Cloudflare Tunnel

Cloudflare Tunnel supports URL normalization

Starting from version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same. In three months, starting 2027-01-25, new cloudflared releases will turn on URL normalization by default. Test your path-based routing before that date, as this…

Granular Tunnel Read And Monitor role is generally available

The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available. You can grant a member read access and log streaming for specific Cloudflare Tunnel instances without granting write access or access to every Tunnel in your account. This role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read: viewing selected Tunnels, their…

50,000 routes per account and Tunnels for Platforms

Two changes make it easier to run Cloudflare Tunnel at scale. 50,000 routes per account by default The default limit for routes is now 50,000 per account, up from 1,000. This limit covers CIDR routes and hostname routes for Cloudflare Tunnel and Cloudflare Mesh. The new limit applies to every account automatically, with no action required. Published applications (public hostnames) are not routes…

Protect Quick Tunnels with email authentication

You can now restrict who can access a Quick Tunnel. Use the new --allowed-mail flag in cloudflared to require visitors to authenticate with a one-time PIN sent to their email before they reach your local service. cloudflared tunnel --url http://localhost:8080 --allowed-mail alice@example.com Previously, anyone with a trycloudflare.com URL could access the service behind it. Protected Quick Tunnel…

Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session. Gateway network logs and Zero Trust Network Session Logs now identify two new kinds of traffic: Mesh — Traffic sent from or delivered to a Cloudflare…

cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027

Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared. After the deprecation takes effect, Cloudflare will no longer publish new cloudflared releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025. Apple has also deprecated Intel-based Mac computers. macOS 26 Tahoe, re…

Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once

You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time. When creating a route, you can now: Add multiple destinations at once — Enter a comma-separated list of CIDR ranges or hostnames to create several routes of the same type and connector together. Queue up multiple routes — Select Add another t…

Configure origin application settings for Cloudflare Tunnel in the dashboard

You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a Cloudflare Tunnel. These settings control how cloudflared connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files. When editing a published application, expand Additional applica…

Hostname routing is now generally available, with a new public IP range for initial resolved IPs

Hostname routing ↗︎ is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: Cloudflare Tunnel: route a private hostname (for example, wiki.internal.local) to a private application behind your tunnel, or a public hostname (for example, bank.example.com) to egress through a specific tunnel and anchor tr…

Stream live logs from Cloudflare Tunnel in the dashboard

Real-time Tunnel log streaming is now available in the Cloudflare dashboard under Networking > Tunnels. This brings the same live debugging capability previously only available in the Cloudflare One dashboard, including multi-connector aggregated streaming for high-availability deployments. In the tunnel detail view, a new Live logs tab lets you: Stream logs from single or multiple connectors — I…

Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026

On October 5, 2026, two changes take effect across the Zero Trust Networks API and Cloudflare Tunnel API: the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the connections field. If you manage private network routes or read tunnel connection details through the API, cloudflared, Terraform, or another integration, review the changes in the following…

Manage all your routes from one page in the dashboard

The Routes page in the Cloudflare dashboard now shows the routes across all of your connectors — Cloudflare Mesh and Cloudflare Tunnel routes alongside Cloudflare WAN and Magic Transit static routes — in a single table, instead of a separate routes view per product. From the unified Routes page you can: Visualize your network with an interactive map that shows how your destinations flow through t…

Cloudflare Tunnel now runs connectivity pre-checks at startup

Starting with cloudflared version 2026.5.2 ↗︎, Cloudflare Tunnel automates the entire connectivity pre-checks workflow directly inside the binary. Previously, customers had to install dig and netcat and run those commands by hand to verify their environment. Now cloudflared does it natively at startup — and surfaces actionable remediation when something is blocked. On every cloudflared tunnel run…

Granular permissions for Cloudflare Tunnel and Cloudflare Mesh

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. What is new When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopa…

Stream logs from multiple replicas of Cloudflare Tunnel simultaneously

In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all replicas of that tunnel and supports streaming logs from multiple replicas at once. Previously, you could only stream logs from one replica at a time. With this update: Replicas on the tunnel overview — All active replicas for the selected tunnel now appear on that tunnel's overview page under Connec…

Manage Cloudflare Tunnels with Wrangler

You can now manage Cloudflare Tunnels directly from Wrangler, the CLI for the Cloudflare Developer Platform. The new wrangler tunnel commands let you create, run, and manage tunnels without leaving your terminal. Available commands: wrangler tunnel create — Create a new remotely managed tunnel. wrangler tunnel list — List all tunnels in your account. wrangler tunnel info — Display details about a…

Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard

Cloudflare Tunnel is now available in the main Cloudflare Dashboard at Networking > Tunnels ↗︎, bringing first-class Tunnel management to developers using Tunnel for securing origin servers. This new experience provides everything you need to manage Tunnels for public applications, including: Full Tunnel lifecycle management: Create, configure, delete, and monitor all your Tunnels in one place. N…

Verify WARP Connector connectivity with a simple ping

We have made it easier to validate connectivity when deploying WARP Connector as part of your software-defined private network. You can now ping the WARP Connector host directly on its LAN IP address immediately after installation. This provides a fast, familiar way to confirm that the Connector is online and reachable within your network before testing access to downstream services. Starting wit…

cloudflared proxy-dns command will be removed starting February 2, 2026

Starting February 2, 2026, the cloudflared proxy-dns command will be removed from all new cloudflared releases. This change is being made to enhance security and address a potential vulnerability in an underlying DNS library. This vulnerability is specific to the proxy-dns command and does not affect any other cloudflared features, such as the core Cloudflare Tunnel service. The proxy-dns command…

Connect and secure any private or public app by hostname, not IP — with hostname routing for Cloudflare Tunnel

You can now route private traffic to Cloudflare Tunnel based on a hostname or domain, moving beyond the limitations of IP-based routing. This new capability is free for all Cloudflare One customers. Previously, Tunnel routes could only be defined by IP address or CIDR range. This created a challenge for modern applications with dynamic or ephemeral IP addresses, often forcing administrators to ma…

Cloudflare Tunnel and Networks API will no longer return deleted resources by default starting December 1, 2025

Starting December 1, 2025, list endpoints for the Cloudflare Tunnel API and Zero Trust Networks API will no longer return deleted tunnels, routes, subnets and virtual networks by default. This change makes the API behavior more intuitive by only returning active resources unless otherwise specified. No action is required if you already explicitly set is_deleted=false or if you only need to list a…

Faster, more reliable UDP traffic for Cloudflare Tunnel

Your real-time applications running over Cloudflare Tunnel are now faster and more reliable. We've completely re-architected the way cloudflared proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel. This is a foundational improvement to Cloudfl…

Troubleshoot tunnels with diagnostic logs

The latest cloudflared build 2024.12.2 ↗︎ introduces the ability to collect all the diagnostic logs needed to troubleshoot a cloudflared instance. A diagnostic report collects data from a single instance of cloudflared running on the local machine and outputs it to a cloudflared-diag file. For more information, refer to Diagnostic logs.