Workers VPC

VPC Network bindings can select a specific virtual network by setting network_id to cf1:vnet:<UUID>, where the UUID is the ID of the virtual network. Continue to use cf1:network to select your account's default virtual network. Multiple bindings can select different virtual networks. This lets one Worker reach separate backends that use the same private IP address: { "$schema": "./node_modules/wr…

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session. Gateway network logs and Zero Trust Network Session Logs now identify two new kinds of traffic: Mesh — Traffic sent from or delivered to a Cloudflare…

VPC Network bindings now support the connect() Socket API for raw TCP connections to private destinations, in addition to HTTP traffic via fetch(). This means Workers can now open TCP sockets to any private service reachable through the bound Cloudflare Tunnel, Cloudflare Mesh, or Cloudflare WAN on-ramp — Redis, Memcached, MQTT, custom binary protocols, or any other TCP-based service. { "$schema"…

Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway. This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today. Worker Calls env.EGRESS.fetch() VPC binding↓ Cloudflare Mesh Bind via cf1:net…

You can now use VPC Network bindings with network_id: "cf1:network" to reach your full private network from Workers, including: Cloudflare Mesh nodes and client devices Subnet routes and hostname routes announced through Cloudflare Tunnel or Cloudflare Mesh Destinations connected through Cloudflare WAN on-ramps — GRE, IPsec, and CNI This means a single VPC Network binding can route Worker request…

VPC Network bindings now give your Workers access to any service in your private network without pre-registering individual hosts or ports. This complements existing VPC Service bindings, which scope each binding to a specific host and port. You can bind to a Cloudflare Tunnel by tunnel_id to reach any service on the network where that tunnel is running, or bind to your Cloudflare Mesh network us…

Each VPC Service now has a Metrics tab so you can monitor connection health and debug failures without leaving the dashboard. Connections — See successful and failed connections over time, broken down by what is responsible: your origin (Bad Upstream), your configuration (Client), or Cloudflare (Internal). Latency — Track connection and DNS resolution latency trends. Errors — Drill into specific…

Workers VPC now supports Cloudflare Origin CA certificates when connecting to your private services over HTTPS. Previously, Workers VPC only trusted certificates issued by publicly trusted certificate authorities (for example, Let's Encrypt, DigiCert). With this change, you can use free Cloudflare Origin CA certificates on your origin servers within private networks and connect to them from Worke…

Workers VPC Services is now available, enabling your Workers to securely access resources in your private networks, without having to expose them on the public Internet. What's new VPC Services: Create secure connections to internal APIs, databases, and services using familiar Worker binding syntax Multi-cloud Support: Connect to resources in private networks in any external cloud (AWS, Azure, GC…