.0/10 CGNAT block by default, which happens to swallow Cloudflare's own 100.96.0.0/12 mesh range. Fixed that (split it into two narrower ranges that carve out the mesh block specifically). Confirmed the client actually picked up the new routes (checked the policy routing table directly, 100.96.0.0/12 is there pointing at the WARP interface).
- General internet ping through the same WARP tunnel works fine (1.1.1.1 replies normally), so it's not like ICMP is broken on the client or blocked account-wide.
- Router side: checked the firewall rules directly (input/output/forward chains), nothing blocking it, RouterOS default-accepts what's not explicitly matched anyway.
- Router's own connection tracking shows it's receiving the ping requests from the client and sending back exactly as many replies (seen-reply: true, matching packet counts), so the router 100% gets the ping and answers it. The client just never sees the reply.
- Flipped it around: had the router ping the client's mesh IP instead. Same result, 100% timeout, both ways.
- TCP to the router's mesh IP (checked ports 8728 and 8291) also just hangs, so it's not ICMP-specific either.
- Checked rp_filter on the client (loose mode, not strict), ufw (inactive), nftables (nothing relevant), nothing OS-level blocking it on my end.
- "Allow Secure Web Gateway to proxy traffic" already has ICMP enabled.
So both endpoints look completely healthy in isolation, but the mesh relay between this specific node/client pair just isn't working. Anyone run into this before? Or anyone who can help me out with pointing out other cases I haven't checked.
Thank you