Connect services and devices with post-quantum encrypted mesh networking
Cloudflare One•Official page ↗
Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs
You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session.
Add Mesh participants with guided onboarding
Cloudflare Mesh now makes it faster to add and manage participants from the dashboard. Select Add participant from Networking > Mesh to deploy a Mesh node or find the information needed to connect a client device.
Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once
You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time.
Hostname routing is now generally available, with a new public IP range for initial resolved IPs
Hostname routing is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors:
Container image for Cloudflare Mesh
Cloudflare Mesh nodes can now run as Docker containers. The cloudflare/mesh image is available on Docker Hub for Docker Compose, Kubernetes, and any OCI-compatible runtime — no host-level package installation required.
Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026
On October 5, 2026, two changes take effect across the Zero Trust Networks API and Cloudflare Tunnel API: the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the connections field.
Hostname routing for Cloudflare Mesh
You can now add hostname routes to a Cloudflare Mesh node, in addition to CIDR routes.
Manage all your routes from one page in the dashboard
The Routes page in the Cloudflare dashboard now shows the routes across all of your connectors — Cloudflare Mesh and Cloudflare Tunnel routes alongside Cloudflare WAN and Magic Transit static routes — in a single table, instead of a separate routes view per product.
Filter Workers' public Internet traffic using Gateway policies
Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway.
High availability replica management for Cloudflare Mesh
The Cloudflare Mesh dashboard now shows per-replica details for high availability nodes. You can see which replica is active, view each replica's Mesh IP and connection details, and manually trigger failover — all from the node detail page.
Granular permissions for Cloudflare Tunnel and Cloudflare Mesh
You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.
