Cloudflare Tunnel

Protect Quick Tunnels with email authentication

You can now restrict who can access a Quick Tunnel. Use the new --allowed-mail flag in cloudflared to require visitors to authenticate with a one-time PIN sent to their email before they reach your local service.

Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session.

cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027

Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared. After the deprecation takes effect, Cloudflare will no longer publish new cloudflared releases for either architecture.

Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once

You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time.

Configure origin application settings for Cloudflare Tunnel in the dashboard

You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a Cloudflare Tunnel.

Hostname routing is now generally available, with a new public IP range for initial resolved IPs

Hostname routing is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors:

Stream live logs from Cloudflare Tunnel in the dashboard

Real-time Tunnel log streaming is now available in the Cloudflare dashboard under Networking > Tunnels.

Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026

On October 5, 2026, two changes take effect across the Zero Trust Networks API and Cloudflare Tunnel API: the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the connections field.

Manage all your routes from one page in the dashboard

The Routes page in the Cloudflare dashboard now shows the routes across all of your connectors — Cloudflare Mesh and Cloudflare Tunnel routes alongside Cloudflare WAN and Magic Transit static routes — in a single table, instead of a separate routes view per product.

Cloudflare Tunnel now runs connectivity pre-checks at startup

Starting with cloudflared version 2026.5.2, Cloudflare Tunnel automates the entire connectivity pre-checks workflow directly inside the binary. Previously, customers had to install dig and netcat and run those commands by hand to verify their environment.

Granular permissions for Cloudflare Tunnel and Cloudflare Mesh

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.

Stream logs from multiple replicas of Cloudflare Tunnel simultaneously

In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all replicas of that tunnel and supports streaming logs from multiple replicas at once.

Manage Cloudflare Tunnels with Wrangler

You can now manage Cloudflare Tunnels directly from Wrangler, the CLI for the Cloudflare Developer Platform. The new wrangler tunnel commands let you create, run, and manage tunnels without leaving your terminal.

Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard

Cloudflare Tunnel is now available in the main Cloudflare Dashboard at Networking > Tunnels, bringing first-class Tunnel management to developers using Tunnel for securing origin servers.

Verify WARP Connector connectivity with a simple ping

We have made it easier to validate connectivity when deploying WARP Connector as part of your software-defined private network.