TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Connectivity Cloud Platform

38 posts · Mar 2012 – Oct 2026

What this trail covers

Cloudflare One's Connectivity Cloud Platform continues to evolve by enabling hostname-based routing for Cloudflare Tunnels, allowing for the creation of Zero Trust and egress policies based on hostnames rather than IP addresses, simplifying management and enhancing security. This capability extends to both private and public applications, and supports granular access control for specific resources. The platform also enhances outbound traffic control by allowing policies to be defined based on ho

All Cloudflare trails
  1. Protected Quick Tunnels: simple accountless authentication for your next dev projectIntroduced email-based authentication for Quick Tunnels via the `--allowed-mail` flag in `cloudflared` and `wrangler tunnel quick-start`. This feature leverages Cloudflare Access for email verification and a stateless authentication broker on Workers to issue signed assertions, which `cloudflared` then uses for authorization against locally stored rules. This enables accountless, protected ephemeral tunnels for agentic workflows and local development previews.
  2. How Cloudflare detects MCP traffic and helps secure itThis post introduces new Cloudflare One capabilities to detect and control Model Context Protocol (MCP) traffic. It details how MCP traffic is identified by analyzing protocol signals beyond simple hostnames and paths, specifically focusing on the MCP-Protocol-Version header and JSON-RPC methods. The post outlines three control points: client-side hooks, network boundary (Secure Web Gateway/Cloudflare Gateway), and MCP server-side middleware (Agents SDK/WriteGuard). It emphasizes the need for a layered security approach to manage AI agent interactions with tools and APIs, and introduces Cloudflare Gateway's ability to classify MCP requests and enforce access policies through MCP Portals.
  3. Building an open Agentic Internet: readable, discoverable, callable, and payableThis post introduces the concept of an 'Agentic Internet' and outlines Cloudflare's role in building the necessary infrastructure and protocols for AI agents to interact with the web. Key contributions include: defining the 'readable, discoverable, callable, and payable' philosophy for agent interactions; highlighting existing and new standards like Web Bot Auth, PACT, Markdown for Agents, WebMCP, and x402; introducing Kitesurf, a new browser for agents; detailing AI Search and Agent Engine Optimization (AEO) for discoverability; and introducing Wallets and Monetization Gateway for payable interactions. The post emphasizes Cloudflare's commitment to an open internet and its position as a neutral infrastructure provider for these new agent-centric interactions.
  4. Introducing the Cloudflare One stack- agent-powered deploymentIntroduces the Cloudflare One stack, a collection of agent skills designed to automate the configuration, deployment, and management of Zero Trust environments. This includes skills for remote access, user/network/device/data security, connectivity (Tunnel, Mesh, WAN), vendor concept translation, and troubleshooting. The stack leverages the Model Context Protocol (MCP) server for typed access to the Cloudflare API, enabling agents to query and modify configurations. It also includes specific migration logic for vendors like Zscaler and Palo Alto Networks, mirroring the capabilities of Cloudflare's Descaler and Deskope programs.
  5. From legacy architecture to Cloudflare OneThis post details a partnership with CDW to de-risk the migration of legacy applications to Cloudflare One (SASE/Zero Trust). It outlines a tiered methodology for application migration, starting with modern SaaS apps and progressing to complex legacy enterprise apps, emphasizing application modernization over a 'lift and shift' approach. Key technical aspects include using Cloudflare Access and Cloudflare Tunnel to wrap legacy applications, applying edge policies for MFA and device health scans, and establishing a phased rollout strategy with coexistence of legacy VPN and Cloudflare Access. The post also touches on architectural and identity assessment, establishing firebreaks between strategy and implementation teams, and persistent session stress testing with Path MTU Discovery.
  7. Complexity is a choice. SASE migrations shouldn’t take years.This post details how Cloudflare One, the connectivity cloud platform, is accelerating SASE migrations by reducing timelines from 18 months to six weeks. It highlights the use of identity-first on-ramps, consolidated policy engines, and cloud-native connectors like `cloudflared` to simplify deployments. The extensibility of Cloudflare One is demonstrated by a partner's ability to extend the Cloudflare One Client to support Arch Linux, ensuring consistent device posture checks. The post also outlines Cloudflare's AI Security Suite, which provides controls for securing workforce AI usage (Shadow AI visibility, AI confidence scores, DLP AI prompt protection) and AI-powered applications (LLM discovery, request validation, response scrubbing), as well as securing agentic AI with MCP server portals.
  8. How Automatic Return Routing solves IP overlapIntroduces Automatic Return Routing (ARR) as a closed beta feature for Cloudflare One customers. ARR addresses the problem of overlapping IP address spaces in enterprise networks (mergers, extranets, cookie-cutter architectures) by using stateful tracking of network flows. Instead of relying on routing tables, ARR remembers the originating tunnel (IPsec, GRE, Network Interconnect) for each flow and directs return traffic back through that same tunnel. This is built on the new Unified Routing framework, which moves routing decisions from the kernel data plane to userspace (Apollo, the Zero Trust hub), enabling programmable, session-aware routing and improving performance (3-5x for Cloudflare One Clients). ARR is enabled on a per-tunnel or interconnect basis and currently supports overlapping IPs accessing the Internet via Secure Web Gateway, with extensions planned for private data centers.
  9. Moving from license plates to badges: the Gateway Authorization ProxyIntroduced the Gateway Authorization Proxy and PAC File Hosting to enable identity-based authentication and policy enforcement for unmanaged devices connecting through Cloudflare's network. This moves identity verification from the endpoint to the network edge, using signed JWT cookies and integration with Cloudflare Access to authenticate users without requiring client software installation. PAC files can now be hosted directly on Cloudflare, simplifying setup and management.
  10. Beyond the blank slate: how Cloudflare accelerates your Zero Trust journeyThis post introduces Project Helix, a new system for automating the deployment of Cloudflare One best-practice configurations. Helix leverages Terraform templates executed by Cloudflare Workers and Cloudflare Containers to rapidly provision Zero Trust security settings (DNS, Network, HTTP policies). It codifies expertise from Solutions Engineers and Professional Services Engineers to simplify customer onboarding and reduce manual configuration time from hours to minutes. The system ensures 100% consistency and immunity to human error, and supports internationalization of deployed configurations.
  11. Modernizing with agile SASE: a Cloudflare One blog takeoverThis post introduces the concept of 'agile SASE' as a modernization strategy for corporate networks, emphasizing a composable and programmable platform that converges networking and security into a single, global connectivity cloud. It highlights innovations across five core themes: securing the network foundation, evolving identity verification, using AI for security signal analysis, engineering away corporate network friction, and unifying enterprise vision. It also outlines key starting points for SASE adoption, including remote access modernization, email phishing protection, DNS filtering, safe AI adoption, and simplified branch networking. The post positions Cloudflare One as the platform enabling these principles, built natively on its global network.
  12. The truly programmable SASE platformThis post introduces the concept of 'true programmability' for SASE platforms, emphasizing the ability to intercept security events, enrich them with external context, and act in real-time using custom logic. It details how Cloudflare One, integrated with the Developer Platform (Workers), enables this by allowing custom logic to be executed at the edge. A concrete example is provided: an automated device session revocation Worker that queries the Devices API to enforce periodic re-authentication. The post also outlines future plans for deeper integration, including custom actions in Cloudflare Gateway for dynamic policy enforcement and request augmentation.
  13. How Workers VPC Services connects to your regional private networks from anywhere in the worldIntroduces VPC Services as the first milestone of the Workers VPC initiative, allowing Workers to connect to services in regional private networks (on-premise or cloud) via Cloudflare Tunnels. This simplifies cross-cloud and hybrid application development by abstracting away complex network configurations like VPC peering and Private Link. The system uses a Workers binding model for secure, explicit access control, preventing SSRF attacks. Under the hood, it involves a Cap'n Proto RPC from the Worker to a Binding Worker, then to the Iris Service, which uses Apollo to interact with Cloudflare Tunnels. DNS resolution and the original request are routed through Apollo to the Tunnel Connector Service, then over QUIC to the Tunnel, and finally to the target service. DNS resolution caching is implemented for subsequent requests.
  14. Connect and secure any private or public app by hostname, not IP — free for everyone in Cloudflare OneThis post introduces hostname-based routing for Cloudflare Tunnels, allowing users to define Zero Trust and egress policies based on hostnames instead of IP addresses. This simplifies the management of access to private and public applications and enhances security by enabling per-resource authorization. The feature allows for routing entire domains to tunnels and supports writing granular Access and Gateway policies based on hostnames. It also enables secure egress traffic control to third-party applications by allowing policies to be defined based on destination hostnames, even when the organization does not control the destination IP.
  15. Integrating CrowdStrike Falcon Fusion SOAR with Cloudflare’s SASE platformThis post details the integration of Cloudflare's SASE platform (specifically Zero Trust Access and Email Security) with CrowdStrike Falcon Fusion SOAR. It introduces two out-of-the-box integrations available in the CrowdStrike Content Library, enabling automated workflows for phishing, malware, and suspicious behavior detection and remediation. The technical implementation involves webhook and API integrations, allowing Cloudflare's Access product to enforce step-up authentication or session revocation upon endpoint compromise detection by CrowdStrike, and Cloudflare to notify CrowdStrike for device isolation and remediation playbooks upon detecting suspicious network behavior. It also outlines how to configure Logpush jobs from Cloudflare to CrowdStrike.
  16. Troubleshooting network connectivity and performance with Cloudflare AIThis post introduces two new AI-powered tools for Cloudflare One: the WARP diagnostic analyzer and an MCP (Model Context Protocol) server for Digital Experience Monitoring (DEX). The WARP diagnostic analyzer uses AI to demystify WARP diagnostic logs, providing summaries of events impacting client performance and network connectivity, along with detailed explanations and troubleshooting recommendations. The DEX MCP server enables users to ask natural language questions about device connectivity and performance, receiving customized graphs and analysis without manual data pipeline integration. The post demonstrates troubleshooting DNS query performance using the DEX MCP server, identifying slow DNS resolution as the root cause of performance issues and suggesting optimization strategies.
  17. Best Practices for Securing Generative AI with SASEThis post introduces new AI Security Posture Management (AI-SPM) features integrated into Cloudflare's SASE platform. These features include shadow AI reporting for visibility into employee AI usage, confidence scoring of AI providers for risk management, AI prompt protection against malicious inputs and data loss, out-of-band API CASB integrations with AI providers to detect misconfigurations, and new tools to untangle and secure Model Context Protocol (MCP) deployments. The post details how these features, combined with existing SASE capabilities like Secure Web Gateway (SWG) and Data Loss Prevention (DLP), enable organizations to formulate and implement an AI Security Strategy by providing visibility, risk management, and data protection for both human and agentic AI usage.
  18. Introducing simple and secure egress policies by hostname in Cloudflare’s SASE platformThis post introduces the ability to write egress policies by hostname, domain, content category, and application within Cloudflare Gateway. Previously, egress policies were limited to destination IP addresses, requiring complex workarounds for dynamic external services. The engineering challenge was to evaluate these policies at Layer 4 before connection establishment, despite hostnames being Layer 7 information. This was solved by integrating the Gateway's DNS resolver with the network connection, using a 'synthetic IP' mechanism from CGNAT address spaces to tag traffic destined for specific hostnames. This allows for granular control over egress IP selection based on the intended destination hostname, simplifying policy management and enhancing security.
  19. Everything you need to know about NIST’s new guidance in “SP 1800-35: Implementing a Zero Trust Architecture”This post summarizes NIST SP 1800-35, which provides a reference architecture for Zero Trust Architecture (ZTA) and demonstrates how various vendor products can be combined to construct a ZTA. It highlights how Cloudflare's Zero Trust platform integrates with other vendors to support this architecture, offering features like FedRAMP compliance and post-quantum cryptography standards. The post details the core components of the NIST ZTA reference architecture (PEP, PE, PA, PDP, PIP) and explains how Cloudflare's platform aligns with these concepts, particularly in supporting Enhanced Identity Governance (EIG) approaches.
  20. Your IPs, your rules- enabling more efficient address space usageIntroduces Service Bindings for BYOIP prefixes, allowing granular routing of IP sub-ranges to different Cloudflare services (CDN, Spectrum, Magic Transit). Details the technical implementation challenges and solutions, including dynamic IP/port binding using eBPF-based Tubular, integration with legacy NGINX ingress proxies via shared Unix domain sockets, and fleet-wide deployment strategies. Aims to reduce IP prefix transition time from hours to minutes.
  21. A global virtual private cloud for building secure cross-cloud apps on Cloudflare WorkersIntroduces Workers VPC and Workers VPC Private Link, enabling the creation of isolated environments for Cloudflare Workers and Developer Platform resources (R2, KV, D1) and bidirectional connectivity to external VPCs in public or private clouds. Workers VPCs are global and built on Cloudflare's network for isolation, while Private Links use IPsec tunnels or Cloudflare Network Interconnect for secure connections. This allows Workers to access private resources in external clouds and vice versa, simplifying cross-cloud app development and reducing egress fees.
  22. RDP without the risk: Cloudflare's browser-based solution for secure third-party accessIntroduces clientless, browser-based RDP support integrated with Cloudflare Access and Cloudflare Tunnel. Leverages IronRDP (Rust-based RDP client) encapsulated in WebSockets for browser communication. Secures sessions using Cloudflare Access JWTs and eliminates redundant TLS encapsulation via RDCleanPath protocol extension. The RDP proxy architecture avoids deploying new services on every server, instead integrating with existing infrastructure.
  23. Improved support for private applications and reusable access policies with Cloudflare AccessThis post introduces the redesign of the self-hosted private application administrative experience within Cloudflare Access to match the experience for web-based apps on public hostnames. It now supports private hostname and IP address-defined applications directly within Access, and introduces reusable access policies. Previously, private application access was primarily handled through Cloudflare Gateway's network firewall component, with a limited wrapper from Access. This update unifies the ZTNA experience by allowing direct definition of private applications within Access, simplifying policy management and enabling consistent Zero Trust controls for both public and private resources.
  24. Elephants in tunnels: how Hyperdrive connects to databases inside your VPC networksThis post details the integration of Hyperdrive with Cloudflare Tunnels to enable secure connections to private databases. It explains the custom implementation of the Postgres message protocol and the use of Rust traits (`AsyncRead`, `AsyncWrite`) to abstract transport layer details, allowing Hyperdrive to work with generic data streams like WebSockets. The post also discusses the challenges of building a WebSocket stream that implements these traits and satisfies `Send`, `Sync`, and `Unpin` for multi-threaded use.
  25. Fearless SSH: short-lived certificates bring Zero Trust to infrastructureThis post announces the integration of BastionZero's technology into Cloudflare One as 'Access for Infrastructure', with the initial feature being short-lived SSH access. It replaces long-lived SSH keys and passwords with short-lived certificates issued by a Cloudflare-managed SSH Certificate Authority (CA). Servers are configured to trust this CA, and certificates are valid for 3 minutes for authentication, though the SSH session can be longer. Policies are centrally managed in the Cloudflare dashboard, allowing granular control over who can SSH to which servers and as which Linux user, based on SSO, MFA, and device posture. This eliminates credential management overhead and reduces the risk of compromise.
  26. What’s new in Cloudflare One: Digital Experience (DEX) monitoring notifications and seamless access to Cloudflare Gateway with China ExpressThis post introduces two new capabilities within Cloudflare One: DEX notifications and enhanced China Express integration for Cloudflare Gateway. DEX notifications allow administrators to create configurable alert rules based on z-score and SLOs for device connectivity anomalies, test latency spikes/drops (HTTP and Traceroute), and test low availability. These notifications can be filtered by data center, platform, WARP Client version, and test name. The China Express enhancement provides a dedicated tunnel configuration for Cloudflare Gateway customers accessing China-hosted sites, routing traffic through Cloudflare's Hong Kong data center and then securely through JD Cloud's private tunnel infrastructure, ensuring stable and predictable connectivity while maintaining Zero Trust security policies.
  27. Cloudflare acquires Kivera to add simple, preventive cloud security to Cloudflare OneThis post announces the acquisition of Kivera and details its integration into Cloudflare One. Kivera provides inline cloud app controls and preventative security for cloud services by inspecting cloud API traffic. Key capabilities added include one-click security for misconfigurations, enforced cloud tenant control, data exfiltration prevention, reduction of 'shadow' cloud infrastructure, streamlined compliance, and a flexible DevOps model. This enhances Cloudflare's SASE platform by extending protections beyond user-facing applications to proactive configuration management of infrastructure services, complementing CSPM and CASB solutions.
  28. TURN and anycast: making peer connections work globallyThis post announces the general availability of Cloudflare Calls TURN service. It details how the service leverages Cloudflare's anycast network for global coverage and near-zero latency. The post explains the challenges of NAT and the ICE protocol for real-time applications and how TURN solves these by relaying traffic. It highlights the privacy benefits of using Cloudflare's TURN service, masking client IP addresses. The technical implementation details the use of anycast for client-server connections and a novel approach for relayed addresses involving internal forwarding over Cloudflare's backbone to the correct datacenter, avoiding the need for unicast addresses for relay candidates.
