TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Load Balancing UI and Feature Enhancements

43 posts · Mar 2013 – Oct 2025

What this trail covers

Cloudflare's Load Balancing service has evolved to offer Dynamic Steering, enabling automatic traffic direction to the fastest pool based on EWMA RTT measurements from Cloudflare regions. This feature addresses the limitations of manual Geo Steering by dynamically adapting to network conditions and user location. The system propagates pool RTT data via an in-house key-value store (QuickSilver) replicated across all machines in every data center to ensure low-latency steering decisions. This post extends this by enabling end-to-end private traffic flows and WARP authenticated device traffic, eliminating the need for dedicated hardware load balancers by integrating with Cloudflare One, Magic WAN, and WARP for private IP load balancers.

All Cloudflare trails
  1. Load Balancing Monitor Groups: Multi-Service Health Checks for Resilient ApplicationsIntroduces Monitor Groups for Cloudflare Load Balancing, allowing the bundling of multiple health monitors (e.g., HTTP, TCP, Database) into a single logical entity. This enables sophisticated, multi-service health assessments and aggregated health scores for more intelligent failover decisions. Key features include 'must_be_healthy' for critical monitors, 'monitoring_only' for observational probes, and quorum-based health determination (more than 50% of checking data centers reporting UP). The latency metric for Dynamic Steering is updated to be the average RTT of all active, non-monitoring-only members in the Monitor Group.
  2. Your IPs, your rules- enabling more efficient address space usageThis post introduces 'Service Bindings' for Bring Your Own IP (BYOIP) prefixes, allowing customers to dynamically allocate parts of their IP address space to different Cloudflare services (CDN, Spectrum, Magic Transit) rather than being restricted to a single service per prefix. It details the technical challenges and solutions, including enhancements to Tubular (an eBPF-based IP and port binding service) and the integration with NGINX ingress proxies, to enable this dynamic reallocation at scale. The post also highlights the ongoing work to reduce the transition time for IP prefix migrations between services.
  3. Simplify cloud routing and object storage configurations with Cloud ConnectorThis post introduces Cloud Connector, a new feature that simplifies multi-cloud routing and object storage configurations. It allows users to direct traffic for a single hostname to multiple cloud providers (AWS S3, Google Cloud Storage, Azure Blob Storage, R2) without complex workarounds, extending capabilities previously limited to Enterprise customers to all plans. The feature leverages the Ruleset Engine and introduces a new `http_request_cloud_connector` phase, with plans to support more HTTP cloud services in the future.
  4. Eliminating hardware with Load Balancing and Cloudflare OneThis post introduces the integration of Cloudflare Load Balancing with Cloudflare One, Magic WAN, and WARP to support end-to-end private traffic flows and WARP authenticated device traffic. This allows for load balancing to private networks via private IP addresses, eliminating the need for dedicated hardware load balancers. It details how Magic WAN and WARP act as on-ramps to these private load balancers, enabling secure and private connectivity to internal applications. The technical contribution lies in the integration of load balancing services with private networking services, assigning private IP addresses within a customer's virtual network, and enabling traffic off-ramping to various secure traffic off-ramps.
  5. Extending Private Network Load Balancing load balancing to Layer 4 with SpectrumThis post announces the extension of Cloudflare's load balancing capabilities to Layer 4 (TCP/UDP) for private IP addresses. Previously, private network load balancing was limited to HTTP(S) traffic. This new feature integrates Cloudflare Spectrum, Cloudflare Tunnels, and Apollo to enable load balancing of non-HTTP(S) traffic to internal servers, eliminating the need for expensive on-premise hardware and providing DDoS protection and origin IP concealment for these private services.
  7. Magic Cloud Networking simplifies security, connectivity, and management of public cloudsThis post introduces Magic Cloud Networking, a new capability built on the acquisition of Nefeli Networks. It addresses the complexities of managing public cloud networks by providing a unified, automated, and secure solution. The post details the challenges of cloud networking, such as poor visibility, rapid pace, diverse technologies, new cost models, security risks, and multi-vendor environments. It positions Magic Cloud Networking as a management plane solution that leverages native cloud data plane constructs, offering end-to-end visibility and simplifying multi-cloud network management within the Cloudflare One ecosystem.
  8. Cloudflare treats SASE anxiety for VeloCloud customersThis post details Cloudflare's strategy for migrating customers from VeloCloud to Cloudflare Magic WAN, positioning Magic WAN as a superior alternative for SASE. It highlights the architectural differences between acquisition-based SASE models and Cloudflare's integrated connectivity cloud approach. The post outlines the transition process, emphasizing consultation with solutions architects, product education workshops on Magic WAN, and support from customer success teams. It also touches upon the underlying architectural principles of Cloudflare's network and its composability.
  9. Fulfilling the promise of single-vendor SASE through network modernizationThis post announces significant updates to Cloudflare One, Cloudflare's SASE platform, focusing on fulfilling the promise of single-vendor SASE through network modernization. It introduces more flexible on-ramps for site-to-site connectivity (agent/proxy-based and appliance/routing-based), new WAN-as-a-service (WANaaS) capabilities for networking teams (high availability, application awareness, VM deployment, enhanced visibility), and Zero Trust connectivity for DevOps (mesh and peer-to-peer secure networking). The post details how these updates simplify SASE implementation for security, networking, and DevOps teams by offering a unified, integrated solution that avoids the fragmentation of multi-vendor approaches.
  10. Announcing General Availability for the Magic WAN Connector: the easiest way to jumpstart SASE transformation for your networkThis post announces the general availability of the Magic WAN Connector, a key component of Cloudflare One's SASE platform. It simplifies SASE transformation for enterprise networks by providing zero-touch connectivity between existing network hardware and Cloudflare's global network. The connector offers automated routing, traffic steering, shaping, and failover, along with integrated Zero Trust security controls (Secure Web Gateway and private network security) for all traffic. It represents a significant step in evolving beyond SD-WAN by offering a unified, single-vendor SASE solution with reduced cost and complexity.
  11. Elevate load balancing with Private IPs and Cloudflare Tunnels: a secure path to efficient traffic distributionThis post introduces Private Network Load Balancing, which extends Cloudflare's load balancing capabilities to private IP addresses within data centers by integrating with Cloudflare Tunnels. It allows for intelligent steering policies (e.g., least outstanding requests, hash steering) to be applied at the origin server level, removing the need for physical load balancers and simplifying configuration through the Cloudflare dashboard. The solution aims to provide a unified approach to global and internal load balancing.
  12. Lost in transit: debugging dropped packets from negative header lengthsThis post details the debugging and resolution of packet drops encountered after switching from Foo-over-UDP encapsulation with virtual interfaces to IPVS native Generic UDP Encapsulation (GUE). The issue stemmed from negative header lengths during encapsulation, causing packets exceeding the Internet MTU to be dropped by the traffic directors. The root cause was identified through eBPF tracing with `pwru` and `perf-probe`, revealing packet drops within the `validate_xmit_skb` function called from `ip_vs_tunnel_xmit`. The fix involved addressing the underlying kernel behavior related to header length calculation during GUE encapsulation.
  13. Argo Smart Routing for UDP: speeding up gaming, real-time communications and moreIntroduced Argo Smart Routing for UDP traffic, extending the existing Argo Smart Routing product to accelerate UDP-based applications like gaming and real-time communications. This involved extending route computations to UDP and validating performance improvements through testing, showing up to 17.3% reduction in round-trip-time.
  14. How Orpheus automatically routes around bad Internet weatherThis post introduces Orpheus, a system that automatically identifies and routes traffic around Internet connectivity outages in real-time, even those outside of Cloudflare's network. It leverages Cloudflare's global network to find alternative paths, preventing request failures (like 522 errors) and improving origin reachability. Orpheus builds upon the reliability features of Argo Smart Routing, making advanced routing around Internet 'weather' available to all customers for free.
  15. Cloud CNI privately connects your clouds to CloudflareThis post introduces Cloud CNI (Cloudflare Network Interconnect) which enables direct, private connections from major cloud providers (IBM Cloud, Google Cloud, Azure, OCI, AWS) into Cloudflare's network. This significantly simplifies corporate network connectivity by allowing Cloudflare to act as the central network intermediary, replacing multiple vendors and complex routing. It integrates seamlessly with existing Cloudflare One products like Magic WAN, Access, and Gateway to provide enhanced security, privacy, and simplified management for cloud-based resources.
  16. Cloudflare Application Services for private networks: do more with the tools you already loveThis post significantly expands the Load Balancing feature thread by detailing the integration of Cloudflare's application services, including WAF, API security, and load balancing, with the Cloudflare One dataplane for private networks. It introduces the ability to apply WAF policies and API security to internal APIs and private applications, regardless of their network on-ramp. Furthermore, it announces upcoming capabilities for application-layer load balancing for traffic connected via various off-ramps and extending load balancing into local networks. It also highlights the automatic application of Argo Smart Routing for full-stack performance optimization of private apps and the introduction of Private DNS for unified management of internal network resources.
  17. Announcing the Magic WAN Connector: the easiest on-ramp to your next generation networkThis post introduces the Magic WAN Connector, a lightweight software package designed to simplify the integration of existing physical or cloud networks into Cloudflare's global network. It acts as an easy on-ramp for adopting SASE, automating connectivity, traffic steering, and shaping. The connector provides end-to-end traffic management features like routing, load balancing, failover, and application-aware steering, and integrates seamlessly with Cloudflare One's security suite. The post also highlights the open-sourcing of the connector and expansion of Network On-Ramp partnerships.
  18. How we built Pingora, the proxy that connects Cloudflare to the InternetThis post introduces Pingora, a new in-house HTTP proxy built with Rust, designed to replace NGINX for Cloudflare's core proxying needs. It details the architectural limitations of NGINX that led to this decision, such as unbalanced load distribution, poor connection reuse, and difficulties in adding custom functionality. Pingora's design leverages Rust for memory safety and performance, a multithreaded, work-stealing scheduler with Tokio for efficient resource sharing and connection pooling, and an event-based programmable interface similar to NGINX/OpenResty for extensibility. The post highlights Pingora's production performance improvements, including a 5ms reduction in median TTFB and an 80ms reduction in the 95th percentile, significant improvements in connection reuse ratios (e.g., from 87.1% to 99.92%), and the ability to add new features like HTTP/2 upstream support more rapidly.
  19. Load Balancing with Weighted PoolsIntroduced Weighted Pools as a feature for Cloudflare Load Balancer, allowing customers to assign relative weights to origin pools. This extends the 'Random' traffic steering policy to distribute requests based on these weights. The feature supports scenarios such as balancing traffic across unequally sized origin pools, acting as a kill switch for data centers by setting weights to 0, and enabling network A/B testing by directing a small percentage of traffic to new pools. Configuration is available via the Dashboard and API.
  20. Magic NAT: everywhere, unbounded, and lower costThis post introduces Magic NAT, a new service that extends Cloudflare's network capabilities by providing a globally distributed, unbounded, and cost-effective Network Address Translation (NAT) solution. It addresses the limitations of traditional NAT hardware and virtual appliances, such as geographical constraints, capacity limits, and complex pricing models, by leveraging Cloudflare's Anycast architecture and Zero Trust platform. Magic NAT supports various use cases including public NAT, private NAT for overlapping IP spaces, and IP address conservation, and integrates with other Cloudflare One security features.
  21. A Primer on ProxiesThis post introduces the concept of forward proxying and details how the HTTP CONNECT method has evolved across HTTP/1.1, HTTP/2, and QUIC/HTTP/3 to establish end-to-end tunnels. It highlights Cloudflare's involvement in standardizing efficient proxy protocols like MASQUE and its application in features like iCloud Private Relay, demonstrating advancements in secure and performant data encapsulation and tunneling.
