How Workers VPC Services connects to your regional private networks from anywhere in the world
Nov 5, 2025Thomas Gauvin, Matt Alonso, Eric Falcão
Summary
Introduces VPC Services as the first milestone of the Workers VPC initiative, enabling Workers to connect to APIs, containers, VMs, and other services in regional private networks via Cloudflare Tunnels. Details the architecture involving Workers, Cap'n Proto, Binding Workers, Iris Service, Apollo, and Tunnel Connector Service for routing requests from global Workers to regional private networks. Highlights security benefits like explicit service access control and SSRF immunity through the binding model.
More from the Internal Service Exposure & Management with Spectrum trail
- Route public traffic to private applications with Cloudflare
- Secure private networking for everyone: users, nodes, agents, Workers — introducing Cloudflare Mesh
- How Automatic Return Routing solves IP overlap
- A QUICker SASE client: re-building Proxy Mode
- So long, and thanks for all the fish- how to escape the Linux networking stack