  29. Simplify cloud routing and object storage configurations with Cloud ConnectorIntroduces Cloud Connector, a new feature that simplifies routing traffic to various cloud object storage services (AWS S3, Google Cloud Storage, Azure Blob Storage, Cloudflare R2) based on hostname and URI path. It extends the Ruleset Engine with a new `http_request_cloud_connector` phase and a thin API translator layer on Workers to manage these routing rules without requiring complex host header modifications or additional rules, making multi-cloud routing accessible to all plans.
  30. Cloudflare acquires BastionZero to extend Zero Trust access to IT infrastructureThis post announces the acquisition of BastionZero, which will extend Cloudflare One's Zero Trust Network Access (ZTNA) capabilities to natively protect infrastructure resources such as servers, Kubernetes clusters, and databases. BastionZero's approach focuses on resource- and target-based access controls, rather than IP addresses and ports, and integrates with OpenPubkey for SSO-based infrastructure access. Key additions include frictionless privileged access management (PAM) for modern credential management (ephemeral, decentralized), a DevOps-based approach for securing SSH connections with session recording, and clientless RDP access. This acquisition aims to replace VPNs, bastion hosts, and traditional PAM solutions.
  31. Unified Risk Posture Management by Cloudflare | Use CasesThis post introduces Cloudflare for Unified Risk Posture, a new suite of capabilities that converges SASE and WAAP portfolios to provide automated and dynamic risk posture enforcement. It details how Cloudflare evaluates risk across people (UEBA) and applications, exchanges risk indicators with partners (e.g., CrowdStrike, Okta), and enforces automated risk controls at scale. A key use case highlights the integration with CrowdStrike Falcon Next-Gen SIEM for enhanced threat detection and response, and the enforcement of Zero Trust policies based on user and device risk scores.
  32. Introducing WARP Connector: paving the path to any-to-any connectivityIntroduces WARP Connector, an extension of the WARP client that acts as a virtual router for subnets, enabling bidirectional traffic flow through WireGuard/MASQUE tunnels. This addresses limitations of cloudflared's Layer 4 proxying by operating at Layer 3, preserving true source IP addresses, and supporting site-to-site and mesh-like connectivity. It enables use cases such as VOIP servers and CI/CD pipelines by allowing granular policies and secure access to private networks. The Cloudflare One Dashboard is updated with new 'Network' and 'Routes' tabs to manage these connectivity options.
  33. Protocol detection with Cloudflare GatewayIntroduced protocol detection to Cloudflare Gateway, enabling filtering, logging, and policy enforcement based on network protocols (e.g., SSH, MQTT) rather than just port numbers. This was achieved by adding a TCP socket pre-read hook to the OXY framework to buffer initial bytes for protocol signature comparison. This feature is available for Enterprise Gateway users and supports a growing list of protocols.
  34. Magic Cloud Networking simplifies security, connectivity, and management of public cloudsIntroduces Magic Cloud Networking, powered by Nefeli Networks technology, to simplify, unify, and automate multi-cloud network management. It provides end-to-end visibility and control across multiple cloud providers' native network capabilities, avoiding the complexity and cost of traditional VNFs. The system discovers and visualizes network resources across accounts and providers, enabling automated and scalable network construction through a single interface.
  35. Cloudflare treats SASE anxiety for VeloCloud customersThis post details the architectural and strategic challenges of acquiring SASE capabilities, contrasting Cloudflare's integrated approach with acquisition-heavy strategies. It highlights the limitations of combining disparate SD-WAN and SSE solutions and positions Cloudflare's Magic WAN as a unified SASE solution built on its global network. It also offers a transition path for VeloCloud customers, emphasizing consultation, product education, and customer success support.
  36. Eliminate VPN vulnerabilities with Cloudflare OneThis post details how Cloudflare One's SASE platform, specifically Zero Trust Network Access (ZTNA), can mitigate vulnerabilities found in legacy VPN solutions like Ivanti Connect Secure. It highlights the principles of least privilege and the absence of external access to system internals as key differentiators. The post explains the threat actor's tactics in exploiting Ivanti vulnerabilities (CVE-2023-46805 and CVE-2024-21887) to gain RCE, harvest credentials, and move laterally within networks. It contrasts this with Cloudflare One's approach of providing granular access to specific resources rather than broad network access.
  37. Simplifying how enterprises connect to Cloudflare with Express Cloudflare Network InterconnectIntroduced 'Express Cloudflare Network Interconnect' (Express CNI) to simplify and accelerate the deployment of physical network connections (CNIs) between enterprise networks and Cloudflare. This includes a 3-minute provisioning process directly from the Cloudflare dashboard, eliminating the need for GRE tunnels for Magic Transit and Magic WAN, and supporting standard 1500-byte packets. This reduces configuration complexity and improves the efficiency of connecting to Cloudflare's network services.
  38. Fulfilling the promise of single-vendor SASE through network modernizationThis post announces updates to Cloudflare One's SASE platform, focusing on network modernization for SASE adoption. Key updates include flexible on-ramps for site-to-site connectivity (agent/proxy-based and appliance/routing-based), new WAN-as-a-service (WANaaS) capabilities (high availability, application awareness, VM deployment, enhanced visibility), and Zero Trust connectivity for DevOps (mesh and P2P secure networking for service-to-service workflows). It emphasizes a single-vendor SASE approach by converging security and networking technologies and modernizing the underlying network architecture.
  39. Announcing General Availability for the Magic WAN Connector: the easiest way to jumpstart SASE transformation for your networkThe Magic WAN Connector is now generally available, providing zero-touch connectivity for enterprise networks to Cloudflare's global network. This component of Cloudflare One simplifies the connection of existing network hardware to Cloudflare's network, enabling SASE transformation by routing traffic through Zero Trust security controls and accelerated paths. It offers automated tunnel configuration, traffic steering, shaping, and failover, with enhanced visibility into traffic flows. This release signifies the final piece for a unified SASE platform, moving away from legacy MPLS/VPN and SD-WAN architectures towards a 'light branch, heavy cloud' principle.
  40. Cloudflare is now powering Microsoft Edge Secure NetworkThis post details the technical implementation of Cloudflare's Privacy Proxy Platform, which powers the Microsoft Edge Secure Network VPN. It explains the use of HTTP CONNECT for proxying traffic, the integration with 1.1.1.1 for DNS resolution, and the application of the Privacy Pass protocol for token-based client authentication without collecting personal information. It also describes the role of the Token Proxy, Privacy API, and Privacy Proxy services, and how Geo-egress is used to provide location-relevant egress IP addresses. The post highlights the benefits of Cloudflare's global network for low last-mile latency and geolocation parity, and mentions the use of Oxy, Cloudflare's proxying framework, for operational aspects.
  41. Cloudflare’s 2023 Annual Founders’ LetterThis post announces the expansion of Cloudflare's connectivity cloud to include GPU resources for AI inference across its global network. It details the strategy of deploying these resources in over 100 cities by the end of the year and nearly every city by the end of 2024, aiming to provide a 'third place' for AI inference between on-device and centralized public clouds. The post highlights the benefits of this approach for AI customers, including reduced latency, improved data locality, and cost-effectiveness, and mentions the development of Cloudflare Workers AI as a platform for this capability.
  42. Welcome to connectivity cloud: the modern way to connect and protect your clouds, networks, applications and usersThis post introduces the concept of a 'connectivity cloud' as a new approach to delivering IT and security services. It outlines four fundamental principles: deep integration with the internet and enterprise networks, programmability for adaptability, platform intelligence through analysis of high volumes of traffic, and simplicity to reduce tool sprawl. Cloudflare positions itself as the first connectivity cloud, showcasing customer examples of secure access, application delivery, and innovative development powered by this platform.
  43. Cloudflare One for Data ProtectionThis post announces Cloudflare One for Data Protection, a unified suite that converges DLP, CASB, ZTNA, SWG, RBI, and email security services onto a single platform. It highlights how this suite addresses modern data risks such as diverse SaaS environments, emerging AI tools, and source code exposure. The post details three customer use cases: securing AI tools and developer code, gaining visibility into data exposure, and achieving compliance with regulations. It emphasizes the effectiveness of Cloudflare One in simplifying management, improving user productivity, and enabling organizational agility.
  44. Cloudflare’s tenant platform in action: Meter deploys DNS filtering at scaleThis post details how Meter, an Internet infrastructure provider, leverages Cloudflare's Tenant API and Gateway for DNS filtering. It highlights the implementation of parent-child policy configurations for granular control across different customer accounts (e.g., schools within a district). Technically, it describes how Meter customers can set policies to block domains by security risk or content theme, define DNS endpoints (IPv4, IPv6, DoH, DoT), and customize block pages. The Tenant API enables Meter administrators to manage differential policies for child accounts, with DNS queries filtered first by parent policies and then by child policies.
