WARP (cloudflared tunnel) TCP handshake behaviour

Related to

Cloudflare Tunnel

What is the issue you’re encountering

Can someone explain how traffic to destination is proxied through cloudflared-tunnel regarding TCP handshake? If you do a test-netconnection to a destination ip and port for example SSH the tcp test is succeeded but for example through a SSH client like Putty the traffic is not allowed. So when does cloudflare actually step in to middle of the session and block it?