Your IPs, your rules- enabling more efficient address space usage
May 19, 2025Mark Rodgers, Sphoorti Metri, Ash Pallarito
Summary
This post details the technical enhancements made to Cloudflare's BYOIP (Bring Your Own IP) functionality, enabling dynamic reallocation of IP address prefixes across services (CDN, Spectrum, Magic Transit). Key technical contributions include: extending the Tubular eBPF program to support CDN traffic by integrating with the NGINX ingress proxy via a shared Unix domain socket, enabling dynamic IP address binding without service restarts; implementing Service Bindings for granular control over traffic routing to different pipelines based on IP address or subnet; and outlining the ongoing work to reduce IP prefix transition times from hours to minutes through improved coordination and orchestration systems.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack