TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Internal Service Exposure & Management with Spectrum

62 posts · Sep 2017 – Jun 2026

What this trail covers

Cloudflare Spectrum now supports load balancing traffic to private IP endpoints, extending Layer 4 load balancing capabilities to non-HTTP(S) TCP and UDP traffic destined for private networks. This integration with Apollo and Director allows for secure, private origin access via Cloudflare Tunnels, eliminating the need for on-premise hardware and enhancing security by keeping origins inaccessible from the public internet. Future enhancements include support for authenticated device traffic and internal-only traffic.

All Cloudflare trails
  1. Route public traffic to private applications with CloudflareThis post introduces Application Services for Private Origins, a new capability that allows routing public traffic to private origins without exposing those origins to the public Internet. This is achieved by extending Cloudflare's private networking layer directly into the application services stack, enabling security, performance, and programmability services (WAF, bot management, rate limiting, caching, rewrites, Workers) to protect private applications. The feature leverages existing private connectivity patterns like Cloudflare Tunnel, Cloudflare One Client, Cloudflare WAN, and Cloudflare Mesh. It introduces a `use_private_routing` flag for DNS records and extends Spectrum to support private origins via `virtual_network_id`. This enables private IPs to be treated as valid origin targets for public hostnames, unifying the model across Cloudflare products.
  2. Secure private networking for everyone: users, nodes, agents, Workers — introducing Cloudflare MeshIntroduces Cloudflare Mesh, a new product for bidirectional, many-to-many private networking for users, nodes, and agents. Mesh integrates with Cloudflare One and the Developer Platform (Workers, Durable Objects) to provide secure access to private infrastructure. It leverages existing WARP Connector (now Mesh node) and WARP Client (now Cloudflare One Client) for setup. Mesh offers global edge routing, integrated security controls (Gateway policies, Access rules, device posture checks), and high availability. It complements Cloudflare Tunnel by providing a full mesh network rather than unidirectional proxying. Workers can now access Mesh networks via the `cf1:network` binding in `wrangler.jsonc`.
  3. A QUICker SASE client: re-building Proxy ModeThis post details a significant re-architecture of the Cloudflare One Client's proxy mode. It replaces the previous WireGuard-based L3 tunneling and smoltcp implementation with a direct Layer 4 proxying approach using QUIC and MASQUE. This change eliminates performance bottlenecks, doubles download/upload speeds, and significantly reduces latency, improving user experience for various use cases including VPN coexistence, high-bandwidth applications, and developer tools.
  4. How Automatic Return Routing solves IP overlapIntroduces Automatic Return Routing (ARR) as a closed beta feature for Cloudflare One customers. ARR solves the problem of IP address overlap in enterprise networks (mergers, extranets, cookie-cutter architectures) by using stateful tracking instead of traditional routing tables. It remembers the originating tunnel for each network flow, allowing return traffic to be sent back to the correct source without ambiguity. ARR is built on the new Unified Routing framework, which consolidates network-layer and user-space routing logic for improved performance and interoperability.
  5. How Workers VPC Services connects to your regional private networks from anywhere in the worldIntroduces VPC Services as the first milestone of the Workers VPC initiative, enabling Workers to connect to APIs, containers, VMs, and other services in regional private networks via Cloudflare Tunnels. Details the architecture involving Workers, Cap'n Proto, Binding Workers, Iris Service, Apollo, and Tunnel Connector Service for routing requests from global Workers to regional private networks. Highlights security benefits like explicit service access control and SSRF immunity through the binding model.
  7. So long, and thanks for all the fish- how to escape the Linux networking stackThis post details the development of the SLATFATF (fish) service to address limitations in the Linux networking stack for managing soft-unicast IP addresses. It explains the challenges of collision avoidance between bound sockets and forwarded packets, particularly when using Netfilter/conntrack, and explores solutions like Netlink and the TCP_REPAIR socket option with TCP Fast Open to achieve reliable IP address leasing and packet forwarding for products like WARP.
  8. Connect and secure any private or public app by hostname, not IP — free for everyone in Cloudflare OneIntroduced hostname-based routing for Cloudflare Tunnel, enabling users to route traffic to private and public applications based on hostname or domain instead of IP addresses. This simplifies Zero Trust policy creation and management by eliminating the need for brittle IP lists and allowing for per-resource authorization. The feature is integrated with Cloudflare Access and Gateway policies for HTTPS and non-HTTP applications respectively.
  9. Your IPs, your rules- enabling more efficient address space usageThis post introduces Service Bindings for Bring Your Own IP (BYOIP) prefixes, enabling customers to use parts of a single IP prefix for multiple Cloudflare services (CDN, Spectrum, Magic Transit). It details the technical challenges and solutions involved in dynamically reallocating prefixes across services, including updates to iptables, IP sets, and the eBPF-based Tubular service. The post highlights the integration of Tubular with the NGINX ingress proxy via a shared Unix domain socket and the phased deployment strategy to minimize disruption. It also explains how Service Bindings provide granular control over traffic routing, allowing for more efficient IP address usage and cost optimization.
  10. A global virtual private cloud for building secure cross-cloud apps on Cloudflare WorkersThis post introduces Workers VPC and Workers VPC Private Links, extending Cloudflare's private networking capabilities. Workers VPC provides an isolated, global virtual private cloud environment for Workers applications and Developer Platform resources. Workers VPC Private Links enable secure, bidirectional connectivity between Workers VPCs and legacy VPCs in public or private clouds, allowing Workers to access external private resources and vice versa. This simplifies cross-cloud application development, reduces egress fees, and leverages existing private networking infrastructure like Cloudflare Tunnels and Cloudflare Network Interconnect.
  11. Build global MySQL apps using Cloudflare Workers and HyperdriveThis post introduces native support for MySQL databases within Cloudflare Workers, leveraging Hyperdrive for optimal performance. It details the technical challenges overcome, including Node.js compatibility improvements for the `mysql` and `mysql2` drivers, and the integration of Hyperdrive with the MySQL wire protocol. This enables developers to build global applications that connect directly to MySQL databases hosted anywhere, with improved performance and reduced latency.
  12. Pools across the sea: how Hyperdrive speeds up access to databases and why we’re making it freeThis post announces that Hyperdrive is now available on the free plan of Cloudflare Workers. It details how Hyperdrive improves performance by reducing latency through connection pooling and caching, and provides a benchmark demonstrating a significant reduction in query times. The post also explains the transaction-mode pooling approach used by Hyperdrive and outlines the multi-round trip process of establishing a new connection to a PostgreSQL database, highlighting the problem Hyperdrive solves.
  13. Elephants in tunnels: how Hyperdrive connects to databases inside your VPC networksThis post details the technical implementation of integrating Hyperdrive with Cloudflare Tunnels to enable Workers to connect to private databases. It explains the custom Postgres message protocol handling, the use of Rust traits like AsyncRead and AsyncWrite for generic stream handling, and the development of a custom WebSocket stream implementation to bridge Hyperdrive's needs with the Tunnel's underlying WebSocket protocol. The post provides code examples for sending Postgres startup messages and illustrates the flexibility gained by abstracting transport layers.
  14. Eliminating hardware with Load Balancing and Cloudflare OneThis post introduces the integration of Cloudflare Load Balancing with Cloudflare One to support end-to-end private traffic flows and WARP authenticated device traffic, eliminating the need for dedicated hardware load balancers. It details how private L4 load balancers are now accessible via private IP addresses within a customer's virtual network, and how Magic WAN and WARP can serve as on-ramps to these private services. The enhancement allows for load balancing of public and private traffic directed at private networks, offering greater flexibility in architecture by directing traffic from any on-ramp to any off-ramp, including Cloudflare Tunnel, CNI connections, or the public internet.
  15. Extending Private Network Load Balancing load balancing to Layer 4 with SpectrumThis post announces the extension of Cloudflare Spectrum's load balancing capabilities to support private IP endpoints. Previously, Spectrum supported public IP origins for Layer 4 load balancing. The integration with Apollo (Zero Trust team's unifying service) and Director (Cloudflare's internal load balancing service) now allows Spectrum to proxy TCP and UDP traffic to private origins hosted in data centers, public clouds, or on-premise. When Director indicates a private origin, Spectrum passes the private IP and virtual network ID to Apollo, which then routes the traffic. This enables load balancing of non-HTTP(S) traffic to private networks without exposing origins to the public internet.
  16. From IP packets to HTTP: the many faces of our Oxy frameworkThis post introduces Cloudflare's Oxy framework, a Rust-based proxy that operates across multiple OSI layers. It details how Oxy handles raw IP packets for Cloudflare One and Zero Trust principles, implements IP tunneling with context for multi-tenancy (e.g., WARP, Magic WAN), and tracks IP flows for policy enforcement and auditing. Crucially, it explains how Oxy upgrades IP flows to TCP streams by leveraging the Linux kernel's TUN interface and network namespaces, enabling user-space applications to process TCP connections efficiently. This significantly expands the capabilities for managing and securing internal services by providing fine-grained control at various network layers.
  17. Protect your key server with Keyless SSL and Cloudflare Tunnel integrationIntroduced integration of Cloudflare Tunnels with Keyless SSL to secure key server communication. Previously, Keyless SSL required a public DNS record for key servers, exposing them to the internet. The new approach uses Cloudflare Tunnels to create a private, secure channel, meaning the key server's IP address is no longer publicly discoverable. This enhances security by ensuring only Cloudflare initiates connections to the key server, reducing its attack surface.
  18. Using Cloudflare Access with CNIIntroduces Cloudflare Aegis, a new product that provides a reliable, dedicated IP address for traffic originating from Cloudflare to customer infrastructure. This, combined with Cloudflare Network Interconnect (CNI) and Cloudflare Access, allows for secure application access over a private link without requiring installed software or application code modifications on the origin server. Aegis ensures that the assigned IP address is exclusively used by Cloudflare services for a specific account, enabling network-level firewall policies to create an airgap around the application, with Layer 7 security provided by Access.
  19. Cloudflare Application Services for private networks: do more with the tools you already loveThis post announces new integrations that extend Cloudflare's Application Services (like WAF, API security, load balancing, and DNS) to private networks. It details how Cloudflare One's dataplane, combined with services like Cloudflare Tunnel, GRE, IPsec, and CNI, enables WAF policies for private traffic, API security for internal APIs, and global/local traffic management for private apps. It also introduces Private DNS for consolidated management of internal and external DNS resources.
  20. Give us a ping. (Cloudflare) One ping only.This post introduces the integration of ping, traceroute, and MTR into Cloudflare Zero Trust. It details how ICMP traffic is proxied over QUIC datagrams, reusing existing UDP infrastructure. The technical explanation covers the use of echo request/reply messages, TTL handling, and how cloudflared processes ICMP packets by encapsulating the entire IP packet within a QUIC datagram. It also provides troubleshooting examples for connectivity issues.
  21. Introducing post-quantum Cloudflare TunnelThis post introduces post-quantum cryptography to Cloudflare Tunnel, enabling users to secure the connection between their origin servers and Cloudflare's network against future quantum computer decryption. It details the implementation of a `--post-quantum` flag in `cloudflared` and the use of hybrid key exchanges (X25519Kyber) to achieve this, marking a significant step towards a post-quantum internet.
  22. A stronger bridge to Zero TrustThis post significantly enhances the "Internal Service Exposure & Management with Spectrum" thread by detailing how Cloudflare One acts as a bridge to Zero Trust for organizations migrating from legacy network architectures. It introduces composable on- and off-ramps that interoperate seamlessly, including GRE, IPsec, and CNI tunnels connecting to Cloudflare Tunnel and WARP clients. The post also highlights expanded support for Anycast IPsec parameters, improved dashboard management, Terraform provider integration, and new integration guides for SD-WAN appliances, all aimed at simplifying the transition to Zero Trust.
  23. Using Cloudflare Tunnel and Access with PostgresThis post details the internal adoption of Cloudflare Tunnel and Cloudflare Access to replace SSH-based bastion hosts for accessing internal PostgreSQL databases. It describes the deployment of Cloudflare Tunnel within an internal Kubernetes cluster to establish connectivity to the database servers, and the implementation of identity-driven Zero Trust policies via Cloudflare Access for authentication and authorization. The post also covers the client-side setup using cloudflared for users to establish local TCP connections to the databases, and the maintenance of SSH jump-hosts as a 'break glass' procedure. The learnings highlight improved security posture, user experience, and the value of dogfooding Cloudflare's own products.
  24. MPLS to Zero Trust in 30 daysThis post details the transition of enterprise networks from outdated MPLS architectures to a Zero Trust model using Cloudflare Magic WAN and the Cloudflare One product suite. It highlights the limitations of MPLS in supporting modern distributed applications and the challenges of SD-WAN, then introduces Magic WAN as a solution that simplifies WAN architectures, integrates Zero Trust security services, and offers improved performance and management through Cloudflare's global network. The post also outlines a comprehensive prep and transition plan for organizations undertaking this migration.