  45. Integrate Cloudflare Zero Trust with Datadog Cloud SIEMThis post announces the general availability of the Cloudflare Zero Trust Integration with Datadog Cloud SIEM. It details the setup process using Logpush jobs to Datadog and installing the Cloudflare Tile in Datadog. The integration provides an out-of-the-box dashboard and detection rules for Cloudflare Zero Trust logs, including specific detections for CASB findings and impossible travel scenarios. This enhances security insights and accelerates investigation and remediation workflows.
  46. Protecting data on Apple devices with Cloudflare and JamfThis post details the integration of Cloudflare's Zero Trust Solutions (DLP, RBI, SaaS Tenancy Controls) with Jamf's device management platform for Apple devices. It outlines the technical steps for configuring Magic WAN, access policies, DLP policies, and RBI policies to enable data protection and threat isolation on managed Apple endpoints. The integration leverages SSL/TLS decryption within Cloudflare Gateway to inspect HTTPS traffic and enforce granular DLP and RBI controls.
  47. Descale your network with Cloudflare’s enhanced Descaler ProgramThe Descaler Program has been enhanced with improved tooling to accelerate Zscaler to Cloudflare One migrations, reducing configuration migration times from days to hours. New features include a summary of migratable objects and the ability to export configurations in Terraform format, catering to customer feedback and existing workflows.
  48. How we think about Zero Trust PerformanceThis post details Cloudflare's approach to measuring and improving Zero Trust performance. It argues for end-to-end HTTP response time as the primary metric, contrasting it with proxy latency and decrypted latency SLAs. Key strategies for performance improvement include last-mile peering, cloud peering, and diverse network paths. The post also outlines how Cloudflare conducts its performance tests using client programs that measure HTTP timings through Zero Trust services.
  49. Donning a MASQUE: building a new protocol into Cloudflare WARPIntroduced MASQUE, a new protocol for WARP that extends HTTP/3 and leverages QUIC for efficient IP and UDP traffic proxying, aiming to improve Internet browsing speed and stability. This represents a shift from WireGuard to a standards-based protocol for enhanced flexibility and future cryptographic advancements. The implementation utilizes Cloudflare's global network and existing proxy framework, with plans to integrate into the Zero Trust suite.
  50. Spotlight on Zero Trust: we're fastest and here's the proofThis post details performance benchmarks comparing Cloudflare Gateway and WARP client against competitors (Zscaler, Netskope, Palo Alto Networks) across Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA), and Remote Browser Isolation (RBI) scenarios. It highlights Cloudflare's speed advantage due to its extensive peering and network proximity to users, presenting detailed metrics and testing methodologies. The post emphasizes that performance is a critical security vector, as slow Zero Trust services lead to user adoption issues and increased risk.
  51. Cloudflare is faster than Netskope and Zscaler across LATAMThis post presents performance benchmarks of Cloudflare Access against Zscaler and Netskope across 10 Latin American countries. It details the methodology using 95th percentile Time to First Byte and Response tests, highlighting Cloudflare's speed advantage due to its 47 data centers in the region. Specific data for Argentina and Brazil is provided, showing Cloudflare's performance improvements.
  52. From IP packets to HTTP: the many faces of our Oxy frameworkThis post introduces Oxy, a Rust-based framework for proxies that spans multiple OSI layers. It details how Oxy handles raw IP packets for Cloudflare One and WARP via IP tunneling (connected and unconnected), tracks IP flows for policy enforcement and logging, and upgrades IP flows to TCP streams using Linux TUN interfaces and network namespaces for stateful NAT. It also discusses the use of the etherparse crate for parsing IP and transport headers.
  53. Adding Zero Trust signals to Sumo Logic for better security insightsThis post announces the expansion of Cloudflare's Logpush integration with Sumo Logic's Cloud SIEM to include Zero Trust logs. Previously, only core Cloudflare services like WAF and bot detection were supported. The update adds logs from Cloudflare Gateway (Network, DNS, HTTP), Remote Browser Isolation, Data Loss Prevention, Access, and Cloud Access Security Broker (CASB). This enables joint customers to achieve deeper context into their security posture by converging security and network data, reducing alert fatigue, and accelerating security analyst triage. The integration requires Enterprise customers to enable Logpush to Sumo Logic and install the Cloudflare App, with an additional step for Cloud SIEM customers to forward logs to Cloud SIEM for normalization and correlation.
  54. Cloudflare Aegis: dedicated IPs for Zero Trust migrationIntroduces Cloudflare Aegis, a new feature providing dedicated egress IP addresses for Enterprise customers. Aegis allows customers to lock down their services at an IP level by providing a small, reserved list of IP addresses that Cloudflare uses to send traffic. This enables IP-based access control lists (ACLs) on customer firewalls, offering an additional layer of security for Zero Trust migrations, especially when mTLS or other application-level security measures are not yet fully deployed. Aegis integrates with Cloudflare Access, Cloudflare Network Interconnect, and Cloudflare Workers to enhance secure application access and origin protection.
  55. Manage and control the use of dedicated egress IPs with Cloudflare Zero TrustIntroduced policies to control when Cloudflare uses dedicated egress IPs for traffic egressing from offices, data centers, and roaming users. Administrators can now use a rule builder in the Cloudflare dashboard to determine which egress IP is used and when, based on attributes like identity, application, IP address, and geolocation. This provides more granular control over traffic egress, enabling organizations to maintain IP-based allowlisting policies for third-party services while optimizing network performance for other traffic.
  56. Cloud CNI privately connects your clouds to CloudflareThis post announces and details the integration of Cloudflare Network Interconnect (CNI) with major public cloud providers (IBM Cloud, Google Cloud, Azure, Oracle Cloud Infrastructure, Amazon Web Services). This allows for direct, private connections from cloud VPCs into Cloudflare's network. The post explains the importance of private cloud interconnection for security and compliance, contrasts it with public internet exposure, and details the simplified, cloud-native provisioning process using Google Cloud's Private Service Connect as an example. It also highlights how this integration enhances Cloudflare One products like Magic WAN, Access, and Gateway by enabling private routing and unified management of connectivity across data centers, offices, and clouds.
  57. China Express: Cloudflare partners to boost performance in China for corporate networksIntroduces China Express, a suite of capabilities designed to address connectivity and performance challenges in mainland China. This includes Premium DIA for optimized cross-border public internet connectivity with partners CMI and CBC Tech, Private Link for secure private network connections, and Travel SIM in partnership with CMI for integrated mobile connectivity and Zero Trust security enforcement via the WARP client. Extends Cloudflare One and Magic WAN to China.
  58. Cloudflare Application Services for private networks: do more with the tools you already loveThis post announces new integrations that extend Cloudflare's Application Services and Cloudflare One to private networks. Key technical contributions include enabling WAF policies for fully private traffic flows by building private networks on Cloudflare, applying public API security controls to private APIs by routing private API traffic through the Cloudflare One dataplane, and extending application-layer load balancing policies to traffic connected via various off-ramps (Cloudflare Tunnel, GRE, IPsec, CNI). It also highlights the automatic application of Argo Smart Routing to private app traffic and the introduction of private DNS for managing internal network resources within the Zero Trust private network.
  59. Cloudflare Zero Trust for managed service providersThis post announces the integration of Cloudflare Gateway DNS Filtering with the Cloudflare Tenant platform, enabling parent-child policy configurations for Managed Service Providers (MSPs). This allows MSPs to manage millions of customer accounts with global corporate security policies set at a parent account level, with the ability for individual child accounts to have their own overrides and custom configurations. Real-world examples with US federal government agencies and Malwarebytes are provided to illustrate the benefits of this scaled policy management.
  60. Email Link Isolation: your safety net for the latest phishing attacksIntroduces Email Link Isolation, a new feature within Cloudflare Area 1 that rewrites potentially malicious email links to protect users from phishing attacks. It leverages Cloudflare's intelligence for early signal detection, Cloudflare Workers for serving interstitial pages without delay, and Cloudflare Browser Isolation for protecting users who choose to proceed to suspicious links. The feature is now generally available for Cloudflare Area 1 enterprise plan customers.
  61. Announcing the Magic WAN Connector: the easiest on-ramp to your next generation networkIntroduced the Magic WAN Connector, a lightweight software package deployable on existing physical or cloud hardware. It automates the connection, steering, and shaping of IP traffic to the closest Cloudflare network location, enabling easier adoption of SASE. The connector provides branch routing, application-aware traffic steering, zero-touch configuration, VPN termination, and acts as a telemetry source for Cloudflare observability tools. It also integrates with the broader Cloudflare One portfolio for SASE security capabilities.
  62. Cloudflare protection for all your cardinal directionsThis post recaps the evolution of corporate network traffic definitions (north/south, east/west) and explains how Cloudflare One provides protection for all traffic flows, regardless of source or destination. It highlights Cloudflare's application security portfolio for external traffic and Cloudflare One's Zero Trust Network Access and Secure Web Gateway for internal traffic. It also details how Cloudflare One can be used for east/west traffic between locations and within a single location by hopping to a Cloudflare location. The post mentions upcoming product announcements that will further enhance these integrations.
  63. Network detection and settings profiles for the Cloudflare One agentIntroduced configuration profiles and managed network detection for the Cloudflare One agent. Managed network detection uses TLS certificate SHA-256 fingerprints to identify trusted networks, allowing the agent to automatically switch between local and Cloudflare-routed traffic based on predefined profiles. This enables dynamic policy application based on network location and user group membership, simplifying network management for administrators and improving user experience.
  64. Why do CIOs choose Cloudflare One?This post details why CIOs choose Cloudflare One for their enterprise connectivity and security needs, focusing on six key themes: completeness of security, team speed, ease of management, product integration, cost-efficiency, and vendor consolidation. It highlights how Cloudflare One addresses challenges in Zero Trust and SASE by providing a unified platform that replaces disparate appliances and point solutions. Specific technical aspects mentioned include the use of BoringTun (WireGuard implementation) for device connectivity, Cloudflare's DNS resolver for speed, smart routing technology, and the integration of Area 1 Email Security. The post also includes customer testimonials from CISA and a Fortune 500 energy company.
  65. Weave your own global, private, virtual Zero Trust network on Cloudflare with WARP-to-WARPIntroduces WARP-to-WARP connectivity, enabling direct device-to-device communication within an organization's Zero Trust network. This feature leverages Cloudflare's global network and Argo Smart Routing to relay traffic between WARP-enabled devices, securing it with Zero Trust policies and enabling features like SSH command auditing. It expands the existing connectivity options beyond WARP-to-Tunnel, GRE, and IPSec tunnels to facilitate East-West traffic flows between WARP clients.
  66. Cloudflare expands Project Pangea to connect and protect (even) more community networksProject Pangea has been expanded to support community networks by relaxing the technical requirement of bringing their own /24 IP space. This allows eligible networks to access Cloudflare's services, including Internet connectivity, DDoS protection, network firewalling, and traffic acceleration, for free. This change leverages existing services like Magic Transit and Magic Firewall, and extends the functionality of Magic Transit to support customers without their own IP address space, now made available to community networks.
  67. Cloudflare partners to simplify China connectivity for corporate networksThis post details the expansion of Cloudflare One's capabilities into mainland China through strategic partnerships. It describes how Cloudflare partners accelerate traffic from China networks to resources outside China by routing local traffic to partner networks, then to Cloudflare data centers outside China for security policy enforcement. It also explains how the WARP client is adapted to use these China partner networks for establishing Wireguard tunnels to Cloudflare points of presence outside mainland China, enabling consistent security policy enforcement for remote users in China. Future plans include extending SASE filtering to local China data centers.
  68. The first Zero Trust SIMIntroduces the Cloudflare SIM, a Zero Trust SIM card that integrates with the Cloudflare One platform. This SIM card acts as a foundational on-ramp for mobile devices, enabling Zero Trust protections at the SIM level. It offers DNS filtering via Cloudflare Gateway, mitigates SIM attacks through eSIM and locked physical SIMs, and enables identity-based private connectivity via Magic WAN. The SIM transforms mobile into another on-ramp pillar for Cloudflare One, allowing devices to reach services beyond the internet and supporting protocols like Geneve. It also explores the use of SIM cards as a root-of-trust for stronger employee identity association.
  69. Bringing Zero Trust to mobile network operatorsThis post announces a new partnership program for mobile network operators (MNOs) called 'Zero Trust for Mobile Operators'. It highlights the complementary nature of Cloudflare's SASE platform (Cloudflare One) and MNO networks, focusing on how Cloudflare's Magic WAN, Access, Gateway, CASB, and Area 1 can integrate with MNO infrastructure. It also discusses the potential of edge computing with Cloudflare Workers for MNOs and IoT use cases, and the benefits of embedding Cloudflare's services within MNO networks for reduced latency and improved performance. The post emphasizes the synergy between enterprise connectivity and security software.
  70. 1.1.1.1 + WARP: More features, still privateThis post details the implementation of geographically accurate browsing experiences for WARP users by replacing their original IP address with a Cloudflare IP associated with their approximate location. This involves analyzing network traffic to estimate user density per city, allocating egress IPs using an anycast architecture, and updating geolocation databases. Additionally, it announces the expansion of the WARP+ network to over 20 new cities, improving connection speeds for subscribers.
  71. Cloudflare One vs Zscaler Zero Trust Exchange: who is most feature complete? It’s not who you might expectThis post argues that Cloudflare One's functionality surpasses Zscaler Zero Trust Exchange by comparing their feature sets across several criteria, including 'Internet-native network platform', 'Cloud-native service platform', 'Services to adopt SASE', 'Services to extend ZT, SSE, SASE and beyond', and 'Network on-ramps'. It highlights Cloudflare's unified global network, higher throughput (6 Gbps vs. 1 Gbps for GRE tunnels), and extensive interconnection peers (10,500+) as key differentiators. The post also emphasizes Cloudflare One's single dashboard for all Zero Trust services (ZTNA, CASB, SWG, RBI, DLP) and its ability to run every service in every location at enterprise scale.
  72. How Cloudflare Security does Zero TrustThis post details the internal adoption and implementation of Cloudflare's Zero Trust services by the Cloudflare Security team. It describes the migration from a hardware-based VPN to Cloudflare Access, including the enforcement of FIDO2 security keys for authentication. It also covers the deployment of Cloudflare Gateway for DNS filtering in offices and for remote users via the WARP client, with subsequent addition of HTTP filtering and Browser Isolation. Finally, it discusses the integration of Area 1 Email Security for phishing prevention and the planned adoption of CASB for SaaS security.
  73. Decommissioning your VDIThis post introduces Remote Browser Isolation (RBI) as a viable alternative to Virtual Desktop Infrastructure (VDI) for securing access to internal web applications. It details the challenges of VDI (high costs, poor user experience, complexity) and explains how RBI, specifically Cloudflare Browser Isolation, addresses these by running all app and web code away from endpoints on Cloudflare's global network. It highlights benefits like faster user experience, simplified administration, and lower, more predictable costs. A customer story from PensionBee illustrates the successful transition from DaaS to RBI.
  74. Connect to private network services with Browser IsolationThis post introduces and details Cloudflare's Browser Isolation feature, which enables secure access to private network services via isolated remote browsers. It integrates Cloudflare Access for user authorization and Cloudflare Tunnels for secure private network connectivity. The feature allows for granular control over access, monitoring of third-party users, and application of data protection controls like disabling clipboard, printing, and file uploads/downloads. It also outlines the steps for connecting a network to Cloudflare Zero Trust, enabling Clientless Web Isolation, and browsing private IP resources.
  75. A stronger bridge to Zero TrustThis post announces enhancements to Cloudflare One's connectivity options, focusing on making the transition to Zero Trust easier. Key contributions include: 1. Increased interoperability between various on-ramps (BYOIP, WARP client, CNI, GRE tunnel, IPSec tunnel, Cloudflare Tunnel) and off-ramps, enabling seamless traffic routing. 2. Expanded support for additional IPsec configuration parameters, a new UI for dashboard management, and Terraform provider support for infrastructure as code. 3. Easier integration with SD-WAN appliances, including new guides for Cisco Viptela and other devices, to facilitate on-ramp configuration.
  76. Cloudflare Gateway dedicated egress and egress policiesThis post introduces dedicated egress IPs for Cloudflare Gateway, allowing organizations to use static, dedicated source IPs for their egress traffic. This addresses the need for IP allowlisting policies commonly used by third-party applications and SaaS providers. It also announces an upcoming egress IP policy builder in the Zero Trust dashboard, enabling granular control over which egress IP is used based on identity, application, network, and geolocation attributes. This enhances security and performance for globally distributed teams.
  77. MPLS to Zero Trust in 30 daysThis post outlines the transition from traditional MPLS-based WAN architectures to a Zero Trust model using Cloudflare Magic WAN. It details the limitations of MPLS and SD-WAN in supporting distributed SaaS and hybrid multi-cloud environments, highlighting business losses due to outdated infrastructure. Cloudflare Magic WAN is presented as a solution that simplifies WAN architectures by leveraging the Cloudflare global network for interconnectivity, offering integrated Zero Trust security services, improved performance, and centralized management. The post also provides a detailed preparation and transition plan for organizations undertaking this migration, emphasizing cross-team collaboration and phased cutovers.
