Internal Service Exposure & Management with Spectrum

6/10/2026

Introduces 'Application Services for Private Origins' in closed beta, allowing public traffic to be routed to private origins without exposing them to the public internet. This enables Cloudflare's security, performance, and programmability services (WAF, bot management, rate limiting, caching, rewrites, Workers) for private applications. Extends this capability to Spectrum for Layer 4 TCP/UDP services and integrates with Workers VPC. The feature leverages existing private network connectivity like Cloudflare Tunnel, WAN, and Mesh. API support includes a `use_private_routing` flag on DNS records and `virtual_network_id` for Spectrum.

4/14/2026

Introduces Cloudflare Mesh, a new private networking solution designed for agents and autonomous software. Mesh provides bidirectional, many-to-many connectivity, integrating with Cloudflare One for SASE and Zero Trust capabilities. It extends Workers VPC to allow Workers and Durable Objects to access resources within the Mesh network. The post contrasts Mesh with Cloudflare Tunnel, highlighting Mesh's suitability for full bidirectional network access.

3/5/2026

This post details a significant re-architecture of the Cloudflare One Client's proxy mode. It replaces the previous WireGuard-based L3 tunneling and smoltcp implementation with a direct Layer 4 proxying approach using QUIC and MASQUE. This change eliminates performance bottlenecks, doubles download/upload speeds, and significantly reduces latency, improving user experience for various use cases including VPN coexistence, high-bandwidth applications, and developer tools.

3/5/2026

Introduces Automatic Return Routing (ARR) as a closed beta feature for Cloudflare One customers. ARR solves the problem of IP address overlap in enterprise networks (mergers, extranets, cookie-cutter architectures) by using stateful tracking instead of traditional routing tables. It remembers the originating tunnel for each network flow, allowing return traffic to be sent back to the correct source without ambiguity. ARR is built on the new Unified Routing framework, which consolidates network-layer and user-space routing logic for improved performance and interoperability.

11/5/2025

Introduces VPC Services as the first milestone of the Workers VPC initiative, enabling Workers to connect to APIs, containers, VMs, and other services in regional private networks via Cloudflare Tunnels. Details the architecture involving Workers, Cap'n Proto, Binding Workers, Iris Service, Apollo, and Tunnel Connector Service for routing requests from global Workers to regional private networks. Highlights security benefits like explicit service access control and SSRF immunity through the binding model.

9/18/2025

Introduced hostname-based routing for Cloudflare Tunnel, allowing traffic to be routed to private and public applications based on hostnames or domains instead of IP addresses. This simplifies Zero Trust and egress policy creation, eliminating the need for IP lists and enhancing security for applications hosted in dynamic cloud environments or behind load balancers. The feature integrates with Cloudflare Access and Gateway for policy enforcement.

5/19/2025

This post introduces Service Bindings for Bring Your Own IP (BYOIP) prefixes, enabling customers to use parts of a single IP prefix for multiple Cloudflare services (CDN, Spectrum, Magic Transit). It details the technical challenges and solutions involved in dynamically reallocating prefixes across services, including updates to iptables, IP sets, and the eBPF-based Tubular service. The post highlights the integration of Tubular with the NGINX ingress proxy via a shared Unix domain socket and the phased deployment strategy to minimize disruption. It also explains how Service Bindings provide granular control over traffic routing, allowing for more efficient IP address usage and cost optimization.

4/11/2025

This post introduces Workers VPC and Workers VPC Private Links, extending Cloudflare's private networking capabilities. Workers VPC provides an isolated, global virtual private cloud environment for Workers applications and Developer Platform resources. Workers VPC Private Links enable secure, bidirectional connectivity between Workers VPCs and legacy VPCs in public or private clouds, allowing Workers to access external private resources and vice versa. This simplifies cross-cloud application development, reduces egress fees, and leverages existing private networking infrastructure like Cloudflare Tunnels and Cloudflare Network Interconnect.

4/8/2025

This post introduces native support for MySQL databases within Cloudflare Workers, leveraging Hyperdrive for optimal performance. It details the technical challenges overcome, including Node.js compatibility improvements for the `mysql` and `mysql2` drivers, and the integration of Hyperdrive with the MySQL wire protocol. This enables developers to build global applications that connect directly to MySQL databases hosted anywhere, with improved performance and reduced latency.

4/8/2025

This post announces that Hyperdrive is now available on the free plan of Cloudflare Workers. It details how Hyperdrive improves performance by reducing latency through connection pooling and caching, and provides a benchmark demonstrating a significant reduction in query times. The post also explains the transaction-mode pooling approach used by Hyperdrive and outlines the multi-round trip process of establishing a new connection to a PostgreSQL database, highlighting the problem Hyperdrive solves.

10/25/2024

This post details the technical implementation of integrating Hyperdrive with Cloudflare Tunnels for secure database access. It explains the need for a custom Postgres message protocol handler and the use of Rust traits (AsyncRead, AsyncWrite) to create a generic stream interface. It also covers the challenges and solutions for implementing WebSocket support for these streams, ensuring compatibility with Cloudflare's internal infrastructure and the `cloudflared` daemon.

5/31/2024

This post introduces the integration of Cloudflare Spectrum with Cloudflare Tunnels and load balancers to enable Layer 4 load balancing for TCP and UDP traffic destined for private IP addresses. This extends previous Private Network Load Balancing capabilities (which only supported HTTP(S)) to non-HTTP(S) traffic, allowing customers to keep origins private and unreachable from the internet while still load balancing traffic to them. The integration relies on Apollo and Director services to route traffic to private origins.

3/30/2023

This post introduces Cloudflare's Oxy framework, a Rust-based proxy that operates across multiple OSI layers. It details how Oxy handles raw IP packets for Cloudflare One and Zero Trust principles, implements IP tunneling with context for multi-tenancy (e.g., WARP, Magic WAN), and tracks IP flows for policy enforcement and auditing. Crucially, it explains how Oxy upgrades IP flows to TCP streams by leveraging the Linux kernel's TUN interface and network namespaces, enabling user-space applications to process TCP connections efficiently. This significantly expands the capabilities for managing and securing internal services by providing fine-grained control at various network layers.

3/16/2023

Introduced integration of Cloudflare Tunnels with Keyless SSL to secure key server communication. Previously, Keyless SSL required a public DNS record for key servers, exposing them to the internet. The new approach uses Cloudflare Tunnels to create a private, secure channel, meaning the key server's IP address is no longer publicly discoverable. This enhances security by ensuring only Cloudflare initiates connections to the key server, reducing its attack surface.

1/13/2023

This post introduces the integration of network utility tools (ping, traceroute, MTR) into Cloudflare Zero Trust. It explains how these tools leverage ICMP echo requests and replies for connectivity testing. The technical implementation involves proxying ICMP traffic over QUIC datagrams between Cloudflare and cloudflared instances, allowing cloudflared to send the entire IP packet with the ICMP payload. This enables users to test connectivity to private network destinations behind Cloudflare Tunnel.

10/3/2022

This post introduces post-quantum cryptography to Cloudflare Tunnel, enabling users to secure the connection between their origin servers and Cloudflare's network against future quantum computer decryption. It details the implementation of a `--post-quantum` flag in `cloudflared` and the use of hybrid key exchanges (X25519Kyber) to achieve this, marking a significant step towards a post-quantum internet.

6/23/2022

This post significantly enhances the "Internal Service Exposure & Management with Spectrum" thread by detailing how Cloudflare One acts as a bridge to Zero Trust for organizations migrating from legacy network architectures. It introduces composable on- and off-ramps that interoperate seamlessly, including GRE, IPsec, and CNI tunnels connecting to Cloudflare Tunnel and WARP clients. The post also highlights expanded support for Anycast IPsec parameters, improved dashboard management, Terraform provider integration, and new integration guides for SD-WAN appliances, all aimed at simplifying the transition to Zero Trust.

6/23/2022

This post details the internal adoption of Cloudflare Tunnel and Cloudflare Access to replace SSH-based bastion hosts for accessing internal PostgreSQL databases. It describes the deployment of Cloudflare Tunnel within an internal Kubernetes cluster to establish connectivity to the database servers, and the implementation of identity-driven Zero Trust policies via Cloudflare Access for authentication and authorization. The post also covers the client-side setup using cloudflared for users to establish local TCP connections to the databases, and the maintenance of SSH jump-hosts as a 'break glass' procedure. The learnings highlight improved security posture, user experience, and the value of dogfooding Cloudflare's own products.

6/23/2022

This post details the transition of enterprise networks from outdated MPLS architectures to a Zero Trust model using Cloudflare Magic WAN and the Cloudflare One product suite. It highlights the limitations of MPLS in supporting modern distributed applications and the challenges of SD-WAN, then introduces Magic WAN as a solution that simplifies WAN architectures, integrates Zero Trust security services, and offers improved performance and management through Cloudflare's global network. The post also outlines a comprehensive prep and transition plan for organizations undertaking this migration.

5/17/2022

This post introduces Network Analytics Logs for Magic Transit, Magic Firewall, Magic WAN, and Spectrum customers on the Enterprise plan. It details how these logs can be fed into SIEM systems like Splunk for near real-time visibility into network traffic, dropped packets, and DDoS attacks. The post outlines the log contents, provides a setup guide for integrating with Splunk via API, and highlights the option to use R2 storage for cost-effective log management.

4/26/2022

Introduced the concept of virtual networks within Cloudflare Zero Trust, allowing for the creation of multiple segregated private networks. This enables the routing of traffic through distinct virtual networks, even when those networks have overlapping IP address spaces. The implementation involves using the `cloudflared` CLI to add virtual networks and route IP subnets to specific tunnels, with WARP clients able to select their desired virtual network.

3/25/2022

This post introduces a significant simplification to the Cloudflare Tunnel creation and management process by enabling it directly from the Zero Trust dashboard. This new GUI-driven approach reduces the required steps from up to 14 CLI commands to just three. It eliminates the need for local configuration files and the management of separate authentication tokens (`cert.pem` and `Tunnel_UUID.json`), as these are now handled by the dashboard. The post also details how this new workflow integrates with both clientless (via Access) and client-based (via WARP and Gateway) Zero Trust deployments, and outlines future plans for migration tooling and support for global configuration options.

3/20/2022

This post introduces MASQUE (Multiplexing And Secure Communication over QUIC Encapsulation) as a protocol that leverages QUIC's DATAGRAM frames to enable UDP tunneling. It explains how MASQUE, built on extended CONNECT requests, allows for proxying non-TCP applications like HTTP/3, addressing the limitations of TCP-based proxying and extending Cloudflare Tunnel's capabilities to handle a wider range of protocols and improve privacy through nested tunneling.

12/8/2021

Kudelski Security developed an internal tool 'k8s-tunnels' that leverages Cloudflare Tunnel and Cloudflare Access to automate secure Zero Trust access to Kubernetes control-plane APIs across multi-cloud environments. This tool automates the discovery of accessible K8s clusters, authenticates access requests using Zero Trust policies, and establishes a SOCKS5 proxy connection via Cloudflare Tunnel for CLI-based clients like kubectl and k9s. It also supports parallel tunnel connections and uses Vault for on-premises cluster metadata.

11/25/2021

This post details the technical nuances of UDP socket programming for stateful services. It explains the differences between connected and unconnected UDP sockets, the challenges of implementing UDP servers with wildcard binding and the use of IP_PKTINFO CMSG for proper source IP selection, and introduces the 'established-over-unconnected' technique as a method for achieving graceful server restarts in UDP environments. It also touches upon the performance benefits of connected sockets and the complexities of handling MTU, fragmentation, and ICMP errors in UDP.

11/23/2021

This post announces the general availability of Argo for Spectrum, which extends Argo Smart Routing's performance optimization capabilities to any TCP-based application. It details how Argo for Spectrum reduces latency and packet loss by leveraging Cloudflare's network intelligence to provision faster routes between the edge and origin servers. Benchmarks show significant improvements in file transfer throughput for various protocols like SFTP, git, RDP, and RTMP.

10/25/2021

This post details the technical implementation of using Cloudflare Tunnel and Cloudflare Access to create secure, ephemeral preview environments for technical writers. It outlines the steps involved in setting up a named tunnel, routing DNS to a local development server (localhost:8000), and securing access with an Access policy restricted to internal employees. The workflow allows technical writers to share their work-in-progress documentation with stakeholders in real-time, mimicking the published experience.

10/20/2021

This post details the successful integration of QUIC (UDP-based) into Cloudflare Tunnel, addressing performance limitations and Head-of-Line blocking inherent in the previous TCP/HTTP/2 approach. It highlights a critical debugging process involving UDP's connectionless nature and Linux kernel's source IP selection heuristics, culminating in the implementation of explicit source address control using `sendmsg` and `recvmsg` system calls to ensure reliable connectivity.

10/18/2021

Introduced a new UI for Cloudflare Tunnel in the Cloudflare for Teams Dashboard, offering enhanced visibility into tunnel status, routes, uptime, connectors, and `cloudflared` version. The UI simplifies onboarding with interactive guides for macOS, Windows, and Linux, covering origin connection and WARP integration. It provides detailed observability metrics like Status (Active, Inactive, Degraded) and Uptime, calculated based on the health of long-lived TCP connections. The UI also visualizes Ingress Rules for serving multiple services from a single tunnel and displays `cloudflared` replicas with their connection status and version. Users can now manage and delete tunnels directly from the dashboard.

10/1/2021

This post details how Cloudflare's Magic Transit service protects VoIP infrastructure from multi-vector DDoS attacks, including L7 and L3/4 attacks targeting VoIP server infrastructure, by leveraging its global network, sophisticated traffic filtering, and real-time threat intelligence. It highlights the effectiveness of its Anycast architecture and edge-based DDoS mitigation for UDP and SIP traffic, ensuring performance and call quality are maintained during attacks.

9/2/2021

Introduced 'Quick Tunnels' for Cloudflare Tunnel, a feature that allows users to create and expose local services to the internet with a single command (`cloudflared tunnel`) without requiring an account or prior onboarding. This leverages Cloudflare Workers for tunnel creation and management, and a complementary edge service for DNS record creation. It also utilizes Workers Cron Triggers for automated cleanup of abandoned tunnels. The feature is built on a more resilient and stable architecture, enabling longer-lived tunnels compared to previous account-free offerings.

8/23/2021

This post details the evolution of the health check system for Cloudflare Magic Transit. It describes the initial naive approach, the subsequent improvement using multicast within data centers, and the final, highly efficient solution employing consistent hashing to distribute health check responsibilities. This new approach significantly reduced CPU and memory usage at the edge, making the system more scalable and responsive.

8/19/2021

This post details the setup of a personal pet cam using a Raspberry Pi, Cloudflare Tunnel, and Cloudflare Access. It explains how to configure the Raspberry Pi with a camera module and the Motion software to stream video, and then uses Cloudflare Tunnel to expose this internal service to the internet. Cloudflare Access is then used to secure the stream with Google authentication, demonstrating a practical application of these services for remote access and security.

6/24/2021

Introduced Browser VNC, a VNC client rendered entirely in the browser, leveraging Cloudflare Workers for edge deployment and Cloudflare Tunnel for secure connectivity to existing TCP tunnels. This enables clientless access to VNC servers, integrating with Cloudflare Access for Zero Trust controls and providing end-to-end encryption. Future plans include full auditability of user actions within VNC sessions.

5/12/2021

Introduced the ability to run multiple instances of `cloudflared` for a single Cloudflare Tunnel. This enables elastic auto-scaling of `cloudflared` instances, graceful restarts for zero-downtime configuration changes, and easier integration with Kubernetes by allowing multiple `cloudflared` pods to manage the same tunnel.

4/27/2021

This post details the setup of Cloudflare Tunnel and Auditable Terminal to provide secure browser-based SSH access to a Raspberry Pi 400. It covers the preparation of the Pi (updates, SSH server enablement), installation and authentication of the `cloudflared` daemon, and the configuration of Cloudflare for Teams to create a self-hosted application for SSH access. The process highlights the use of one-time PIN authentication and access rules for securing the connection.

4/15/2021

This post announces the renaming of Argo Tunnel to Cloudflare Tunnel and makes its core functionality (secure, outbound-only connection) free for all organizations. It details architectural improvements for stability and persistence, including removing internal dependencies and migrating to the Unimog load balancer. The introduction of Named Tunnels is highlighted as a feature enabling autonomous reconnection.

2/27/2021

This post introduces flow-based monitoring for Magic Transit, a new capability that enhances on-demand DDoS protection. It allows customers to send NetFlow or sFlow data to Cloudflare for proactive attack detection. Upon detection, Cloudflare can automatically notify customers or activate Magic Transit protection, significantly reducing the time to mitigate network-layer DDoS attacks and minimizing business impact. This complements existing Magic Transit features by providing an intelligent, proactive layer for on-demand protection.

11/19/2020

Introduced the ability to route multiple local services through a single cloudflared instance using Named Tunnels and ingress rules. Named Tunnels provide immutable IDs for tunnels, allowing them to be run and stopped independently. Ingress rules within a configuration file define how traffic arriving at the tunnel is mapped to specific local services, supporting hostname, path, and wildcard matching. Per-rule configuration allows for fine-grained control over origin request settings like timeouts and chunked encoding.

11/7/2020

This post announces the expansion of Network Analytics to Spectrum customers on the Enterprise plan, providing visibility into L3/L4 traffic patterns and DDoS attacks. It introduces two major dashboard improvements: DDoS Insights & Trends for dynamic attack trend analysis and Group-by Filtering for customized traffic analysis, making reporting and investigation easier. The post also details additional enhancements like CSV export, zoom-in features, and new visualizations.

10/13/2020

Introduced a new architecture for Argo Tunnel that separates persistent objects (DNS records, cloudflared) from ephemeral objects (connections). This includes the concept of 'Named Tunnels' with persistent names and UUIDs, allowing DNS records to point to a stable subdomain tied to the Tunnel's UUID. This makes Tunnels more resilient to restarts and simplifies management by treating them as origin servers. The post details the steps for using this new architecture: logging in with `cloudflared tunnel login`, creating a named Tunnel with `cloudflared tunnel create <name>`, and routing traffic via `cloudflared tunnel run <name>` or `cloudflared tunnel run <UUID>`, and then configuring DNS records or Load Balancer pools.

8/27/2020

This post details how the Argo Tunnel engineering team uses Argo Tunnel and Cloudflare Access to create a secure, remote development environment for their distributed team. It covers the evolution of their development stack from Docker Compose to Skaffold + Minikube, and finally to Tilt + Docker for Mac Kubernetes. The core contribution is the pattern of using Argo Tunnel as a sidecar to a reverse proxy that injects authentication tokens, secured by Cloudflare Access policies, to share Kubernetes dashboards and development environments remotely.

8/21/2020

This post details an intern's project to improve the usability of Cloudflare Spectrum for internal services. The core contribution was the integration of Spectrum's origin IP validation with the internal Addressing API. This allowed internal customers to use Cloudflare-managed IP addresses as Spectrum origins by checking for delegations within the Addressing API, bypassing the previous manual Salt configuration process. The project also involved removing Spectrum's internal deny network database and ensuring that Spectrum edge IPs are not used as origins to prevent cycles. Performance implications of the new API call were analyzed using OpenTracing.

8/7/2020

Introduced 'Argo Tunnel RDP Bastion mode' for Cloudflare Access, allowing a single `cloudflared` instance to proxy RDP connections to multiple internal servers. This simplifies deployment and management for large-scale remote desktop access, eliminating the need to install `cloudflared` on each RDP server. The bastion mode functions as a jump-host, forwarding authenticated requests from the Cloudflare edge to the specified internal RDP destination. Future plans include extending this to FTP and SSH.

4/13/2020

This post announces the extension of Cloudflare Spectrum's DDoS protection and traffic acceleration capabilities to Pro and Business plan customers for SSH, RDP, and Minecraft. It highlights the importance of securing and improving performance for these non-HTTP protocols, detailing how Spectrum proxies traffic through the Cloudflare network to protect against DDoS attacks and reduce latency. The post also outlines the pricing model and integration with Cloudflare Access.

4/7/2020

Refactored the Crossbow internal tool to improve its architecture, security, and usability. Deprecated the UI interface in favor of a CLI-only approach. Re-architected the pub/sub pipeline using gRPC daemons on the edge. Implemented JWT authentication with Cloudflare Access and cloudflared for CLI users. Placed the gRPC API endpoint on Cloudflare Spectrum to remove VPN requirements. Integrated multiple disparate tools into Crossbow, including Edge Worker Debug.

6/15/2019

Introduced a free model for Argo Tunnel, allowing users without a Cloudflare account to expose a server to the internet without opening ports. This is achieved by running the `cloudflared` daemon, which creates outbound tunnels to the Cloudflare network and generates a random subdomain of 'trycloudflare.com' for access. This model is intended for testing and development, not production, and does not offer an SLA.

3/20/2019

Introduced Spectrum for UDP, extending Cloudflare's Spectrum service to protect UDP-based applications. This includes DDoS protection and IP firewalling for UDP traffic. Developed a custom 'Simple Proxy Protocol' for UDP to prepend packet headers with original client IP, Spectrum IP, original client port, and Spectrum port, as a UDP equivalent to TCP's Proxy Protocol. Spectrum for UDP is an Enterprise-only feature.

2/12/2019

This post announces the integration of Cloudflare Spectrum and Workers (as CIS Edge Functions) into IBM Cloud Internet Services (CIS). Spectrum provides Layer 3/4 DDoS protection and SSL/TLS encryption for non-HTTP traffic across TCP and UDP ports. CIS Edge Functions (based on Cloudflare Workers) allow customers to run custom JavaScript logic at the network edge for tasks like request modification and outbound requests. CIS Log Share is also introduced for enhanced analytics and forensics. These features are part of the CIS Enterprise Plan and aim to protect and accelerate any cloud-connected workload.

2/5/2019

This post announces the availability of a Cloudflare Argo Tunnel application in the Azure Marketplace, enabling Azure customers to securely connect their origin servers to Cloudflare's edge. It also provides guidance on securing Azure's serverless static web hosting with Cloudflare SSL and details on using Cloudflare's 1.1.1.1 DNS resolver with Azure.

1/21/2019

This post details the integration of Cloudflare Argo Tunnel with Mesosphere DC/OS, enabling secure and load-balanced access to services running within DC/OS clusters. It explains how Argo Tunnel creates persistent outbound connections to Cloudflare PoPs, eliminating the need for inbound port opening, DNS configuration, or NAT/firewall rule modifications. The integration allows DC/OS users to leverage Cloudflare's network benefits like DDoS protection and CDN for their services, and enables global load balancing between multiple DC/OS clusters.

10/25/2018

This post announces the full integration of Cloudflare Spectrum with Load Balancing, enabling traffic management of TCP connections. It details the addition of TCP health checks (configurable for any TCP port), origin weights for unequal traffic splitting, and the availability of all existing Load Balancing steering modes (failover, dynamic, geo) for Spectrum applications. This integration allows for the construction of scalable gaming platforms, robust live streaming infrastructure, and cryptocurrency use cases.

6/21/2018

This post introduces load balancing capabilities for Argo Tunnels, allowing traffic to be spread across multiple instances of a service exposed via Argo Tunnel. It details how to configure cloudflared with the --lb-pool option to automatically join a load balancer pool, create DNS entries, and manage tunnels. It also highlights the integration with existing Load Balancer features like health checks and routing policies.

4/18/2018

Introduced `mmproxy`, a userspace gateway that leverages Linux's `IP_TRANSPARENT` socket option and advanced routing rules (`CONNMARK`, `fwmark`, custom routing tables) to spoof the client IP address on outgoing connections to target applications. This enables applications that do not natively support the PROXY protocol to receive the original client IP address when proxied through Cloudflare Spectrum, effectively solving the problem of preserving client IP for generic TCP tunnels.

4/12/2018

Introduced Spectrum, a new product that extends Cloudflare's security and acceleration to any TCP port and protocol for Enterprise customers. Spectrum provides DDoS protection for any internet-connected box, container, or VM, and supports TLS termination at the edge. It integrates with Cloudflare's IP Firewall for access control and can be managed via API. The post highlights early use cases with Hypixel and Montecito Bank & Trust, and discusses potential future offerings like IPv6-only Spectrum.

4/12/2018

This post details the technical challenges and solutions for enabling Cloudflare Spectrum to accept TCP connections on any port (1-65535) and on a large number of IP addresses. It explains the 'AnyIP' trick for assigning IP prefixes to the loopback interface and introduces the `TPROXY` iptables module as a solution for binding to all ports without using `conntrack`. The post provides configuration examples and a Python server demonstrating the use of `IP_TRANSPARENT` socket option.

4/6/2018

This post details the setup and demonstration of Cloudflare Argo Tunnel using a Raspberry Pi and Rust with the Gotham web framework. It covers installing the cloudflared agent, authenticating with Cloudflare, creating a tunnel to expose a local web server (initially a hello-world, then a Rust Gotham server serving Unicode), and configuring the system to auto-start on boot. The technical depth includes the agent's connection model, certificate-based security, and the use of Rust for a web server.

4/5/2018

Introduced Argo Tunnel, a private connection between a web server and Cloudflare, acting as a secure, unroutable link. This replaces expensive and complex GRE tunnels by providing a fast, easy-to-install solution that reduces firewall administrative overhead and attack surface. Argo Tunnel is built on top of Cloudflare's Argo smart routing for performance benefits and is included at no additional cost with Argo.

12/5/2017

Introduced the Cloudflare Warp Ingress Controller for Kubernetes, an open-source project developed in collaboration with StackPointCloud. This controller automatically creates secure Warp tunnels to Cloudflare for services exposed via Kubernetes Ingress resources, simplifying the secure exposure of Kubernetes-managed services to the internet. It manages the lifecycle of these tunnels transparently, registering services with Cloudflare based on Ingress resource hostnames. The integration leverages TLS tunnels for secure communication and provides benefits like DDoS protection, WAF, global load balancing, and health checks.

11/23/2017

This post introduces the beta of Warp, a product that allows users to expose locally running web servers to the internet without opening firewall ports or needing a public IP address. Warp establishes an encrypted virtual tunnel from the origin server to the Cloudflare edge, enabling the application of security policies and rate limits before requests reach the origin. It supports basic 'hello world' deployments, pointing to existing web servers, load balancing across multiple origins with health checks, and automation via Docker. Additionally, it introduces a beta feature for requiring user authentication via Cloudflare Access.

9/28/2017

Introduced Cloudflare Warp (later renamed Argo Tunnel), a tool for securely exposing web applications without direct public routability. It creates a private, encrypted virtual tunnel from the Cloudflare edge to the origin server, ensuring traffic only routes through Cloudflare. The agent issues SSL certificates, establishes encrypted connections, and sets up DNS records. It acts as a network shield, allowing policy enforcement at the edge and providing service discovery benefits through DNS registration and labeling.