Cloudflare Mesh

50,000 routes per account and Tunnels for Platforms

Two changes make it easier to run Cloudflare Tunnel at scale. 50,000 routes per account by default The default limit for routes is now 50,000 per account, up from 1,000. This limit covers CIDR routes and hostname routes for Cloudflare Tunnel and Cloudflare Mesh. The new limit applies to every account automatically, with no action required. Published applications (public hostnames) are not routes…

Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session. Gateway network logs and Zero Trust Network Session Logs now identify two new kinds of traffic: Mesh — Traffic sent from or delivered to a Cloudflare…

Add Mesh participants with guided onboarding

Cloudflare Mesh now makes it faster to add and manage participants from the dashboard. Select Add participant from Networking > Mesh to deploy a Mesh node or find the information needed to connect a client device. The updated dashboard includes the following improvements: More Mesh node deployment options — Install a node on Linux, Kubernetes, Docker Compose, or Docker CLI. The dashboard provides…

Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once

You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time. When creating a route, you can now: Add multiple destinations at once — Enter a comma-separated list of CIDR ranges or hostnames to create several routes of the same type and connector together. Queue up multiple routes — Select Add another t…

Hostname routing is now generally available, with a new public IP range for initial resolved IPs

Hostname routing ↗︎ is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: Cloudflare Tunnel: route a private hostname (for example, wiki.internal.local) to a private application behind your tunnel, or a public hostname (for example, bank.example.com) to egress through a specific tunnel and anchor tr…

Container image for Cloudflare Mesh

Cloudflare Mesh nodes can now run as Docker containers. The cloudflare/mesh ↗︎ image is available on Docker Hub for Docker Compose, Kubernetes, and any OCI-compatible runtime — no host-level package installation required. The image supports amd64 and arm64 architectures and includes built-in source NAT so return traffic routes correctly without VPC route table changes. Deployment patterns Docker…

Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026

On October 5, 2026, two changes take effect across the Zero Trust Networks API and Cloudflare Tunnel API: the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the connections field. If you manage private network routes or read tunnel connection details through the API, cloudflared, Terraform, or another integration, review the changes in the following…

Hostname routing for Cloudflare Mesh

You can now add hostname routes to a Cloudflare Mesh node, in addition to CIDR routes. Client device Requests wiki.internal.local DNS query↓ Cloudflare Gateway Returns a token IP, then rewrites the destination to the real private IP. 172.64.128.0/20 Hostname route↓ Mesh node Forwards traffic to the host on the local network ↓ Private host wiki.internal.local · 10.0.0.50 Instead of managing IP ran…

Manage all your routes from one page in the dashboard

The Routes page in the Cloudflare dashboard now shows the routes across all of your connectors — Cloudflare Mesh and Cloudflare Tunnel routes alongside Cloudflare WAN and Magic Transit static routes — in a single table, instead of a separate routes view per product. From the unified Routes page you can: Visualize your network with an interactive map that shows how your destinations flow through t…

Filter Workers' public Internet traffic using Gateway policies

Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway. This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today. Worker Calls env.EGRESS.fetch() VPC binding↓ Cloudflare Mesh Bind via cf1:net…

High availability replica management for Cloudflare Mesh

The Cloudflare Mesh dashboard now shows per-replica details for high availability nodes. You can see which replica is active, view each replica's Mesh IP and connection details, and manually trigger failover — all from the node detail page. What's new Replica tabs on the node detail page — switch between replicas to see each one's Mesh IP, edge data center, origin IP, platform, version, and uptim…

Granular permissions for Cloudflare Tunnel and Cloudflare Mesh

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. What is new When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopa…