Cloudflare WAN

Cloudflare WAN supports regional Gateway HTTP inspection

Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data center (that may be outside the selected region) via an IPsec or GRE tunnel, or through Direct CNI, and remains encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. This feature gives organizations control over where their sens…

BGP route filtering for IPsec and GRE tunnels

Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering. Create reusable filter profiles that specify an allow or deny action and a list of Classless Inter-Domain Routing (CIDR) targets with exact, more-specific, or prefix-length matching. Each tunnel supports one import filter and one export filter. You can create and assign profiles through the dashboa…

BGP over IPsec and GRE tunnels generally available

BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads. BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes. BGP over IPsec and GRE tunnels is available to all accounts that use…

Managed Rulesets supported in Unified Routing

Cloudflare Advanced Network Firewall Managed Rulesets are now supported for accounts using Unified Routing mode. For the full list of feature availability, refer to Check feature availability before upgrading.

Unified Routing generally available

Unified Routing is generally available for Cloudflare WAN and Magic Transit. Unified Routing improves the integration between Cloudflare One and the standard connectivity onramps supported by Cloudflare WAN. It is capable of many new features including Automatic Return Routing, BGP and custom client subnets. We recommend Unified Routing for all new accounts. For details, refer to Cloudflare WAN t…

Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard

You can now define custom applications for breakout and prioritized traffic on the Cloudflare One Appliance directly from the dashboard, without calling the API. In Traffic Steering > Breakout traffic or Prioritized traffic, select Assign application traffic > Add to create a custom application matched by Hostnames, IP subnets, and/or the new Source subnets field, alongside Cloudflare-managed app…

Configure DHCP options from the dashboard on Cloudflare One Appliance

You can now configure custom DHCP options directly from the dashboard when the Cloudflare One Appliance is acting as the DHCP server for a LAN. In LAN configuration, under DHCP server options, select Add DHCP option to choose from common options for PXE / iPXE boot, VoIP phone provisioning, and vendor-specific configuration, or select Add custom option to enter your own option code, type, and val…

Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once

You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time. When creating a route, you can now: Add multiple destinations at once — Enter a comma-separated list of CIDR ranges or hostnames to create several routes of the same type and connector together. Queue up multiple routes — Select Add another t…

Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard

When you register a Cloudflare One Virtual Appliance, you can now select your hypervisor and download the appliance directly from the dashboard — no need to look up asset URLs. On the Connectors page, select Add an appliance, choose Virtual appliance, then select your hypervisor: VMware ESXi, Proxmox, or libvirt/KVM. Download the OVA image (VMware ESXi) or the install script (Proxmox and libvirt/…

Threat Intel Lists supported in Unified Routing

Cloudflare Advanced Network Firewall Threat Intel Lists are now supported for accounts using Unified Routing mode. This feature requires a Cloudflare Advanced Network Firewall subscription. Support for additional features - Rate Limiting and Managed Rulesets - is planned. For the full list of current beta limitations, refer to Traffic steering beta limitations.

Restart, reboot, or shut down a Cloudflare One Appliance from the dashboard

You can now restart, reboot, or shut down a Cloudflare One Appliance directly from the dashboard or via API. Restart — Restart managed services. Purges temporary and (optionally) persistent state. Reboot — Power cycle the appliance. Optionally, purge persistent state. Re-applies configuration starting from scratch. Shutdown — Power off the appliance. Optionally, purge persistent state. The machin…

IPsec downgrade protection (beta)

Cloudflare IPsec now supports the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH ↗︎ IKEv2 extension to protect against downgrade attacks on IPsec tunnels. IKEv2's original authentication design has each endpoint sign only its own outbound messages, not the full handshake transcript. A quantum-capable on-path attacker ↗︎ can exploit this to bypass post-quantum key exchange by downgrading the connection to class…

IP lists, IDS, and SIP rules supported in Unified Routing

Cloudflare Advanced Network Firewall IP lists, IDS, and SIP rules are now supported for accounts using Unified Routing mode. These features require a Cloudflare Advanced Network Firewall subscription. Support for additional features - Threat Intel Lists, Rate Limiting, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to Traffic steering beta limitations.

Self-serve registration of Cloudflare One Virtual Appliance in the dashboard

You can now register a Cloudflare One Virtual Appliance and generate its license key directly from the dashboard, without contacting your account team. On the Connectors page, select Add an appliance and choose Virtual appliance to register a virtual appliance and generate its authentication key. Use Regenerate authentication key from a virtual appliance connector's menu to rotate its key. The pr…

Manage all your routes from one page in the dashboard

The Routes page in the Cloudflare dashboard now shows the routes across all of your connectors — Cloudflare Mesh and Cloudflare Tunnel routes alongside Cloudflare WAN and Magic Transit static routes — in a single table, instead of a separate routes view per product. From the unified Routes page you can: Visualize your network with an interactive map that shows how your destinations flow through t…

Cisco IOS XE

The Cisco IOS XE third-party integration guide for Cloudflare WAN has been updated to include: Post Quantum Cryptography (PQC) Policy-Based Routing (PBR) IP Service Level Agreement (IP SLA) This link will take you directly to the updated Cisco IOS XE guide.