  22. Protect all network traffic with CloudflareThis post introduces the ability to offer Cloudflare-managed IP space as a service for Magic Transit. This allows customers with smaller networks, who cannot advertise their own IP space via BGP, to leverage Magic Transit for DDoS protection, performance, and reliability. It details use cases for consistent cross-cloud security, protecting branches of any size, and protecting streamers by masking their home IP addresses.
  23. How Cloudflare Is Solving Network Interconnection for CIOsThis post details Cloudflare's strategy for solving network interconnection challenges for CIOs and IT teams. It emphasizes making interconnection valuable by providing access to Cloudflare's security, reliability, and performance products with zero additional latency, and leveraging network effects from its vast customer base. It also outlines plans to expand interconnection availability to 1000 new office locations through Cloudflare for Offices and describes efforts to reduce provisioning times for network connectivity to minutes by automating BGP configurations and streamlining cross-connect provisioning with partners.
  24. Argo for Packets is Generally AvailableIntroduces Argo for Packets, which optimizes traffic at the IP layer by dynamically selecting the fastest and most available path through Cloudflare's global network. This is achieved by leveraging health check probes and Layer 4 traffic analytics to construct dynamic routes, resulting in an average 10% latency improvement. The post details latency reductions with specific examples for different network topologies and highlights its integration with Magic Transit, Magic WAN, and Cloudflare for Offices.
  25. Announcing Argo for SpectrumThis post announces the general availability of Argo for Spectrum, extending Cloudflare's Argo Smart Routing capabilities beyond HTTP to any TCP-based application. It highlights how Argo for Spectrum reduces latency, packet loss, and improves connectivity for protocols like SFTP, RDP, and gaming, demonstrating significant performance improvements through benchmarks and explaining the underlying 'bandwidth delay product' concept. This marks a significant expansion of Cloudflare's performance optimization services to non-HTTP traffic.
  26. Magic makes your network fasterThis post details how Cloudflare's "Magic" suite of products (Magic Transit, Magic WAN, Magic Firewall) leverages Anycast architecture, global network presence, and intelligent routing decisions to improve network performance for IP traffic. It explains how Anycast tunnels simplify connectivity, how running services everywhere enables efficient traffic processing, and how the "global hub" architecture eliminates the "trombone" effect of traditional hub-and-spoke models. Performance improvements are demonstrated through comparative tests showing reduced latency and increased throughput. The post also introduces Argo Smart Routing for Packets as a further enhancement for IP traffic performance.
  27. Argo 2.0: Smart Routing Learns New TricksThis post announces significant upgrades to Cloudflare's Argo intelligent routing. Key enhancements include extending Argo's optimization to the 'last mile' (client to Cloudflare), reducing end-user round trip times by up to 40% and overall time to first byte by 39%. It also introduces support for accelerating pure IP workloads through 'Argo Smart Routing for Packets' for Magic Transit and Magic WAN customers. This new capability leverages health check probes and Layer 4 data to determine optimal IP-level routes, achieving an average of 10% latency improvement for these workloads. The improvements are automatically deployed for existing Argo customers.
  28. Making Magic Transit health checks faster and more responsiveIntroduced a new distributed health check system for Magic Transit GRE tunnels. This system replaces the previous naive approach where each server independently checked each tunnel every minute. The new system utilizes consistent hashing to assign responsibility for checking specific tunnels to individual servers within a data center. These assigned servers then send health checks more frequently and share aggregated results via multicast heartbeats. This significantly reduced CPU usage by over 70% and memory usage by nearly 85% at the edge.
  29. Rich, complex rules for advanced load balancingIntroduced a custom rule builder for Cloudflare Load Balancing, allowing users to define complex traffic steering logic using 'and' and 'or' statements. This feature leverages the open-source wirefilter execution engine, providing a familiar syntax for users of Firewall Rules. The post details use cases for path-based routing, header-based steering, and split-horizon DNS setups, and explains the differences in available fields between DNS and proxied load balancing modes.
  30. Per Origin Host Header OverrideIntroduced the ability to override the Host header on a per-origin basis within Cloudflare's Load Balancing solution. This feature addresses issues where third-party applications (e.g., Heroku, S3) require specific origin hostnames that differ from the end-user's requested domain. The override is applied to both the request to the origin and its associated health monitor. Restrictions are in place to ensure the override is a valid 'Host' header, a single FQDN or IP address resolvable by public DNS, and a subdomain of an account-associated zone.
  31. Unimog - Cloudflare’s edge load balancerThis post introduces Unimog, Cloudflare's internal Layer 4 Load Balancer (L4LB) designed for edge data centers. Unimog addresses limitations in existing load balancing solutions by running on general-purpose servers, performing dynamic load balancing based on real-time server load measurements, supporting long-lived connections, managing virtual IP addresses as ranges, and integrating tightly with DDoS mitigation using XDP. It improves load distribution uniformity across diverse server hardware within data centers.
  32. High Availability Load Balancers with MaglevThis post details the implementation of a new stateless L4 load balancing architecture using Maglev consistent hashing, IPVS, and Foo-Over-UDP encapsulation. Key technical contributions include preserving source IPs, supporting distributed backends, enabling zero-downtime maintenance via BGP and statelessness, utilizing well-tested Linux features, avoiding explicit connection synchronization, and allowing staged rollouts. The implementation addresses challenges with MTU and encapsulation, and introduces a Go agent for configuring IPVS and iptables, with an open-sourced netlink package for IPVS management.
  33. Adding the Fallback Pool to the Load Balancing UI and other significant UI enhancementsThis post introduces the addition of a fallback pool to the Load Balancing UI, allowing users to designate a pool of last resort for traffic when all other pools are unavailable. It also details significant UI improvements, including a facelift and de-modaling of the Load Balancing app, combining health status and icons, and updating toggle buttons. Shared objects like Monitors and Pools now have columns indicating their usage, and confirmation modals with impact lists are added for edits. Edits to Monitors are now restricted to the Manage Monitors page. Action buttons have been updated from icons to clear text ('Edit', 'Delete') to prevent accidental deletions.
  34. Introducing Load Balancing AnalyticsIntroduced Load Balancing Analytics, providing users with detailed insights into traffic flow distribution, origin health status, and latency metrics from Cloudflare's global network. The analytics service includes an overview of traffic flow, a latency map, and event logs for origin health changes. Additionally, a GraphQL Analytics API is now available for programmatic data extraction.
  35. MultiCloud... flareThis post introduces Cloudflare's capabilities for multi-cloud operations, focusing on Load Balancing, Argo Tunnel, and Access Control. Load Balancing is presented as a Layer 7 solution running on Cloudflare's global network, offering features like weighting, latency-based routing, and health checks independent of cloud providers. Argo Tunnel is described as a method to establish secure, outbound tunnels from customer infrastructure to Cloudflare's edge, simplifying networking and enabling dynamic scaling across clouds and on-premise environments. Access Control is highlighted as a zero-trust solution leveraging identity providers to secure access to infrastructure regardless of its cloud location, with an example of SSH access control.
  36. Custom Load Balancing With Cloudflare WorkersThis post introduces the use of Cloudflare Workers to implement custom load balancing logic, including random routing, fallback strategies for downed servers, and geographic routing based on the CF-IPCountry header. It provides code examples demonstrating how to intercept requests, modify hostnames, and implement these load balancing patterns.
  37. I Wanna Go Fast - Load Balancing Dynamic SteeringIntroduced Dynamic Steering for Cloudflare Load Balancing, enabling automatic traffic direction to the fastest pool based on EWMA RTT measurements. Solved the problem of deciding which pool is fastest by using existing health check RTT data and calculating pool RTT using Exponential Weighted Moving Average (EWMA) for faster response to changes and noise reduction. Addressed data propagation by replicating pool RTT data to an in-house key-value store (QuickSilver) on every machine in every data center.
  38. Creating a single pane of glass for your multi-cloud Kubernetes workloads with CloudflareThis post demonstrates how to use Cloudflare Load Balancer in conjunction with Kubernetes to achieve multi-cloud benefits, such as avoiding vendor lock-in, running applications on the best-suited cloud, and lowering costs. It provides a guide on deploying an application using Kubernetes on GCP and AWS with Cloudflare Load Balancer.
  39. Living In A Multi-Cloud WorldThis post introduces the concept of multi-cloud strategies for companies, highlighting the benefits of cost efficiencies, negotiation strength, business continuity, and experimentation. It details how Cloudflare's Load Balancing service can be used to implement a multi-cloud setup by acting as a global traffic aggregator. A case study of Billforward is presented, demonstrating how they use Cloudflare Load Balancing to failover traffic between Google Compute Engine and Amazon Web Services, with active layer 7 health checks and manual traffic shifting capabilities. The configuration involves setting up pools for each cloud provider and enabling proxying through Cloudflare. The post also touches upon Billforward's use of Docker and Rancher for orchestration and their loosely coupled system architecture.
  40. Introducing Argo — A faster, more reliable, more secure Internet for everyoneIntroduced Argo, a 'virtual backbone' for the Internet, featuring Smart Routing and Tiered Cache. Smart Routing analyzes real-time Internet traffic data (latency, packet loss) to optimize routing paths between Cloudflare PoPs and origin servers, reducing latency and connection errors. Tiered Cache utilizes the global network of PoPs to serve content from other Cloudflare locations before hitting the origin, significantly reducing cache miss rates and origin load. Argo Smart Routing tunnels requests over a secure overlay network, improving reliability and performance compared to public Internet transit.
  41. Introducing Load Balancing & Intelligent Failover with CloudflareThis post announces the general availability of Cloudflare's Load Balancing service, previously only available to Enterprise customers. It highlights the ability to route requests between multiple origins for performance and reliability, with near-instant failover for proxied traffic. The service runs within Cloudflare's datacenters, offering resilience against DDoS attacks and cloud provider issues. It also introduces active and passive monitoring for single-origin setups to alert customers of origin problems. The post details how to enable Load Balancing in the Traffic app and its pricing structure.
  42. Cloudflare Traffic Manager: The DetailsThis post introduces Cloudflare Traffic Manager, detailing its configuration for load balancing, failover, and geo-steering. It highlights rapid failover (seconds) enabled by Anycast DNS and per-data center health checks. The post also describes how Cloudflare uses Traffic Manager internally for its own website, combining failover and geo-steering. An early access program is announced.
  43. How the CloudFlare Team Got Into Bondage (It's Not What You Think)This post details the implementation of port bonding (802.3ad Dynamic Link Aggregation) on Cloudflare's Generation 3 servers to aggregate multiple 1Gbps network interfaces into a single logical interface, increasing maximum throughput. It also describes the custom configuration of IRQ handling to isolate external and internal network traffic across physical CPUs and their cores, preventing network interrupts from becoming a bottleneck during large SYN flood attacks and ensuring customer traffic isolation.
  44. Load Balancing without Load BalancersThis post details Cloudflare's architectural approach to load balancing without traditional hardware load balancers, focusing on the use of Anycast routing at both the Wide Area Network (WAN) and Local Area Network (LAN) levels. It explains how Anycast is used at the WAN level to route traffic to the closest data center based on the shortest path, and at the LAN level within data centers, where each server announces routes via BGP using the Bird software. The system is designed to handle failures gracefully, with monitors detecting process crashes and signaling Bird to withdraw routes, rerouting traffic to the next available server. The post also touches on early experiments with BGP for true load balancing, particularly for UDP traffic, and acknowledges the complexities of stateful protocols like TCP and SSL.