  25. Integrating Network Analytics Logs with your SIEM dashboardThis post introduces Network Analytics Logs for Magic Transit, Magic Firewall, Magic WAN, and Spectrum customers on the Enterprise plan. It details how these logs can be fed into SIEM systems like Splunk for near real-time visibility into network traffic, dropped packets, and DDoS attacks. The post outlines the log contents, provides a setup guide for integrating with Splunk via API, and highlights the option to use R2 storage for cost-effective log management.
  26. Building many private virtual networks through Cloudflare Zero TrustIntroduced the concept of virtual networks within Cloudflare Zero Trust, allowing for the creation of multiple segregated private networks. This enables the routing of traffic through distinct virtual networks, even when those networks have overlapping IP address spaces. The implementation involves using the `cloudflared` CLI to add virtual networks and route IP subnets to specific tunnels, with WARP clients able to select their desired virtual network.
  27. Ridiculously easy to use TunnelsThis post introduces a significant simplification to the Cloudflare Tunnel creation and management process by enabling it directly from the Zero Trust dashboard. This new GUI-driven approach reduces the required steps from up to 14 CLI commands to just three. It eliminates the need for local configuration files and the management of separate authentication tokens (`cert.pem` and `Tunnel_UUID.json`), as these are now handled by the dashboard. The post also details how this new workflow integrates with both clientless (via Access) and client-based (via WARP and Gateway) Zero Trust deployments, and outlines future plans for migration tooling and support for global configuration options.
  28. Unlocking QUIC’s proxying potential with MASQUEThis post introduces MASQUE (Multiplexing And Secure Communication over QUIC Encapsulation) as a protocol that leverages QUIC's DATAGRAM frames to enable UDP tunneling. It explains how MASQUE, built on extended CONNECT requests, allows for proxying non-TCP applications like HTTP/3, addressing the limitations of TCP-based proxying and extending Cloudflare Tunnel's capabilities to handle a wider range of protocols and improve privacy through nested tunneling.
  29. Guest Blog: k8s tunnels with Kudelski SecurityKudelski Security developed an internal tool 'k8s-tunnels' that leverages Cloudflare Tunnel as an Identity-aware Proxy (IAP) to provide secure, automated access to Kubernetes clusters across multi-cloud environments. The tool automates the discovery of accessible K8s clusters based on Zero Trust policies, embeds the 'cloudflared' daemon, and configures local CLI clients (kubectl, k9s) to use a SOCKS5 proxy for authenticated access. This significantly improves developer experience and security posture by eliminating manual configuration and providing a single pane of visibility.
  30. Everything you ever wanted to know about UDP sockets but were afraid to ask, part 1This post introduces the concepts of connected vs. unconnected UDP sockets, detailing their use cases and implications for client and server implementations. It highlights the challenges of binding UDP servers to wildcard addresses and introduces the IP_RECVPKTINFO CMSG on Linux/BSD as a solution for determining the destination IP of incoming packets. The post also discusses the difficulty of graceful UDP server restarts and presents the 'established-over-unconnected' technique as a method to achieve TCP-like connection handling for UDP services, while acknowledging its race conditions and suitability for specific use cases.
  31. Announcing Argo for SpectrumThis post announces the general availability of Argo for Spectrum, extending Argo Smart Routing's performance optimization capabilities to any TCP-based application. It details how Argo for Spectrum reduces latency, packet loss, and improves connectivity for protocols like Minecraft, RDP, and SFTP by leveraging Cloudflare's network intelligence to provision faster routes. Benchmarks show significant throughput increases, attributed to reducing the bandwidth-delay product by terminating TCP connections closer to the user and optimizing the route to the origin. The feature is enabled by toggling 'Argo Smart Routing' when creating a Spectrum application.
  32. Cloudflare Tunnel for Content TeamsThis post details the technical implementation of using Cloudflare Tunnel and Cloudflare Access to create secure, ephemeral preview environments for technical writers. It outlines the steps involved in setting up a named tunnel, routing DNS to a local development server (localhost:8000), and securing access with an Access policy restricted to internal employees. The workflow allows technical writers to share their work-in-progress documentation with stakeholders in real-time, mimicking the published experience.
  33. Getting Cloudflare Tunnels to connect to the Cloudflare Network with QUICThis post details the successful integration of QUIC (UDP-based) into Cloudflare Tunnel, addressing performance limitations and Head-of-Line blocking inherent in the previous TCP/HTTP/2 approach. It highlights a critical debugging process involving UDP's connectionless nature and Linux kernel's source IP selection heuristics, culminating in the implementation of explicit source address control using `sendmsg` and `recvmsg` system calls to ensure reliable connectivity.
  34. Tunnel: Cloudflare’s Newest HomeownerIntroduced a new UI for Cloudflare Tunnel in the Cloudflare for Teams Dashboard, offering enhanced visibility into tunnel status, routes, uptime, connectors, and `cloudflared` version. The UI simplifies onboarding with interactive guides for macOS, Windows, and Linux, covering origin connection and WARP integration. It provides detailed observability metrics like Status (Active, Inactive, Degraded) and Uptime, calculated based on the health of long-lived TCP connections. The UI also visualizes Ingress Rules for serving multiple services from a single tunnel and displays `cloudflared` replicas with their connection status and version. Users can now manage and delete tunnels directly from the dashboard.
  35. May I ask who’s calling, please? A recent rise in VoIP DDoS attacksThis post details how Cloudflare's Magic Transit service protects VoIP infrastructure from multi-vector DDoS attacks, including L7 and L3/4 attacks targeting VoIP server infrastructure, by leveraging its global network, sophisticated traffic filtering, and real-time threat intelligence. It highlights the effectiveness of its Anycast architecture and edge-based DDoS mitigation for UDP and SIP traffic, ensuring performance and call quality are maintained during attacks.
  36. Quick Tunnels: Anytime, AnywhereIntroduced 'Quick Tunnels' for Cloudflare Tunnel, a feature that allows users to create and expose local services to the internet with a single command (`cloudflared tunnel`) without requiring an account or prior onboarding. This leverages Cloudflare Workers for tunnel creation and management, and a complementary edge service for DNS record creation. It also utilizes Workers Cron Triggers for automated cleanup of abandoned tunnels. The feature is built on a more resilient and stable architecture, enabling longer-lived tunnels compared to previous account-free offerings.
  37. Making Magic Transit health checks faster and more responsiveThis post details the evolution of the health check system for Cloudflare Magic Transit. It describes the initial naive approach, the subsequent improvement using multicast within data centers, and the final, highly efficient solution employing consistent hashing to distribute health check responsibilities. This new approach significantly reduced CPU and memory usage at the edge, making the system more scalable and responsive.
  38. Building a Pet Cam using a Raspberry Pi, Cloudflare Tunnels and TeamsThis post details the setup of a personal pet cam using a Raspberry Pi, Cloudflare Tunnel, and Cloudflare Access. It explains how to configure the Raspberry Pi with a camera module and the Motion software to stream video, and then uses Cloudflare Tunnel to expose this internal service to the internet. Cloudflare Access is then used to secure the stream with Google authentication, demonstrating a practical application of these services for remote access and security.
  39. Browser VNC with Zero Trust RulesIntroduced Browser VNC, a VNC client rendered entirely in the browser, leveraging Cloudflare Workers for edge deployment and Cloudflare Tunnel for secure connectivity to existing TCP tunnels. This enables clientless access to VNC servers, integrating with Cloudflare Access for Zero Trust controls and providing end-to-end encryption. Future plans include full auditability of user actions within VNC sessions.
  40. Highly available and highly scalable Cloudflare tunnelsIntroduced the ability to run multiple instances of `cloudflared` for a single Cloudflare Tunnel. This enables elastic auto-scaling of `cloudflared` instances, graceful restarts for zero-downtime configuration changes, and easier integration with Kubernetes by allowing multiple `cloudflared` pods to manage the same tunnel.
  41. SSHing to my Raspberry Pi 400 from a browser, with Cloudflare Tunnel and Auditable TerminalThis post details the setup of Cloudflare Tunnel and Auditable Terminal to provide secure browser-based SSH access to a Raspberry Pi 400. It covers the preparation of the Pi (updates, SSH server enablement), installation and authentication of the `cloudflared` daemon, and the configuration of Cloudflare for Teams to create a self-hosted application for SSH access. The process highlights the use of one-time PIN authentication and access rules for securing the connection.