  78. Zero Trust, SASE and SSE: foundational concepts for your next-generation networkThis post breaks down the foundational concepts of Zero Trust, SASE, and SSE, and explains how Cloudflare One delivers these capabilities. It details the components of SASE, including secure access functions (ZTNA, SWG, RBI, CASB, DLP), on-ramps, and the service edge. It positions Cloudflare One as a comprehensive SASE platform, highlighting its composability and ability to address immediate use cases while building towards a full SASE architecture.
  79. Magic NAT: everywhere, unbounded, and lower costIntroduces Magic NAT, a new NAT solution built on Cloudflare One's Zero Trust platform. Magic NAT leverages Cloudflare's Anycast architecture to provide a globally distributed, unbounded, and cross-platform NAT service. It supports various connection methods (GRE, IPsec, CNI, WARP) and integrates with Magic Firewall and Secure Web Gateway. It also offers IPv4/IPv6 address translation. The post details the challenges of traditional NAT solutions (geography, capacity, cost, hybrid infrastructure) and explains how Magic NAT addresses them.
  80. Building many private virtual networks through Cloudflare Zero TrustThis post introduces the capability to create and manage multiple segregated virtual private networks within Cloudflare Zero Trust. This is achieved by introducing the concept of virtual networks that logically segregate IP subspaces, allowing for overlapping IP address ranges across different data centers or networks. The functionality is initially enabled through the `cloudflared` CLI, with commands for adding virtual networks (`vnet add`) and routing IP subnets to specific tunnels within a chosen virtual network (`tunnel route ip add --vnet`). This directly addresses the limitation of ambiguous IP routes in previous configurations, enabling more flexible and scalable private network connectivity.
  81. Ridiculously easy to use TunnelsThis post introduces a significant simplification to the Cloudflare Tunnel creation and management process by enabling it directly through the Zero Trust dashboard. Previously requiring up to 14 CLI commands and local configuration files, the process is now reduced to three steps: naming the tunnel, installing the connector via a script, and configuring public hostnames or private network routes. This eliminates the need for manual management of configuration files and authentication tokens (`cert.pem`, `Tunnel_UUID.json`), as these are now handled by Cloudflare. The post also highlights the integration with WARP, Gateway, and Access for client-based and clientless Zero Trust deployments, and outlines future plans for migration tooling and support for global configuration options.
  82. A bridge to Zero TrustThis post introduces the ability to route traffic from WARP-enrolled devices to any network connected with IP-layer on-ramps (GRE, IPsec, or CNI). It details how user traffic lands in a customer's isolated network namespace, is routed to the destination network via configured tunnels, and how return traffic is handled using the internal Hermes service to share WARP session locations across the network. This enhances flexibility for connecting existing network infrastructure and facilitates a gradual transition to Zero Trust.
  83. Protect all network traffic with CloudflareThis post announces the extension of Magic Transit to customers with smaller networks by offering Cloudflare-managed IP space. Previously, Magic Transit required customers to bring their own IP addresses (minimum /24) for BGP advertisement. The new offering allows customers to direct traffic to dedicated static IPs, receiving DDoS protection, visibility, performance, and resiliency benefits. It highlights use cases for hybrid/poly-cloud security, protecting branch offices of any size, and securing home networks for streamers and gamers by routing traffic through Magic Transit-protected IP space.
  84. Cloudflare and Aruba partner to deliver a seamless global secure network from the branch to the cloudThis post details a new integration between Aruba's EdgeConnect SD-WAN appliances and Cloudflare One. It describes how GRE or IPSec tunnels can be established between EdgeConnect appliances and Cloudflare's edge network, allowing Aruba customers to steer traffic through Cloudflare's Secure Web Gateway and Magic Firewall for enhanced security and control. The integration leverages Aruba Orchestrator's Business Intent Overlays to manage traffic policies, enabling customers to send specific internet-bound traffic to Cloudflare while routing other traffic types through different interfaces or directly to the internet. Future enhancements aim for tighter integration with authorization credentials and automatic configuration via the Magic WAN management API.
  85. How Cloudflare Is Solving Network Interconnection for CIOsThis post details Cloudflare's approach to solving CIO connectivity challenges by making interconnection more valuable, available everywhere, and faster to provision. It highlights the expansion of Cloudflare for Offices to 1000 new locations, the benefits of connecting to Cloudflare's global network for security and performance products, and the streamlining of BGP session turnup and cross-connect provisioning to reduce provisioning times from weeks to minutes. It also emphasizes the role of interconnect partners in expanding reach and simplifying connectivity.
  86. Secure how your servers connect to the Internet todayThis post details how Cloudflare One can be used to secure server outbound traffic by filtering and logging DNS queries and network traffic (Layers 3-5) through Cloudflare's network. It introduces three layers of defense: Protective DNS filtering, network firewalling (via GRE/IPsec tunnels, direct connections, or WARP client), and Secure Web Gateway for HTTP inspection. It emphasizes a defense-in-depth strategy and the ability to implement positive security models (allow-listing).
  87. Cloudflare One helps optimize user connectivity to Microsoft 365This post announces Cloudflare's participation in the Microsoft 365 Networking Partner Program (NPP). It details how Cloudflare One optimizes user connectivity to Microsoft 365 by providing a direct and fast path to Microsoft's service endpoints, bypassing legacy security solutions that might introduce extra hops. It also highlights the integration of Cloudflare Zero Trust security features (network firewall, DNS resolver, Secure Web Gateway, Shadow IT analysis) to secure traffic to the rest of the internet while ensuring direct connectivity to Microsoft 365. The post outlines the simple steps for customers to enable this optimization in the Cloudflare for Teams dashboard.
  88. Cloudflare Agent — Seamless Deployment at ScaleThis post announces expanded OS support for the Cloudflare Zero Trust agent (ChromeOS, Linux), feature parity across all major platforms, and new configuration options: domain-based split tunneling, include-only split tunnels, and improved private domain DNS resolution. It highlights the use of Rust for a shared daemon and BoringTun for reliable connections, and details API and Terraform controls for deployment and administration.
  89. Extending Cloudflare’s Zero Trust platform to support UDP and Internal DNSIntroduced early access to UDP support for Cloudflare's Zero Trust platform, enabling support for protocols beyond TCP. This expansion allows for use cases such as internal DNS resolution and thick client applications, further enabling the replacement of legacy VPNs. Also introduced Internal DNS functionality, which allows for the use of private hostnames without manual migration.
  90. Zero Trust Private Networking RulesThis post introduces session control and login interval enforcement for Cloudflare's private network offering within the Zero Trust platform. Administrators can now configure session durations and require re-authentication. It also announces the upcoming beta for UDP support in this model, enabling private DNS and thick client applications.
  91. Control input on suspicious sites with Cloudflare Browser IsolationIntroduced Cloudflare Browser Isolation as a feature within Cloudflare Gateway and Zero Trust Network Access. This service protects against phishing and credential theft by rendering risky websites in a remote browser. Administrators can define policies to prohibit keyboard input and file uploads for high-risk browsing activities. The service is included with Cloudflare for Teams Enterprise Plan at no additional charge for the first 2,000 seats until December 31, 2021.
  92. Replace your hardware firewalls with Cloudflare OneThis post announces new capabilities within Cloudflare One that enable customers to replace hardware firewalls with a cloud-native solution. It details the historical evolution of firewalls (stateless, stateful, NGFW) and the challenges associated with them, such as capacity planning, maintenance, and the limitations of IP-based policies. Cloudflare One is presented as a solution that offers a global firewall, flexible on-ramps (GRE, IPsec, application-layer tunnels, direct connections, BYOIP, device client), eliminating hardware management burdens. It also highlights the ability to configure comprehensive policies using both traditional firewall attributes and Zero Trust attributes, including integration with identity providers and endpoint security solutions. Specific features mentioned include stateless and stateful network policies, deep packet inspection, programmable packet filters, application and content categories for Layer 7 policies, protected DNS resolver, and remote browser isolation. The post also mentions upcoming SSH session command logging and filtering.
  93. Announcing Anycast IPsec: a new on-ramp to Cloudflare OneIntroduces Anycast IPsec, enabling customers to establish a single IPsec tunnel to Cloudflare's global network. This leverages a custom IKE daemon and an upgraded Cloudflare Tunnel technology for distributing Security Associations (SAs) to all edge servers, effectively turning the entire Cloudflare network into a single, scalable IPsec tunnel. This approach eliminates the performance penalties of traditional hub-and-spoke architectures and simplifies management.
  94. Cloudflare One: One Year LaterThis post marks one year since the announcement of Cloudflare One, highlighting its evolution and customer adoption. Key contributions include the introduction of IPsec Tunnels as a new connectivity option alongside GRE Tunnels, improvements to Cloudflare Tunnel and network interfacing provisioning for easier organization connection, and the continued emphasis on Zero Trust principles for application security and access control. It also details the scale of traffic defended (9.3 trillion unwanted packets) and applications protected (192,000) using Cloudflare One's integrated security and connectivity features.
  95. Welcome to CIO Week and the future of corporate networksThis post introduces the concept of corporate network evolution through three generations: 'Castle and moat,' 'Smörgåsbord of point solutions,' and the future vision enabled by Cloudflare One. It details the limitations of traditional castle-and-moat architectures (security, performance, reliability, cost, visibility, agility, precision) and the challenges introduced by cloud adoption and remote work (hybrid architectures, backhauling costs, VPN limitations, security gaps, poor user experience, high costs, network fragility). It positions Cloudflare One as a Zero Trust Network-as-a-Service (NaaS) solution that addresses these challenges by providing a unified platform for network security, performance, and reliability, moving away from fragmented point solutions.
  96. Cloudflare for OfficesCloudflare is extending its network into office buildings and multi-dwelling units through strategic partnerships and custom hardware. This initiative, 'Cloudflare for Offices,' aims to bring Cloudflare's network services, including security and performance features, directly to enterprise office locations. It simplifies branch office connectivity by eliminating the need for traditional costly hardware solutions and third-party providers, enabling a direct connection to Cloudflare's network for all office traffic. This serves as an onramp to Cloudflare One, offering Zero Trust security and performance benefits by placing Cloudflare equipment physically closer to users within these buildings. The deployments are designed with considerations for cooling, energy efficiency, resiliency, cost-effectiveness, and enhanced security due to the deployment environment.
  97. Quick Tunnels: Anytime, AnywhereIntroduced 'Quick Tunnels' for Cloudflare Tunnel, enabling users to establish a tunnel with a single command (`cloudflared tunnel`) without prior account creation or zone configuration. This feature leverages Cloudflare Workers for dynamic subdomain generation and management, and Cron Triggers for cleanup of abandoned tunnels. Quick Tunnels now utilize the more resilient and long-lived architecture previously available only to Named Tunnels, improving stability and persistence.
  98. Announcing WARP for Linux and Proxy ModeThis post announces the release of Cloudflare WARP for Linux and introduces a new 'proxy mode' for WARP across all desktop platforms. WARP for Linux is built using a shared Rust codebase (BoringTun) for cross-platform compatibility and is controlled via a command-line interface (`warp-cli`). Proxy mode allows users to configure specific applications to route their traffic through WARP, rather than encrypting all device traffic. This provides more granular control over which applications benefit from WARP's security and performance enhancements.
  99. Interconnect Anywhere — Reach Cloudflare’s network from 1,600+ locationsThis post announces the expansion of Cloudflare Network Interconnect (CNI) to over 1,600 locations by integrating with new and existing Layer 2 service fabric partners (PacketFabric, Megaport, Equinix Fabric, Console Connect, CoreSite Open Cloud Exchange, Infiny by Epsilon). This allows customers to connect securely and privately to Cloudflare's network from their own infrastructure, even when not in the same data center. The expansion aims to improve reliability, reduce latency, and enhance security by enabling customers to avoid traversing shared public networks.
  100. A Boring Announcement: Free Tunnels for EveryoneThis post announces the free availability of Argo Tunnel (renamed to Cloudflare Tunnel) for all organizations, previously a paid feature tied to Argo Smart Routing. It details the technical benefits of Tunnel: creating secure, outbound-only connections from origin servers to Cloudflare without requiring firewall holes or public IPs. The post explains the underlying architecture, highlighting the removal of internal dependencies for improved stability and the migration to the Unimog edge load balancer for increased uptime. It also introduces 'Named Tunnels' to ensure persistence and autonomous reconnection after restarts. The post provides examples of use cases: connecting applications via public hostnames and building private networks.
  101. Announcing Network On-ramp Partners for Cloudflare OneThis post announces new Network On-ramp Partnerships for Cloudflare One, specifically for Magic WAN and Magic Firewall. It introduces partnerships with VMware, Aruba, and Infovista for WAN/SD-WAN connectivity, and expands Network Interconnect partners with Digital Realty, CoreSite, EdgeConneX, 365 Data Centers, BBIX, Teraco, and Netrality Data Centers. The post details how these partnerships enable customers to connect their existing infrastructure (physical or virtual appliances) to Cloudflare's global network using GRE tunnels, with future support for IPSec. It also highlights private interconnection options via colocation in 70 locations, reducing cross-connect lead times and offering connectivity reference architectures. Future plans include self-configuration of on-ramp devices via the Magic WAN management API and enhanced Zero Trust security integration.
  102. Magic WAN & Magic Firewall: secure network connectivity as a serviceIntroduced Magic WAN and Magic Firewall as foundational components of Cloudflare One. Magic WAN provides secure, performant connectivity and routing for corporate networks using various on-ramps (Anycast GRE tunnels, Cloudflare Network Interconnect, Argo Tunnel, WARP, Network On-ramp Partners), replacing expensive and complex MPLS networks. Magic Firewall enables centralized, edge-enforced network firewall policies across all traffic sources connected via Magic WAN. The post details use cases for replacing MPLS between branch offices and data centers, and securing remote employee access to private networks using WARP clients and Magic Firewall policies.
  103. Many services, one cloudflaredThis post introduces the ability for a single cloudflared instance to proxy multiple local services through a single Argo Tunnel. This is achieved by leveraging Named Tunnels and a new ingress rules configuration within cloudflared. Ingress rules allow mapping internet URLs (hostname and optional path regex) to specific local services (URLs, HTTP status codes, or a built-in hello world server). The post also details validation and testing commands for ingress rules and introduces per-rule origin request configuration overrides.
  104. How our network powers Cloudflare OneThis post details how Cloudflare's global network infrastructure, characterized by its extensive distribution (200+ cities, 100+ countries, 42 Tbps capacity), scalability (commodity hardware, software-based functions), broad interconnectivity (8,800+ networks), and unique insight from diverse traffic, powers Cloudflare One. It emphasizes how this network architecture enables unified security and networking management for distributed enterprises, offering performance benefits by processing traffic close to users and consolidating control across global operations.
  105. How small businesses can start using Cloudflare One todayThis post introduces how small businesses can leverage Cloudflare One, specifically focusing on DNS Filtering, WARP+, and Access. It details the steps for setting up DNS filtering by changing router settings, deploying the WARP client for encrypted and accelerated internet traffic, and replacing VPNs with Cloudflare Access by integrating with identity providers. It also outlines the addition of a Secure Web Gateway for threat and data loss prevention and the application of Zero Trust rules to SaaS applications. The post highlights the availability of a free plan for up to 50 users.
  106. Introducing Cloudflare Browser Isolation betaIntroduces Cloudflare Browser Isolation beta, a new capability within Cloudflare for Teams. This feature runs browsers in sandboxed environments on Cloudflare's edge network, sending draw commands to the user's device instead of streaming pixels. This approach aims to provide a secure, low-latency, and performant remote browsing experience, complementing existing Cloudflare Access and Gateway services by addressing unknown and unforeseeable threats.
  107. Introducing Cloudflare One IntelIntroduced Cloudflare One Intel, a new feature within Cloudflare Gateway that leverages global internet intelligence to provide actionable insights for network and security operations. This includes the launch of DNS tunneling detection, which uses machine learning to identify and block anomalous DNS requests, and domain insights, which provide transparency into the reputation and characteristics of hostnames by linking to Cloudflare Radar. These features aim to streamline incident detection, remediation, and forensics by consolidating threat intelligence and network activity within a single platform.
  108. Introducing Cloudflare OneThis post introduces Cloudflare One, a comprehensive network-as-a-service solution designed to replace traditional corporate network architectures with a unified, cloud-based platform. It integrates Cloudflare's global network with leading identity management and device integrity providers to enable Zero Trust networking. Key components announced include WARP Gateway Clients, Access for SaaS, browser isolation, and a next-generation network firewall/intrusion detection system. The post details the shift from the 'castle and moat' security model to Zero Trust, driven by mobile, SaaS, and remote work trends, and highlights partnerships with identity (Okta, Ping Identity, OneLogin) and device integrity (CrowdStrike, VMware Carbon Black, SentinelOne, Tanium) vendors to create a flexible and robust solution.
  109. What is Cloudflare One?This post introduces Cloudflare One, a unified platform for enterprise security and networking. It combines existing and new products like WARP, Gateway, Magic Transit, Magic Firewall, and Access to replace traditional castle-and-moat network architectures with a Zero Trust model. The platform aims to provide consistent security controls globally, simplify network management, and improve performance by leveraging Cloudflare's distributed network. Key components include filtering outbound internet traffic with WARP and Gateway, next-generation firewall capabilities with Magic Firewall, and replacing VPNs with Cloudflare Access for Zero Trust controls. The post also highlights the importance of unified logging and visibility.