Network Analytics support for Unified Routing

Network Analytics is now fully supported for accounts using Unified Routing mode. Traffic that traverses Unified Routing onramps and offramps is now visible in Network Analytics with the same dimensions and filters as traffic on the standard data plane. This closes a parity gap for customers who had moved tunnels onto Unified Routing and lost visibility into their dataplane traffic in the Network…

New accounts assigned a single IPv4 anycast address

New Magic Transit and Cloudflare WAN accounts are now assigned a single IPv4 anycast address by default. Cloudflare handles failures on its network automatically by advertising your endpoint IP from multiple nodes across many globally distributed data centers. To handle failures on your network, configure two tunnels from separate routers. To request additional anycast IP addresses for your accou…

NAT-T support for IKE on UDP port 500

Cloudflare IPsec now supports the standard NAT traversal (NAT-T) flow, where IKE begins on UDP port 500 and switches to UDP port 4500 after NAT is detected. Previously, devices behind NAT had to be configured to initiate IKE on UDP port 4500 directly. Devices that started on UDP port 500 could not complete the IKE handshake when NAT was in the path. This required custom configuration on devices s…

Custom DHCP options on Cloudflare One Appliance

When the Cloudflare One Appliance is acting as the DHCP server for a LAN, you can now configure custom DHCP options on the leases it issues. This unlocks workflows such as PXE / iPXE boot, VoIP phone provisioning, and vendor-specific client configuration. Each option is defined by option_number, value, and one of four value types: text, integer, hex, or ip. Configurations are validated on the app…

Source-based breakout and prioritization on Cloudflare One Appliance

Breakout and traffic prioritization rules on the Cloudflare One Appliance can now match by source in addition to destination application. You can pin breakout or priority behavior to: A source LAN interface — VLANs attached to that LAN are included automatically. A source IP address, range, or CIDR block. This is the natural way to break out a guest VLAN to the local Internet, or to prioritize tr…

Self-serve provisioning of Cloudflare One Virtual Appliance via API

You can now create, rotate, and delete Cloudflare One Virtual Appliance instances and their license keys directly via the API and Terraform. Create a virtual appliance and receive a license key: POST /accounts/{account_id}/magic/connectors with device.provision_license: true. Rotate the license key for an existing virtual appliance: PATCH /accounts/{account_id}/magic/connectors/{connector_id} wit…

Post-quantum IPsec interoperability with third-party devices

Cloudflare IPsec now supports post-quantum key agreement with compatible third-party devices. Cisco ↗︎ and Fortinet ↗︎ are the first third-party vendors validated to interoperate with Cloudflare IPsec using ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). Post-quantum IPsec uses RFC 9370 ↗︎ and draft-ietf-ipsecme-ikev2-mlkem ↗︎ to negotiate hybrid key agreement during the IKEv2 IKE_INTE…

Country rules supported in Unified Routing

Cloudflare Advanced Network Firewall Country rules are now supported for accounts using Unified Routing mode. This feature requires a Cloudflare Advanced Network Firewall subscription. You can create firewall rules that match traffic based on source or destination country to enforce geographic access policies across your network. This is the first of the Cloudflare Advanced Network Firewall featu…

Link aggregation (LACP) support for Cloudflare One Appliance

Cloudflare One Appliance now supports Link Aggregation Control Protocol (LACP), allowing you to bundle up to six physical LAN ports into a single logical interface. Link aggregation increases available bandwidth and eliminates single points of failure on the LAN side of the appliance. This feature is available in beta on physical appliance hardware with the latest OS. No entitlement is required.…

Cloudflare One Product Name Updates

We are updating naming related to some of our Networking products to better clarify their place in the Zero Trust and Secure Access Service Edge (SASE) journey. We are retiring some older brand names in favor of names that describe exactly what the products do within your network. We are doing this to help customers build better, clearer mental models for comprehensive SASE architecture delivered…

Anycast IPs displayed on the dashboard

Cloudflare WAN now displays your Anycast IP addresses directly in the dashboard when you configure IPsec or GRE tunnels. Previously, customers received their Anycast IPs during onboarding or had to retrieve them with an API call. The dashboard now pre-loads these addresses, reducing setup friction and preventing configuration errors. No action is required. All Cloudflare WAN customers can see the…

Post-quantum encryption support for Cloudflare One Appliance

Cloudflare One Appliance version 2026.2.0 adds post-quantum encryption support using hybrid ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). The appliance now uses TLS 1.3 with hybrid ML-KEM for its connection to the Cloudflare edge. During the TLS handshake, the appliance and the edge share a symmetric secret over the TLS connection and inject it into the ESP layer of IPsec. This prote…

BGP over GRE and IPsec tunnels

Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using IPsec and GRE tunnel on-ramps (beta). Using BGP peering allows customers to: Automate the process of adding or removing networks and subnets. Take advantage of failure detection and session recovery features. With this functiona…

Configure Cloudflare source IPs (beta)

