[ZT] Load Balancing traffic to Cloudflare Tunnel endpoints #25578

ranbel · 2025-10-01T22:40:18Z

PCX-16753

github-actions · 2025-10-01T22:41:17Z

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
`/public/__redirects`	`@cloudflare/pcx-content-engineering`, `@cloudflare/pcx-technical-writing`, `@kodster28`
`/src/content/docs/cloudflare-one/connections/connect-networks/`	`@nikitacano`, `@ranbel`, `@cloudflare/pcx-technical-writing`
`/src/content/docs/learning-paths/`	`@cloudflare/pcx-technical-writing`
`/src/content/docs/load-balancing/`	`@angelampcosta`, `@cloudflare/pcx-technical-writing`
`/src/content/docs/reference-architecture/`	`@securitypedant`, `@haleycode`, `@cloudflare/pcx-technical-writing`
`/src/content/docs/spectrum/`	`@angelampcosta`, `@cloudflare/pcx-technical-writing`
`/src/content/docs/support/`	`@zeinjaber`, `@ngayerie`, `@cloudflare/pcx-technical-writing`, `@cloudflare/customer-support`
`*`	`@cloudflare/pcx-technical-writing`

github-actions · 2025-10-01T22:47:25Z

This PR requires additional review attention because it affects the following areas:

Redirects

This PR changes current filenames or deletes current files. Make sure you have redirects set up to cover the following paths:

/cloudflare-one/connections/connect-networks/private-net/cloudflared/load-balancing/
/cloudflare-one/connections/connect-networks/routing-to-tunnel/lb/
/load-balancing/private-network/tunnels-setup/
/load-balancing/private-network/warp/

github-actions · 2025-10-01T22:58:08Z

Preview URL: https://4ea5c72c.preview.developers.cloudflare.com
Preview Branch URL: https://ranbel-load-balancing-with-zt.preview.developers.cloudflare.com

Files with changes (up to 15)

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx

chungthuang · 2025-10-13T20:51:11Z

...e-one/connections/connect-networks/configure-tunnels/tunnel-availability/deploy-replicas.mdx

+
+1. To create a remotely-managed tunnel, follow the [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/).
+2. On the **Tunnels** page, select your newly created tunnel. The **Connectors** section shows all of the `cloudflared` instances for that tunnel.
+3. Select **Configure**.


Do we want to mention that the replicas will have the same config? We can't apply custom config per replica.

.../cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/index.mdx

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx

chungthuang · 2025-10-13T21:44:14Z

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx

+
+If you notice traffic imbalances across endpoints in different locations, you may have to adjust your load balancer setup.
+
+`cloudflared` connections give preference to tunnels that terminate in the same Cloudflare data center. This behavior can impact how connections are weighted and traffic is distributed.


We might want to be clear that we prefer to serve eyeball using cloudflared connections that are in the same data center.

attempted to clarify this here: 959a9fc

src/content/docs/load-balancing/private-network/warp-to-tunnel.mdx

chungthuang · 2025-10-13T22:03:14Z

src/content/docs/load-balancing/private-network/warp-to-tunnel.mdx

+To create a new tunnel:
+
+<Render file="tunnel/create-tunnel" product="cloudflare-one" />
+9. Go to the **CIDR** tab.


Can we update https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/ to better explain how to setup IP/CIDR?

Hey @chungthuang would you mind elaborating on what should change? Are you referring to adding VNET details?

DevinCarr · 2025-10-16T22:32:58Z

src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns.mdx

-/>
+When you create a tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created tunnel. You can treat `<UUID>.cfargotunnel.com` as if it were an origin target in the Cloudflare dashboard.
+
+Unlike publicly routable IP addresses, `<UUID.cfargotunnel.com` will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.


Suggested change

Unlike publicly routable IP addresses, `<UUID.cfargotunnel.com` will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.

Unlike publicly routable IP addresses, `<UUID>.cfargotunnel.com` will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.

DevinCarr · 2025-10-16T22:34:11Z

src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns.mdx

-/>
+When you create a tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created tunnel. You can treat `<UUID>.cfargotunnel.com` as if it were an origin target in the Cloudflare dashboard.
+
+Unlike publicly routable IP addresses, `<UUID.cfargotunnel.com` will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.


Suggested change

Unlike publicly routable IP addresses, `<UUID.cfargotunnel.com` will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.

Unlike publicly routable IP addresses, `<UUID.cfargotunnel.com` will only proxy traffic for a DNS record in the same Cloudflare account. The Tunnel UUID is not secret information; if someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.

chungthuang · 2025-10-16T22:34:14Z

...onnections/connect-networks/do-more-with-tunnels/local-management/tunnel-useful-commands.mdx

 | `cloudflared tunnel create <NAME or UUID>`                                             | Creates a tunnel, registers it with the Cloudflare edge and generates a credential file to run this tunnel.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `cloudflared tunnel route`                                                             | Routes traffic through a tunnel.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `cloudflared tunnel route lb <NAME or UUID> <load balancer name> <load balancer pool>` | Creates a Load Balancer with a pool that points to the tunnel.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `cloudflared tunnel route lb <NAME or UUID> <hostname> <load balancer pool>` | Adds a tunnel as an endpoint in a [load balancer pool](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/). A new load balancer and pool will be created if necessary. <ul> <li> `<hostname>`: the public-facing hostname of the load balancer, for example `lb.example.com` </li> <li> `<load balancer pool>`: the name of the [pool](/load-balancing/pools/create-pool/#create-a-pool) that will contain the tunnel endpoint </li> </ul> To load balance traffic to a [published application](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/#file-structure-for-published-applications), you will also need to specify the application hostname in the [endpoint host header](/load-balancing/additional-options/override-http-host-headers/).                                                   |


Can we clarify that specifying the application hostname in the endpoint host header has to be done via the UI or LB API, not through cloudflared command?

chungthuang · 2025-10-16T22:34:50Z

.../cloudflare-one/connections/connect-networks/do-more-with-tunnels/migrate-legacy-tunnels.mdx

@nikitacano I think we can deprecate this page? No one should be using legacy tunnels anymore.

chungthuang · 2025-10-16T22:40:01Z

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx

+
+### Optional Cloudflare settings
+
+The application will default to the Cloudflare settings for the load balancer hostname, including [cache rules](/cache/how-to/cache-rules/) and [firewall policies](/firewall/). You can change the settings for your hostname in the [Cloudflare dashboard](https://dash.cloudflare.com/).


change the settings for your hostname
@nikitacano I think this will only be effective if the published application hostname CNAME to the load balancer hostname?

chungthuang · 2025-10-16T22:43:10Z

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx

+
+### One app per load balancer
+
+For this example, assume we have a web application that runs on servers in two different data centers. We want to connect the application to Cloudflare so that users can access the application from anywhere in the world. Additionally, we want Cloudflare to load balance between the servers such that if the primary server fails, the secondary server receives all traffic.


Can we clarify that in the LB pool config, one has to be the fallback pool?

chungthuang · 2025-10-16T22:45:56Z

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx

+
+When an end user sends a request to your application, Cloudflare routes their traffic using [Anycast routing](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) and their request typically goes to the nearest Cloudflare data center. Cloudflare Tunnel will prefer to serve the request using `cloudflared` connections in the same data center. This behavior can impact how connections are weighted and traffic is distributed.
+
+The solution depends on the type of tunnel being used. If running [legacy tunnels](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/migrate-legacy-tunnels/), put your origins in different pools. If running [`cloudflared` replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) (using a shared UUID), switch to separate Cloudflare tunnels as distinct origins.


Legacy tunnel has been deprecated. Using different tunnels is the only way now.

chungthuang · 2025-10-16T22:49:29Z

src/content/docs/load-balancing/private-network/warp-to-tunnel.mdx

+3. Under **Split Tunnels**, check whether your [Split Tunnels mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/#change-split-tunnels-mode) is set to **Exclude** or **Include**.
+4. Select **Manage**. Depending on the mode:
+
+	- **Exclude mode**: Delete the IP range that contains your load balancer IP. For example, if your load balancer has a Cloudflare-assigned CGNAT IP, delete `100.64.0.0/10`. We recommend [adding back the IPs](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/#3-route-private-network-ips-through-warp) that are not being used by your load balancer.


Maybe we can use another private IP range to avoid confusion for CGNAT?

add mermaid diagrams

0f2f392

github-actions bot assigned nikitacano Oct 1, 2025

github-actions bot added size/s October 2025 product:cloudflare-one labels Oct 1, 2025

delete old private load balancing page

34ab9ae

ranbel changed the title ~~[ZT] Load Balancing with cloudflared~~ [ZT] Load Balancing traffic to Cloudflare Tunnel endpoints Oct 1, 2025

ranbel added 12 commits October 2, 2025 15:33

delete partial

209f43d

edit diagrams

15e794e

private load balancer for warp-to-tunnel

0d5b32c

clean up tunnel LB overview page

d4b3bde

move replica how-to instructions

6207f62

begin public load balancer refresh

dfafed5

update diagrams

13c7b46

move cli instructions

e31156a

small clarification

849508e

enhance LB instructions

03f788a

small clarification

c503c9c

explain diagrams

c7711dc

ranbel commented Oct 10, 2025

View reviewed changes

...docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx Outdated Show resolved Hide resolved

ranbel added 2 commits October 10, 2025 17:10

minor edits

ffc0013

fix invalid links

2ff59c9

ranbel marked this pull request as ready for review October 10, 2025 21:44

ranbel requested review from a team, haleycode and securitypedant as code owners October 10, 2025 21:44

ranbel requested review from a team, kodster28 and nikitacano as code owners October 10, 2025 21:44