VPC Networks

Last updated Oct 15, 2026 VPC Networks allow your Workers to access any service in your private network without pre-registering individual hosts or ports. You can bind to a specific Cloudflare Tunnel to reach any service behind that tunnel, or bind to Cloudflare Mesh to reach any Mesh node, client device, subnet route or hostname route announced through Cloudflare Tunnel or Mesh, or destination reachable through a Cloudflare WAN on-ramp (GRE, IPsec, or CNI).

At runtime, the URL you pass to fetch() or the address you pass to connect() determines the destination — any hostname or IP address reachable through the bound Cloudflare Tunnel or through Cloudflare Mesh. Use fetch() for HTTP traffic, and connect() for raw TCP connections (Redis, MQTT, custom protocols, and other non-HTTP services). This differs from VPC Services, which require you to create a separate binding for each target host and port combination.

Note

Workers VPC is currently in beta. Features and APIs may change before general availability. While in beta, Workers VPC is available for free to all Workers plans.

Bind to a Cloudflare Tunnel

Note

Binding directly to a Cloudflare Tunnel through a VPC Network binding requires the Connectivity Directory Admin role.

Reference a specific Cloudflare Tunnel directly by its UUID:

{
  "vpc_networks": [
    {
      "binding": "MY_VPC",
      "tunnel_id": "550e8400-e29b-41d4-a716-446655440000",
      "remote": true
    }
  ]
}

[[vpc_networks]]
binding = "MY_VPC"
tunnel_id = "550e8400-e29b-41d4-a716-446655440000"
remote = true

The remote flag must be set to true to enable remote bindings during local development.

Bind to Cloudflare Mesh

Cloudflare Mesh (formerly WARP Connector) connects your services, devices, and Workers through Cloudflare's global network. When you bind a Worker to Cloudflare Mesh using network_id: "cf1:network", your Worker can reach:

• Any Mesh node or client device in your account
• Subnet routes and hostname routes announced through Cloudflare Tunnel or Cloudflare Mesh
• Destinations reachable through Cloudflare WAN on-ramps (GRE, IPsec, and CNI)
• Public Internet destinations through Cloudflare Gateway — with your existing Zero Trust traffic policies enforced and traffic logged in DNS, HTTP, and Network logs

All of this without specifying a particular Cloudflare Tunnel UUID.

Use cf1:network when:

• Your Workers need to reach private services across multiple Cloudflare Tunnels, Mesh nodes, or Cloudflare WAN on-ramps
• You want to access your entire private network from a Worker without managing individual Cloudflare Tunnel bindings
• Your private network topology may change (new connections, new nodes, new routes) and you do not want to update Worker configuration each time
• You want Worker egress to public destinations to flow through Cloudflare Gateway for policy enforcement and visibility

Gateway drops HTTP traffic from Workers VPC if it matches a Forward policy (beta). Exclude Workers VPC traffic from your Forward policies.

Note

Your account must have at least one active Cloudflare Tunnel, Cloudflare Mesh node, or Cloudflare WAN on-ramp that can reach the target services.

For destinations behind Cloudflare WAN on-ramps (GRE, IPsec, or CNI), your network must also route the Cloudflare source IP range (100.64.0.0/12 by default) back through the on-ramp so reply traffic returns to Cloudflare. This is part of standard Cloudflare WAN onboarding. If you have already configured this for Gateway, Load Balancing, or other Cloudflare services that reach your private network through Cloudflare WAN, no additional setup is required.

Bind to Cloudflare Mesh using network_id: "cf1:network":

{
  "vpc_networks": [
    {
      "binding": "MY_VPC",
      "network_id": "cf1:network",
      "remote": true
    }
  ]
}

[[vpc_networks]]
binding = "MY_VPC"
network_id = "cf1:network"
remote = true

Runtime usage

HTTP via fetch()

Access any HTTP service in your network at runtime using fetch():

export default {
    async fetch(request: Request, env: Env) {
        // Access a service by private IP
        const response = await env.MY_VPC.fetch("http://10.0.1.50/data");

        // Access another service on a different port
        const dbResponse = await env.MY_VPC.fetch("http://10.0.5.42:5432");

        return response;
    },
};

When a VPC Network cannot establish a connection to your target service, fetch() throws an exception.

TCP via connect()

Open raw TCP connections to any private destination using connect(). This is useful for non-HTTP protocols like Redis, Memcached, MQTT, or custom binary protocols:

export default {
    async fetch(request: Request, env: Env) {
        // Open a TCP connection to a private Redis instance
        const socket = await env.MY_VPC.connect("10.0.1.50:6379");

        // Write a Redis PING command
        const writer = socket.writable.getWriter();
        await writer.write(new TextEncoder().encode("PING\r\n"));
        await writer.close();

        return new Response(socket.readable);
    },
};

When a VPC Network cannot establish a TCP connection, connect() throws an exception.

Note

connect() over VPC Networks currently supports plaintext TCP only.

Logs

Traffic sent through a VPC Network binding appears in Gateway network logs with Workers VPC as the Traffic Source.

Zero Trust Network Session Logs also record which Worker started each session. Workers VPC sessions report OnrampType as WORKERS_VPC, SourceName as the Worker name, and SourceID as the Worker's stable identifier. Use these fields to audit which Worker reached a private service, or to debug a failed connection.

Note

SourceName and SourceID are only populated for Workers deployed after the release of Worker attribution in Network Session Logs. Redeploy existing Workers to include them. No code changes are required.

VPC Networks vs VPC Services

VPC Networks and VPC Services both connect Workers to private infrastructure, but they make different trade-offs.

• Use VPC Services when you have a known set of targets and want each binding scoped to a specific host and port.
• Use VPC Networks when you need broader access — an entire Cloudflare Tunnel or all of Cloudflare Mesh — and want the URL in your fetch() call to control routing at runtime.

The following table summarizes the differences:

Next steps

• Set up Cloudflare Tunnel
• Set up Cloudflare Mesh
• Set up Cloudflare WAN
• Try the Connect Workers to Cloudflare Mesh example
• Learn about the Workers Binding API

Was this helpful?

YesNo

On this page

Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/#page","headline":"VPC Networks","description":"Bind Workers to an entire Cloudflare Tunnel or Cloudflare Mesh without pre-registering hosts.","url":"https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/","inLanguage":"en","image":"https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/og.png?v=5276f4b158e0621f","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Register private network resources as VPC Services that Workers can access through Cloudflare Tunnel. title: VPC Services image: https://developers.cloudflare.com/workers-vpc/configuration/vpc-services/og.png?v=2c2633353a7f0d7f

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/workers-vpc/llms.txt
Use this file to discover all available pages before exploring further.