Workers VPC - Reach Cloudflare WAN destinations from Workers VPC

You can now use VPC Network bindings with network_id: "cf1:network" to reach your full private network from Workers, including:

• Cloudflare Mesh nodes and client devices
• Subnet routes and hostname routes announced through Cloudflare Tunnel or Cloudflare Mesh
• Destinations connected through Cloudflare WAN on-ramps — GRE, IPsec, and CNI

This means a single VPC Network binding can route Worker requests to private services regardless of how those services are connected to Cloudflare: through a Cloudflare Tunnel from a cloud VPC, a Mesh node on a private subnet, or a Cloudflare WAN on-ramp from your data center or branch site.

• wrangler.jsonc

  <div><div><span>{</span></div></div><div><div><span>  </span><span>"</span><span>vpc_networks</span><span>"</span><span>:</span><span> </span><span>[</span></div></div><div><div><span>    </span><span>{</span></div></div><div><div><span>      </span><span>"</span><span>binding</span><span>"</span><span>:</span><span> </span><span>"PRIVATE_NETWORK"</span><span>,</span></div></div><div><div><span>      </span><span>"</span><span>network_id</span><span>"</span><span>:</span><span> </span><span>"cf1:network"</span><span>,</span></div></div><div><div><span>      </span><span>"</span><span>remote</span><span>"</span><span>:</span><span> </span><span>true</span><span>,</span></div></div><div><div><span>    </span><span>},</span></div></div><div><div><span>  </span><span>],</span></div></div><div><div><span>}</span></div></div>

• wrangler.toml

  <div><div><span>[[</span><span>vpc_networks</span><span>]]</span></div></div><div><div><span>binding</span><span> </span><span>=</span><span> </span><span>"PRIVATE_NETWORK"</span></div></div><div><div><span>network_id</span><span> </span><span>=</span><span> </span><span>"cf1:network"</span></div></div><div><div><span>remote</span><span> </span><span>=</span><span> </span><span>true</span></div></div>

At runtime, the URL you pass to fetch() determines the destination:

<div><div><span>// Reach a service behind a Cloudflare WAN IPsec on-ramp</span></div></div><div><div><span>const</span><span> </span><span>response</span><span> </span><span>=</span><span> </span><span>await</span><span> </span><span>env</span><span>.</span><span>PRIVATE_NETWORK</span><span>.</span><span>fetch</span><span>(</span><span>"http://10.50.0.100:8080/api"</span><span>)</span><span>;</span></div></div>

For configuration options, refer to VPC Networks.