  110. How Argo Tunnel engineering uses Argo TunnelThis post details how the Argo Tunnel engineering team uses Argo Tunnel and Cloudflare Access to create a secure and efficient development environment for distributed teams. It describes the evolution of their development stack from Docker Compose to Skaffold + Minikube, and finally to Tilt + Docker for Mac's k8s. The core contribution is the pattern of using Argo Tunnel as a sidecar to a reverse proxy that injects authentication tokens, exposing internal Kubernetes dashboards and development environments securely to the internet via Cloudflare Access policies. This enables remote collaboration and debugging by providing secure, authenticated access to development resources.
  111. Cloudflare Network Interconnection partnerships launchIntroduced the Cloudflare Network Interconnection Partner Program, enabling customers to connect privately and securely to Cloudflare's network using software-defined Layer 2 networking technology. This program partners with Console Connect, Megaport, PacketFabric, Equinix ECX Fabric, and Zayo Tranzact across 23 metro areas globally, offering benefits such as sub-rate speeds, burstiness, reduced overhead, and improved performance by avoiding the public internet. This expands connectivity options beyond physical locations for Cloudflare's Magic Transit and DDoS protection services.
  112. Introducing Cloudflare Network InterconnectIntroduced Cloudflare Network Interconnect (CNI) as a new capability. CNI allows direct interconnection between customer on-premise networks and Cloudflare's global network via Private Network Interconnect (PNI) or Internet Exchange (IX). This bypasses the public internet, offering improved performance (reduced RTT, jitter) and enhanced security by minimizing public exposure. Specific benefits are detailed for Cloudflare Access, CDN, Magic Transit, and Workers. A case study of 'Penguin Corp' illustrates how CNI enables a SASE-like model with zero public internet exposure for branch and core networks.
  113. Bringing Your Own IPs to Cloudflare (BYOIP)This post announces the general availability of Bring Your Own IP (BYOIP) across Cloudflare's Layer 7 products, Spectrum, and Magic Transit. It details the technical requirements for BYOIP, including Letters of Authorization (LOA) and updated Internet Routing Registry (IRR) records, and mentions support for RPKI. The post also describes configuration options like dynamic advertisement toggles and delegations for managing prefix usage across accounts, with specific implications for Layer 7 (SSL for SaaS) and Spectrum services.
  114. Extending Cloudflare to On-Prem NetworksThis post introduces Cloudflare Magic Transit, a new product that extends Cloudflare's global network to on-premise networks. It leverages BGP and GRE tunnels to announce customer IP address space globally and ingest traffic. Magic Transit provides DDoS mitigation, packet filtering, load balancing, and traffic management by processing traffic at Cloudflare's edge before forwarding it to the origin. The product is built on Cloudflare's internal software-defined networking and network function virtualization tooling, developed over nine years.
  115. Magic Transit: Network functions at Cloudflare scaleThis post introduces Cloudflare Magic Transit, a service that extends Cloudflare's network functions to operate at the IP layer for customer traffic. It details how Magic Transit leverages Cloudflare's existing global network, anycast routing, and homogeneous server architecture to provide DDoS mitigation, firewalling, and routing for customer IP prefixes. Key technical components discussed include the use of network namespaces for isolated customer configurations, virtual ethernet interfaces for traffic delivery into namespaces, iptables for packet marking and routing table management, and GRE tunneling combined with anycast IP addresses for delivering traffic to customer networks over the public internet.
  116. A free Argo Tunnel for your next projectIntroduced a free tier for Argo Tunnel, allowing users without a Cloudflare account to expose a server to the internet without opening ports. This is achieved by running the `cloudflared` daemon, which creates outbound tunnels to the Cloudflare network and generates a random subdomain of 'trycloudflare.com' for access. The free version is intended for testing and development, not production, and does not offer an SLA.
  117. MultiCloud... flareThis post introduces Cloudflare's capabilities for multi-cloud and hybrid deployments, highlighting Load Balancing, Argo Tunnel, and Access Control. Load Balancing is presented as a Layer 7 solution across multiple origins (AWS, Google Cloud, on-premise) with features like weighting, latency-based routing, and health checks, operating independently of cloud providers. Argo Tunnel is described as a solution to simplify multi-cloud networking by establishing outbound tunnels from infrastructure to Cloudflare PoPs, eliminating the need for inbound ports and complex firewall configurations. Access Control is presented as a zero-trust model using identity providers to manage access to infrastructure irrespective of its cloud location, with SSH access as an example. The post also touches on Cloudflare's inherent reliability through its distributed Anycast network and BGP advertising.
  118. IBM Cloud Internet Services protects any cloud – now with Cloudflare Spectrum and WorkersThis post announces the integration of Cloudflare Spectrum and Workers into IBM Cloud Internet Services (CIS). Specifically, it highlights: 1. CIS Enterprise Log Share for ingesting log data into customer repositories for analytics and forensics. 2. CIS Internet Services Range (Spectrum) for mitigating Layer 3/4 DDoS attacks on TCP/UDP traffic and encrypting it with SSL/TLS. 3. CIS Edge Functions (beta) for running custom JavaScript logic at the edge, enabling tasks like request interception/modification and outbound requests. Existing CIS Enterprise features like Smart Routing and Custom WAF rules are also mentioned.
  119. Argo Tunnels: Spread the LoadThis post introduces the integration of Argo Tunnel with Cloudflare Load Balancing. It details how Argo Tunnel, via the cloudflared agent, can establish secure connections to Cloudflare's network, allowing services behind firewalls or NATs to be exposed. The integration enables load balancing across multiple Argo Tunnel instances, providing failure tolerance and improved performance through geo-routing. The post outlines the command-line arguments for attaching cloudflared to a load balancer pool and explains the automated DNS entry creation, load balancer and pool creation, tunnel addition, and traffic proxying. It also highlights the ability to scale services up or down by managing tunnel instances and mentions other Load Balancing features like health checks and routing policies.
  120. Argo Tunnel: A Private Link to the Public InternetIntroduced Argo Tunnel, a private connection between a web server and Cloudflare. This feature emulates the security of GRE tunnels without the expense or hassle, offering faster installation and running on any device. It provides a private link to the public internet, making the origin server unroutable to the rest of the internet. Argo Tunnel is built on top of Argo for performance boosts and is included for free with Argo.
  121. Introducing the Cloudflare Warp Ingress Controller for KubernetesIntroduced the Cloudflare Warp Ingress Controller for Kubernetes, an open-source project developed in collaboration with StackPointCloud. This controller automates the creation and management of secure Warp tunnels for services exposed via Kubernetes Ingress resources, allowing for seamless integration with Cloudflare's network and security features.
  122. Want to try Warp? We just enabled the beta for youThis post announces the beta release of Cloudflare Warp, a service that allows users to expose locally running web servers to the internet without opening firewall ports or needing a public IP address. It details the installation process via Homebrew, Linux, and Windows packages, and the command-line usage for setting up a hello-world server or pointing to an existing local server. It also explains how Warp can be used for load balancing multiple application instances by registering origins to a load balancer pool and setting up health checks. The post further describes automating Warp with Docker and integrating it with Cloudflare Access for user authentication.
  123. Introducing Cloudflare Warp: Hide Behind The EdgeIntroduced Cloudflare Warp (later renamed Argo Tunnel), a tool to expose web applications without making the origin server directly routable. It creates a private, encrypted virtual tunnel from the Cloudflare edge to the application server, allowing traffic to be routed through Cloudflare's network. This provides a secure gateway, enabling policy enforcement at the edge and simplifying service discovery by automatically registering DNS records for the application. The initial command-line interface allows users to specify a hostname and the local HTTPS URL of their application.
  124. Down the Rabbit Hole: The Making of Cloudflare WarpThis post introduces Cloudflare Warp (later renamed Argo Tunnel), a new tunneling protocol based on HTTP/2. It aims to provide an easier and more secure way to connect origin servers to the Cloudflare network, overcoming limitations of GRE tunnels. Key technical details include the use of HTTP/2 for multiplexing, HPACK header compression, and a downloadable agent for popular OSes. It also highlights integration with Cloudflare's Anycast network via Argo for optimized routing and redundancy through multiple PoP connections. Integration with Load Balancing for origin management is also discussed.
  125. CloudFlare Now Supporting More PortsThis post details the expansion of Cloudflare's proxied ports to include common web control panel ports (2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 8080, 8443, 8880) beyond the initial 80 and 443. It also explains the technical limitations preventing the proxying of non-web protocols like FTP and SSH due to the lack of a HOST header, and how this blocking adds a layer of security and contributes to Cloudflare's threat intelligence.