Cloudflare source IPs are the IP addresses used by Cloudflare services (such as Load Balancing, Gateway, and Browser Isolation) when sending traffic to your private networks. For customers using legacy mode routing, traffic to private networks is sourced from public Cloudflare IPs, which may cause IP conflicts. For customers using Unified Routing mode (beta), traffic to private networks is source…

Network Services navigation update

The Network Services menu structure in Cloudflare's dashboard has been updated to reflect solutions and capabilities instead of product names. This will make it easier for you to find what you need and better reflects how our services work together. Your existing configurations will remain the same, and you will have access to all of the same features and functionality. The changes visible in you…

Breakout traffic visibility via NetFlow

Magic WAN Connector now exports NetFlow data for breakout traffic to Magic Network Monitoring (MNM), providing visibility into traffic that bypasses Cloudflare's security filtering. This feature allows you to: Monitor breakout traffic statistics in the Cloudflare dashboard. View traffic patterns for applications configured to bypass Cloudflare. Maintain visibility across all traffic passing throu…

Automatic Return Routing (Beta)

Magic WAN now supports Automatic Return Routing (ARR), allowing customers to configure Magic on-ramps (IPsec/GRE/CNI) to learn the return path for traffic flows without requiring static routes. Key benefits: Route-less mode: Static or dynamic routes are optional when using ARR. Overlapping IP space support: Traffic originating from customer sites can use overlapping private IP ranges. Symmetric r…

Designate WAN link for breakout traffic

Magic WAN Connector now allows you to designate a specific WAN port for breakout traffic, giving you deterministic control over the egress path for latency-sensitive applications. With this feature, you can: Pin breakout traffic for specific applications to a preferred WAN port. Ensure critical traffic (such as Zoom or Teams) always uses your fastest or most reliable connection. Benefit from auto…

DNS filtering for private network onramps

Magic WAN and WARP Connector users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet. Routing DNS traffic to the Gateway resolver allows DNS resolution and filtering for traffic coming from private networks while preserving source internal IP visibility. This ensures Magic WAN users have full integration with our Cloudflare One featur…

Custom IKE ID for IPsec Tunnels

Now, Magic WAN customers can configure a custom IKE ID for their IPsec tunnels. Customers that are using Magic WAN and a VeloCloud SD-WAN device together can utilize this new feature to create a high availability configuration. This feature is available via API only. Customers can read the Magic WAN documentation to learn more about the Custom IKE ID feature and the API call to configure it.

Bidirectional tunnel health checks are compatible with all Magic on-ramps

All bidirectional tunnel health check return packets are accepted by any Magic on-ramp. Previously, when a Magic tunnel had a bidirectional health check configured, the bidirectional health check would pass when the return packets came back to Cloudflare over the same tunnel that was traversed by the forward packets. There are SD-WAN devices, like VeloCloud, that do not offer controls to steer tr…

Terraform V5 support for tunnels and routes

The Cloudflare Terraform provider resources for Cloudflare WAN tunnels and routes now support Terraform provider version 5. Customers using infrastructure-as-code workflows can manage their tunnel and route configuration with the latest provider version. For more information, refer to the Cloudflare Terraform provider documentation ↗︎.

Magic Transit and Magic WAN health check data is fully compatible with the CMB EU setting.

Today, we are excited to announce that all Magic Transit and Magic WAN customers with CMB EU (Customer Metadata Boundary - Europe) enabled in their account will be able to access GRE, IPsec, and CNI health check and traffic volume data in the Cloudflare dashboard and via API. This ensures that all Magic Transit and Magic WAN customers with CMB EU enabled will be able to access all Magic Transit a…

Virtual Cloudflare One Appliance with KVM support (open beta)

The KVM-based virtual Cloudflare One Appliance is now in open beta with official support for Proxmox VE. Customers can deploy the virtual appliance on KVM hypervisors to connect branch or data center networks to Cloudflare WAN without dedicated hardware. For setup instructions, refer to Configure a virtual Cloudflare One Appliance.

Cloudflare One Appliance supports multiple DNS server IPs

Cloudflare One Appliance DHCP server settings now support specifying multiple DNS server IP addresses in the DHCP pool. Previously, customers could only configure a single DNS server per DHCP pool. With this update, you can specify multiple DNS servers to provide redundancy for clients at branch locations. For configuration details, refer to DHCP server.

Configure your Magic WAN Connector to connect via static IP assignment

You can now locally configure your Magic WAN Connector to work in a static IP configuration. This local method does not require having access to a DHCP Internet connection. However, it does require being comfortable with using tools to access the serial port on Magic WAN Connector as well as using a serial terminal client to access the Connector's environment. For more details, refer to WAN with…

Establish BGP peering over Direct CNI circuits

Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using a Direct CNI on-ramp. Using BGP peering allows customers to: Automate the process of adding or removing networks and subnets. Take advantage of failure detection and session recovery features. With this functionality, customers…

Explore product updates for Cloudflare One

Welcome to your new home for product updates on Cloudflare One. Our new changelog lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs. If you are looking for older product updates, refer to the following locations. Older product updates Access Browser Isolation CASB Cloudflare Tunnel Data Loss Prevention Digital Experience Monitoring Ema…