Workers VPC

Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session.

TCP connections via connect() over VPC Networks

VPC Network bindings now support the connect() Socket API for raw TCP connections to private destinations, in addition to HTTP traffic via fetch().

Filter Workers' public Internet traffic using Gateway policies

Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway.

Reach Cloudflare WAN destinations from Workers VPC

You can now use VPC Network bindings with network_id: "cf1:network" to reach your full private network from Workers, including:

VPC Networks and Cloudflare Mesh support now in public beta

VPC Network bindings now give your Workers access to any service in your private network without pre-registering individual hosts or ports. This complements existing VPC Service bindings, which scope each binding to a specific host and port.

Observability for Workers VPC Services

Each VPC Service now has a Metrics tab so you can monitor connection health and debug failures without leaving the dashboard.

Origin CA certificate support for Workers VPC

Workers VPC now supports Cloudflare Origin CA certificates when connecting to your private services over HTTPS. Previously, Workers VPC only trusted certificates issued by publicly trusted certificate authorities (for example, Let's Encrypt, DigiCert).