  42. A Boring Announcement: Free Tunnels for EveryoneThis post announces the renaming of Argo Tunnel to Cloudflare Tunnel and makes its core functionality (secure, outbound-only connection) free for all organizations. It details architectural improvements for stability and persistence, including removing internal dependencies and migrating to the Unimog load balancer. The introduction of Named Tunnels is highlighted as a feature enabling autonomous reconnection.
  43. Flow-based monitoring for Magic TransitThis post introduces flow-based monitoring for Magic Transit, a new capability that enhances on-demand DDoS protection. It allows customers to send NetFlow or sFlow data to Cloudflare for proactive attack detection. Upon detection, Cloudflare can automatically notify customers or activate Magic Transit protection, significantly reducing the time to mitigate network-layer DDoS attacks and minimizing business impact. This complements existing Magic Transit features by providing an intelligent, proactive layer for on-demand protection.
  44. Many services, one cloudflaredIntroduced the ability to route multiple local services through a single cloudflared instance using Named Tunnels and ingress rules. Named Tunnels provide immutable IDs for tunnels, allowing them to be run and stopped independently. Ingress rules within a configuration file define how traffic arriving at the tunnel is mapped to specific local services, supporting hostname, path, and wildcard matching. Per-rule configuration allows for fine-grained control over origin request settings like timeouts and chunked encoding.
  45. Announcing Spectrum DDoS Analytics and DDoS Insights & TrendsThis post announces the expansion of Network Analytics to Spectrum customers on the Enterprise plan, providing visibility into L3/L4 traffic patterns and DDoS attacks. It introduces two major dashboard improvements: DDoS Insights & Trends for dynamic attack trend analysis and Group-by Filtering for customized traffic analysis, making reporting and investigation easier. The post also details additional enhancements like CSV export, zoom-in features, and new visualizations.
  46. Argo Tunnels that live foreverIntroduced a new architecture for Argo Tunnel that separates persistent objects (DNS records, cloudflared) from ephemeral objects (connections). This includes the concept of 'Named Tunnels' with persistent names and UUIDs, allowing DNS records to point to a stable subdomain tied to the Tunnel's UUID. This makes Tunnels more resilient to restarts and simplifies management by treating them as origin servers. The post details the steps for using this new architecture: logging in with `cloudflared tunnel login`, creating a named Tunnel with `cloudflared tunnel create <name>`, and routing traffic via `cloudflared tunnel run <name>` or `cloudflared tunnel run <UUID>`, and then configuring DNS records or Load Balancer pools.
  47. How Argo Tunnel engineering uses Argo TunnelThis post details how the Argo Tunnel engineering team uses Argo Tunnel and Cloudflare Access to create a secure, remote development environment for their distributed team. It covers the evolution of their development stack from Docker Compose to Skaffold + Minikube, and finally to Tilt + Docker for Mac Kubernetes. The core contribution is the pattern of using Argo Tunnel as a sidecar to a reverse proxy that injects authentication tokens, secured by Cloudflare Access policies, to share Kubernetes dashboards and development environments remotely.
  48. How Cloudflare uses Cloudflare Spectrum: A look into an intern’s project at CloudflareThis post details an intern's project to improve the usability of Cloudflare Spectrum for internal customers. The project involved integrating with the Addressing API to allow internal services to use Cloudflare-managed IP addresses as Spectrum origins, bypassing a previous restriction. This was achieved by checking IP ownership, delegation, and ensuring the IP was not already in use as a Spectrum edge IP. The post also discusses the performance implications of this change and how OpenTracing was used to analyze and mitigate them.
  49. Protecting Remote Desktops at Scale with Cloudflare AccessIntroduced 'Argo Tunnel RDP Bastion mode' for Cloudflare Access, allowing a single `cloudflared` instance to proxy RDP connections to multiple internal servers. This simplifies deployment and management for large-scale remote desktop access, eliminating the need to install `cloudflared` on each RDP server. The bastion mode functions as a jump-host, forwarding authenticated requests from the Cloudflare edge to the specified internal RDP destination. Future plans include extending this to FTP and SSH.
  50. Cloudflare for SSH, RDP and MinecraftCloudflare Spectrum is now available to Pro and Business plan customers, extending DDoS protection and traffic acceleration to SSH, RDP, and Minecraft services. This expands Spectrum's reach beyond Enterprise customers, offering these non-HTTP protocols the benefits of Cloudflare's network for improved reliability, performance, and security. The post details the ease of configuration through the dashboard and the pricing model, including a free data allowance for Pro and Business plans.
  51. Project Crossbow: Lessons from Refactoring a Large-Scale Internal ToolRefactored the Crossbow internal tool to improve its architecture, security, and usability. Deprecated the UI interface in favor of a CLI-only approach. Re-architected the pub/sub pipeline using gRPC daemons on the edge. Implemented JWT authentication with Cloudflare Access and cloudflared for CLI users. Placed the gRPC API endpoint on Cloudflare Spectrum to remove VPN requirements. Integrated multiple disparate tools into Crossbow, including Edge Worker Debug.
  52. It's crowded in here!This post details the evolution of socket programming techniques at Cloudflare for handling multiple IP addresses and ports on edge servers. It covers the naive approach of one socket per IP, the use of `INADDR_ANY` for simplifying socket management, the limitations of `INADDR_ANY` (especially with `SO_REUSEADDR` vs. `SO_REUSEPORT`), the `SO_BINDTOPREFIX` socket option for constraining wildcard binds to specific IP ranges (and its upstream rejection), and the use of TPROXY with `IP_TRANSPARENT` for a catch-all-ports socket to enable services like Spectrum to listen on all 65,535 ports.
  53. A free Argo Tunnel for your next projectIntroduced a free model for Argo Tunnel, allowing users without a Cloudflare account to expose a server to the internet without opening ports. This is achieved by running the `cloudflared` daemon, which creates outbound tunnels to the Cloudflare network and generates a random subdomain of 'trycloudflare.com' for access. This model is intended for testing and development, not production, and does not offer an SLA.
  54. Spectrum for UDP: DDoS protection and firewalling for unreliable protocolsIntroduced Spectrum for UDP, extending DDoS protection and IP firewalling to UDP-based services. Developed a custom 'Simple Proxy Protocol' for UDP to convey client IP and port information to origin servers, as a UDP equivalent to TCP's Proxy Protocol is not standardized. This feature is initially Enterprise-only.
  55. IBM Cloud Internet Services protects any cloud – now with Cloudflare Spectrum and WorkersThis post announces the integration of Cloudflare Spectrum and Workers (as CIS Edge Functions) into IBM Cloud Internet Services (CIS). Spectrum provides Layer 3/4 DDoS protection and SSL/TLS encryption for non-HTTP traffic across TCP and UDP ports. CIS Edge Functions (based on Cloudflare Workers) allow customers to run custom JavaScript logic at the network edge for tasks like request modification and outbound requests. CIS Log Share is also introduced for enhanced analytics and forensics. These features are part of the CIS Enterprise Plan and aim to protect and accelerate any cloud-connected workload.
  56. Cloudflare Support for Azure CustomersThis post announces the availability of a Cloudflare Argo Tunnel application in the Azure Marketplace, enabling Azure customers to securely connect their origin servers to Cloudflare's edge. It also provides guidance on securing Azure's serverless static web hosting with Cloudflare SSL and details on using Cloudflare's 1.1.1.1 DNS resolver with Azure.
  57. Argo Tunnel + DC/OSThis post details the integration of Cloudflare Argo Tunnel with Mesosphere DC/OS, enabling secure and load-balanced access to services running within DC/OS clusters. It explains how Argo Tunnel creates persistent outbound connections to Cloudflare PoPs, eliminating the need for inbound port opening, DNS configuration, or NAT/firewall rule modifications. The integration allows DC/OS users to leverage Cloudflare's network benefits like DDoS protection and CDN for their services, and enables global load balancing between multiple DC/OS clusters.
  58. Introducing Spectrum with Load BalancingThis post announces the full integration of Cloudflare Spectrum with Load Balancing, enabling traffic management of TCP connections. It details the addition of TCP health checks (port probing for accepted connections), origin weights for unequal traffic splitting, and the availability of all steering modes (failover, dynamic, geo) for transport load balancing through Spectrum. This integration allows for building scalable TCP applications by combining Spectrum's proxying capabilities with the Load Balancer's feature set.
  59. Argo Tunnels: Spread the LoadThis post introduces load balancing capabilities for Argo Tunnels, allowing traffic to be spread across multiple instances of a service exposed via Argo Tunnel. It details how to configure cloudflared with the --lb-pool option to automatically join a load balancer pool, create DNS entries, and manage tunnels. It also highlights the integration with existing Load Balancer features like health checks and routing policies.
  60. mmproxy - Creative Linux routing to preserve client IP addresses in L7 proxiesIntroduced mmproxy, a new tool that enables the preservation of original client IP addresses for L7 proxies that do not natively support protocols like PROXY or custom TCP headers. mmproxy achieves this by accepting PROXY protocol headers from an upstream load balancer (like Cloudflare Spectrum) and then using Linux's IP_TRANSPARENT socket option and routing tricks (CONNMARK, fwmark, and a custom routing table) to spoof the client IP address when connecting to the target application via the loopback interface. This allows applications like sshd, which lack PROXY protocol support, to see the original client IP.
  61. Introducing Spectrum: Extending Cloudflare To 65,533 More PortsIntroduced Spectrum, a product that extends Cloudflare's security and acceleration to any TCP port and protocol for Enterprise customers. Spectrum provides DDoS protection for any internet-connected box, container, or VM, including those running email, file transfer, or custom protocols. It offers TLS termination at the edge for performance benefits and enables encryption for legacy protocols. Spectrum integrates with Cloudflare's IP Firewall for connection management and can be controlled via API.
  62. Abusing Linux's firewall: the hack that allowed us to build SpectrumThis post details the technical challenges and solutions for enabling Cloudflare Spectrum to accept connections on any TCP port and IP address. It explains the limitations of the BSD sockets API and the Linux kernel's `conntrack` module for this use case. The solution involves using the 'AnyIP' trick to assign IP prefixes to the loopback interface and the `TPROXY` iptables module in conjunction with the `IP_TRANSPARENT` socket option to redirect traffic to a single listening socket on localhost. This bypasses the need to bind to all 65535 ports individually and avoids the performance issues associated with `conntrack`.
  63. Cloudflare Argo Tunnel with Rust+Raspberry PiThis post details the setup and demonstration of Cloudflare Argo Tunnel using a Raspberry Pi and Rust with the Gotham web framework. It covers installing the cloudflared agent, authenticating with Cloudflare, creating a tunnel to expose a local web server (initially a hello-world, then a Rust Gotham server serving Unicode), and configuring the system to auto-start on boot. The technical depth includes the agent's connection model, certificate-based security, and the use of Rust for a web server.
  64. Argo Tunnel: A Private Link to the Public InternetIntroduced Argo Tunnel, a private connection between a web server and Cloudflare, acting as a secure, unroutable link. This replaces expensive and complex GRE tunnels by providing a fast, easy-to-install solution that reduces firewall administrative overhead and attack surface. Argo Tunnel is built on top of Cloudflare's Argo smart routing for performance benefits and is included at no additional cost with Argo.
  65. Introducing the Cloudflare Warp Ingress Controller for KubernetesIntroduced the Cloudflare Warp Ingress Controller for Kubernetes, an open-source project developed in collaboration with StackPointCloud. This controller automatically creates secure Warp tunnels to Cloudflare for services exposed via Kubernetes Ingress resources, simplifying the secure exposure of Kubernetes-managed services to the internet. It manages the lifecycle of these tunnels transparently, registering services with Cloudflare based on Ingress resource hostnames. The integration leverages TLS tunnels for secure communication and provides benefits like DDoS protection, WAF, global load balancing, and health checks.
  66. Want to try Warp? We just enabled the beta for youThis post introduces the beta of Warp, a product that allows users to expose locally running web servers to the internet without opening firewall ports or needing a public IP address. Warp establishes an encrypted virtual tunnel from the origin server to the Cloudflare edge, enabling the application of security policies and rate limits before requests reach the origin. It supports basic 'hello world' deployments, pointing to existing web servers, load balancing across multiple origins with health checks, and automation via Docker. Additionally, it introduces a beta feature for requiring user authentication via Cloudflare Access.
  67. Introducing Cloudflare Warp: Hide Behind The EdgeIntroduced Cloudflare Warp (later renamed Argo Tunnel), a tool for securely exposing web applications without direct public routability. It creates a private, encrypted virtual tunnel from the Cloudflare edge to the origin server, ensuring traffic only routes through Cloudflare. The agent issues SSL certificates, establishes encrypted connections, and sets up DNS records. It acts as a network shield, allowing policy enforcement at the edge and providing service discovery benefits through DNS registration and labeling.