---
title: Cloudflare Tunnel for SASE Changelog
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

Cloudflare Tunnel for SASE

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jul 09, 2026
1. ### [Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-09-tunnel-routes-and-connections-api-changes/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
On **October 5, 2026**, two changes take effect across the [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/) and [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/): the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the `connections` field. If you manage private network routes or read tunnel connection details through the API, `cloudflared`, Terraform, or another integration, review the changes in the following sections and migrate before the removal date.  
#### Route endpoints  
The CIDR-encoded route endpoints are deprecated in favor of the standard, `route_id`\-based endpoints that already exist today. Both sets of endpoints route a private network through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) or [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) (the API still refers to Mesh nodes as `warp_connector`) — only the request shape changes.

**Deprecated endpoints (removed October 5, 2026):**

  * Create a tunnel route (CIDR Endpoint): [POST /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/create/)
  * Update a tunnel route (CIDR Endpoint): [PATCH /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/edit/)
  * Delete a tunnel route (CIDR Endpoint): [DELETE /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/delete/)

**Replacement endpoints:**

  * Create a tunnel route: [POST /accounts/{account\_id}/teamnet/routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/create/)
  * Update a tunnel route: [PATCH /accounts/{account\_id}/teamnet/routes/{route\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/edit/)
  * Delete a tunnel route: [DELETE /accounts/{account\_id}/teamnet/routes/{route\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/delete/)  
#### What is changing

|                  | Deprecated (CIDR-encoded path)                                 | Replacement                                                         |
| ---------------- | -------------------------------------------------------------- | ------------------------------------------------------------------- |
| Route identifier | URL-encoded CIDR in the path (/network/{ip\_network\_encoded}) | route\_id in the path (network moves to the request body on create) |
| Create           | POST .../teamnet/routes/network/{ip\_network\_encoded}         | POST .../teamnet/routes with network and tunnel\_id in the body     |
| Update           | PATCH .../teamnet/routes/network/{ip\_network\_encoded}        | PATCH .../teamnet/routes/{route\_id}                                |
| Delete           | DELETE .../teamnet/routes/network/{ip\_network\_encoded}       | DELETE .../teamnet/routes/{route\_id}                               |  
#### Action required

  1. Capture each route's `route_id` by calling [List tunnel routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/list/), or read it from the response the first time you create a route with the replacement endpoint.
  2. Update any scripts, backend services, or CI/CD pipelines that call the CIDR-encoded endpoints directly.
  3. If you manage routes with the `cloudflared tunnel route ip add | delete` commands, upgrade `cloudflared` to the [latest version ↗](https://github.com/cloudflare/cloudflared/releases).
  4. If you manage routes with Terraform, make sure you are on a current version of the [cloudflare\_zero\_trust\_tunnel\_cloudflared\_route ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Ftunnel%5Fcloudflared%5Froute) resource and the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs).  
```bash  
# Before: create a route by URL-encoding the CIDR into the path  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/network/172.16.0.0%2F16 \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'  
# After: create a route with the network in the request body  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"network": "172.16.0.0/16", "tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'  
# After: update or delete a route using its route_id  
curl -X PATCH https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"comment": "Updated comment for this route."}'  
curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
```  
#### Cloudflare Tunnel and Cloudflare Mesh connections  
Starting the same day, the `connections` array is removed from list and get responses for [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes (the `cfd_tunnel` and `warp_connector` API resources). Query the dedicated connections endpoint instead of reading the field off the tunnel or node object.  
This affects:

  * [GET /accounts/{account\_id}/cfd\_tunnel](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/list/) — `connections` removed from each item in `result`
  * [GET /accounts/{account\_id}/cfd\_tunnel/{tunnel\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/get/) — `connections` removed from `result`
  * [GET /accounts/{account\_id}/warp\_connector](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/list/) — `connections` removed from each item in `result`
  * [GET /accounts/{account\_id}/warp\_connector/{tunnel\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/get/) — `connections` removed from `result`  
#### Action required  
Fetch connection details from the tunnel-specific connections endpoint instead of parsing it off the list or get response. For Cloudflare Tunnel, call [GET /accounts/{account\_id}/cfd\_tunnel/{tunnel\_id}/connections](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/subresources/connections/methods/get/). For Cloudflare Mesh, call [GET /accounts/{account\_id}/warp\_connector/{tunnel\_id}/connections](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/subresources/connections/methods/get/).  
```bash  
# Before: read connections off the tunnel object  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
# After: query connections directly  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
```  
Update any dashboards, monitoring scripts, or automation that parses `connections` from the tunnel list or get response. `cloudflared` and the Cloudflare Terraform provider do not read this field, so no changes are required on their side for this part of the update.  
#### Why we are making these changes

  * **Smaller, faster responses.** Cloudflare Tunnel and Cloudflare Mesh nodes with many connections no longer inflate every list and get call — connection detail is only fetched when you need it.
  * **A single way to identify a route.** Consolidating on `route_id` removes the need to URL-encode CIDR ranges into the path and matches how every other resource in the Zero Trust Networks API is addressed.
  * **Consistency across the API.** Both changes align these endpoints with Cloudflare's standard REST conventions for resource identifiers and nested detail endpoints.  
To learn more, refer to the [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/), the [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/), and [Routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/routes/) documentation.

May 27, 2026
1. ### [Cloudflare Tunnel now runs connectivity pre-checks at startup](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudflared-connectivity-prechecks/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting with [cloudflared version 2026.5.2 ↗](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) automates the entire [connectivity pre-checks workflow](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked.  
![cloudflared connectivity pre-checks output](https://edgetunnel-b2h.pages.dev/_astro/cloudflared-connectivity-prechecks.DRwN6tGe_c1XGu.webp)  
On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks:

  * **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs.
  * **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`.
  * **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates.  
Results are printed in a scannable CLI table with three states:

  * ✅ **Pass** — the check succeeded.
  * ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up.
  * ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`).  
If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors.  
Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide.  
To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/).

May 21, 2026
1. ### [Granular permissions for Cloudflare Tunnel and Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-tunnel-mesh-granular-permissions/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.  
#### What is new  
When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes as scopable resource types. You can:

  * Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
  * Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
  * Scope a single policy to one or many Tunnels and Mesh nodes at once.  
#### How it works  
Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

  * **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
  * **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource.
  * **Resource enumeration is authorization-aware.** Listing endpoints (`GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to.  
#### Get started

  * Configure [granular permissions for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/advanced/granular-permissions/).
  * Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/granular-permissions/).
  * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference.

Mar 20, 2026
1. ### [Stream logs from multiple replicas of Cloudflare Tunnel simultaneously](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-20-tunnel-replica-overview-and-multi-log-streaming/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all [replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) of that tunnel and supports streaming logs from multiple replicas at once.  
![View replicas and stream logs from multiple connectors](https://edgetunnel-b2h.pages.dev/_astro/tunnel-multiconn.DEOEaLlu_ZDxArh.webp)  
Previously, you could only stream logs from one replica at a time. With this update:

  * **Replicas on the tunnel overview** — All active replicas for the selected tunnel now appear on that tunnel's overview page under **Connectors**. Select any replica to stream its logs.
  * **Multi-connector log streaming** — Stream logs from multiple replicas simultaneously, making it easier to correlate events across your infrastructure during debugging or incident response. To try it out, log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/) and go to **Networks** \> **Connectors** \> **Cloudflare Tunnels**. Select **View logs** next to the tunnel you want to monitor.  
For more information, refer to [Tunnel log streams](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) and [Deploy replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas/).

Feb 20, 2026
1. ### [Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-20-tunnel-core-dashboard/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
[Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) is now available in the main Cloudflare Dashboard at [Networking > Tunnels ↗](https://dash.cloudflare.com/?to=/:account/tunnels), bringing first-class Tunnel management to developers using Tunnel for securing origin servers.  
![Manage Tunnels in the Core Dashboard](https://edgetunnel-b2h.pages.dev/_astro/tunnel-core-dashboard.BGPqaHfo_Pi6HO.webp)  
This new experience provides everything you need to manage Tunnels for [public applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), including:

  * **Full Tunnel lifecycle management**: Create, configure, delete, and monitor all your Tunnels in one place.
  * **Native integrations**: View Tunnels by name when configuring [DNS records](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/how-to/create-dns-records/) and [Workers VPC](https://edgetunnel-b2h.pages.dev/workers-vpc/) — no more copy-pasting UUIDs.
  * **Real-time visibility**: Monitor [replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) and Tunnel [health status](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/#tunnel-status) directly in the dashboard.
  * **Routing map**: Manage all ingress routes for your Tunnel, including [public applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), [private hostnames](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/), [private CIDRs](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/), and [Workers VPC services](https://edgetunnel-b2h.pages.dev/workers-vpc/), from a single interactive interface.  
#### Choose the right dashboard for your use case

**Core Dashboard**: Navigate to [Networking > Tunnels ↗](https://dash.cloudflare.com/?to=/:account/tunnels) to manage Tunnels for:

  * Securing origin servers and [public applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) with CDN, WAF, Load Balancing, and DDoS protection
  * Connecting [Workers to private services](https://edgetunnel-b2h.pages.dev/workers-vpc/) via Workers VPC

**Cloudflare One Dashboard**: Navigate to [Zero Trust > Networks > Connectors ↗](https://one.dash.cloudflare.com/?to=/:account/networks/connectors) to manage Tunnels for:

  * Securing your public applications with [Zero Trust access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/)
  * Connecting users to [private applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/)
  * Building a [private mesh network](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-networks)  
Both dashboards provide complete Tunnel management capabilities — choose based on your primary workflow.  
#### Get started  
New to Tunnel? Learn how to [get started with Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) or explore advanced use cases like [securing SSH servers](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/) or [running Tunnels in Kubernetes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/).

Jan 15, 2026
1. ### [Verify WARP Connector connectivity with a simple ping](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-15-warp-connector-ping-support/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
We have made it easier to validate connectivity when deploying [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) as part of your [software-defined private network](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-networks).  
You can now `ping` the WARP Connector host directly on its LAN IP address immediately after installation. This provides a fast, familiar way to confirm that the Connector is online and reachable within your network before testing access to downstream services.  
Starting with [version 2025.10.186.0](https://edgetunnel-b2h.pages.dev/changelog/2026-01-13-warp-linux-ga/), WARP Connector responds to traffic addressed to its own LAN IP, giving you immediate visibility into Connector reachability.  
Learn more about deploying [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) and building private network connectivity with [Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/).

Nov 11, 2025
1. ### [cloudflared proxy-dns command will be removed starting February 2, 2026](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-11-cloudflared-proxy-dns/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting February 2, 2026, the `cloudflared proxy-dns` command will be removed from all new `cloudflared` [releases](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/).  
This change is being made to enhance security and address a potential vulnerability in an underlying DNS library. This vulnerability is specific to the `proxy-dns` command and does not affect any other `cloudflared` features, such as the core [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) service.  
The `proxy-dns` command, which runs a client-side [DNS-over-HTTPS (DoH)](https://edgetunnel-b2h.pages.dev/1.1.1.1/encryption/dns-over-https/) proxy, has been an officially undocumented feature for several years. This functionality is fully and securely supported by our actively developed products.  
Versions of `cloudflared` released before this date will not be affected and will continue to operate. However, note that our [official support policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#deprecated-releases) for any `cloudflared` release is one year from its release date.  
#### Migration paths  
We strongly advise users of this undocumented feature to migrate to one of the following officially supported solutions before February 2, 2026, to continue benefiting from secure [DNS-over-HTTPS](https://edgetunnel-b2h.pages.dev/1.1.1.1/encryption/dns-over-https/).  
#### End-user devices  
The preferred method for enabling DNS-over-HTTPS on user devices is the [Cloudflare WARP client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). The WARP client automatically secures and proxies all DNS traffic from your device, integrating it with your organization's [Zero Trust policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) and [posture checks](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/).  
#### Servers, routers, and IoT devices  
For scenarios where installing a client on every device is not possible (such as servers, routers, or IoT devices), we recommend using the [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/).  
Instead of running `cloudflared proxy-dns` on a machine, you can install the WARP Connector on a single Linux host within your private network. This connector will act as a gateway, securely routing all DNS and network traffic from your [entire subnet](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/) to Cloudflare for [filtering and logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/).

Sep 18, 2025
1. ### [Connect and secure any private or public app by hostname, not IP — with hostname routing for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/changelog/post/2025-09-18-tunnel-hostname-routing/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
You can now route private traffic to [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) based on a hostname or domain, moving beyond the limitations of IP-based routing. This new capability is **free for all Cloudflare One customers**.  
Previously, Tunnel routes could only be defined by IP address or [CIDR range](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/). This created a challenge for modern applications with dynamic or ephemeral IP addresses, often forcing administrators to maintain complex and brittle IP lists.  
![Hostname-based routing in Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/_astro/tunnel-hostname-routing.DSi8MP_7_Z1E6Ym4.webp)  

**What’s new:**

  * **Hostname & Domain Routing**: Create routes for individual hostnames (e.g., `payroll.acme.local`) or entire domains (e.g., `*.acme.local`) and direct their traffic to a specific Tunnel.
  * **Simplified Zero Trust Policies**: Build resilient policies in Cloudflare Access and Gateway using stable hostnames, making it dramatically easier to apply per-resource authorization for your private applications.
  * **Precise Egress Control**: Route traffic for public hostnames (e.g., `bank.example.com`) through a specific Tunnel to enforce a dedicated source IP, solving the IP allowlist problem for third-party services.
  * **No More IP Lists**: This feature makes the workaround of maintaining dynamic IP Lists for Tunnel connections obsolete.  
Get started in the Tunnels section of the Zero Trust dashboard with your first [private hostname](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) or [public hostname](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/egress-cloudflared/) route.  
Learn more in our [blog post ↗](https://blog.cloudflare.com/tunnel-hostname-routing/).

Sep 11, 2025
1. ### [DNS filtering for private network onramps](https://edgetunnel-b2h.pages.dev/changelog/post/2025-09-11-dns-filtering-for-private-network-onramps/)  
[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
[Magic WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/zero-trust/cloudflare-gateway/#dns-filtering) and [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#dns-filtering) users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet.  
Routing DNS traffic to the Gateway resolver allows DNS resolution and filtering for traffic coming from private networks while preserving source internal IP visibility. This ensures Magic WAN users have full integration with our Cloudflare One features, including [Internal DNS](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/#internal-dns) and [hostname-based policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/#selector-prerequisites).  
To configure DNS filtering, change your Magic WAN or WARP Connector DNS settings to use Cloudflare's shared resolver IPs, `172.64.36.1` and `172.64.36.2`. Once you configure DNS resolution and filtering, you can use _Source Internal IP_ as a traffic selector in your [resolver policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/) for routing private DNS traffic to your [Internal DNS](https://edgetunnel-b2h.pages.dev/dns/internal-dns/).

Sep 02, 2025
1. ### [Cloudflare Tunnel and Networks API will no longer return deleted resources by default starting December 1, 2025](https://edgetunnel-b2h.pages.dev/changelog/post/2025-09-02-tunnel-networks-list-endpoints-new-default/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting **December 1, 2025**, list endpoints for the [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/) and [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/) will no longer return deleted tunnels, routes, subnets and virtual networks by default. This change makes the API behavior more intuitive by only returning active resources unless otherwise specified.  
No action is required if you already explicitly set `is_deleted=false` or if you only need to list active resources.  
This change affects the following API endpoints:

  * List all tunnels: [GET /accounts/{account\_id}/tunnels](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/methods/list/)
  * List [Cloudflare Tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/): [GET /accounts/{account\_id}/cfd\_tunnel](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/list/)
  * List [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) tunnels: [GET /accounts/{account\_id}/warp\_connector](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/list/)
  * List tunnel routes: [GET /accounts/{account\_id}/teamnet/routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/list/)
  * List subnets: [GET /accounts/{account\_id}/zerotrust/subnets](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/subnets/methods/list/)
  * List virtual networks: [GET /accounts/{account\_id}/teamnet/virtual\_networks](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/virtual%5Fnetworks/methods/list/)  
#### What is changing?  
The default behavior of the `is_deleted` query parameter will be updated.

| Scenario                         | Previous behavior (before December 1, 2025)                                | New behavior (from December 1, 2025)                                  |
| -------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| is\_deleted parameter is omitted | Returns **active & deleted** tunnels, routes, subnets and virtual networks | Returns **only active** tunnels, routes, subnets and virtual networks |  
#### Action required  
If you need to retrieve deleted (or all) resources, please update your API calls to explicitly include the `is_deleted` parameter before **December 1, 2025**.  
To get a list of only deleted resources, you must now explicitly add the `is_deleted=true` query parameter to your request:  
```bash  
# Example: Get ONLY deleted Tunnels  
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/tunnels?is_deleted=true" \
     -H "Authorization: Bearer $API_TOKEN"  
# Example: Get ONLY deleted Virtual Networks  
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/virtual_networks?is_deleted=true" \
     -H "Authorization: Bearer $API_TOKEN"  
```  
Following this change, retrieving a complete list of both active and deleted resources will require two separate API calls: one to get active items (by omitting the parameter or using `is_deleted=false`) and one to get deleted items (`is_deleted=true`).  
#### Why we’re making this change  
This update is based on user feedback and aims to:

  * **Create a more intuitive default:** Aligning with common API design principles where list operations return only active resources by default.
  * **Reduce unexpected results:** Prevents users from accidentally operating on deleted resources that were returned unexpectedly.
  * **Improve performance:** For most users, the default query result will now be smaller and more relevant.  
To learn more, please visit the [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/) and [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/) documentation.

Jul 15, 2025
1. ### [Faster, more reliable UDP traffic for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-15-udp-improvements/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Your real-time applications running over [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) are now faster and more reliable. We've completely re-architected the way `cloudflared` proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel.  
This is a foundational improvement to Cloudflare Tunnel, delivered automatically to all customers. There are no settings to configure — your UDP traffic is already flowing faster and more reliably.

**What’s new:**

  * **Faster UDP performance**: We've significantly reduced the latency for establishing new UDP sessions, making applications like private DNS much more responsive.
  * **Greater reliability for mixed traffic**: UDP packets are no longer affected by heavy TCP traffic, preventing timeouts and connection drops for your real-time services.  
Learn more about running [TCP or UDP applications](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-applications) and [private networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/).

Dec 19, 2024
1. ### [Troubleshoot tunnels with diagnostic logs](https://edgetunnel-b2h.pages.dev/changelog/post/2024-12-19-diagnostic-logs/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
The latest `cloudflared` build [2024.12.2 ↗](https://github.com/cloudflare/cloudflared/releases/tag/2024.12.2) introduces the ability to collect all the diagnostic logs needed to troubleshoot a `cloudflared` instance.  
A diagnostic report collects data from a single instance of `cloudflared` running on the local machine and outputs it to a `cloudflared-diag` file.  
For more information, refer to [Diagnostic logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs/).

Jun 16, 2024
1. ### [Explore product updates for Cloudflare One](https://edgetunnel-b2h.pages.dev/changelog/post/2024-06-16-cloudflare-one/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)[ Browser Isolation ](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/)[ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Digital Experience Monitoring ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/)[ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/)[ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Multi-Cloud Networking ](https://edgetunnel-b2h.pages.dev/multi-cloud-networking/)[ Cloudflare Network Firewall ](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/)[ Network Flow ](https://edgetunnel-b2h.pages.dev/network-flow/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Network Interconnect ](https://edgetunnel-b2h.pages.dev/network-interconnect/)[ Risk Score ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/risk-score/)[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
Welcome to your new home for product updates on [Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/).  
Our [new changelog](https://edgetunnel-b2h.pages.dev/changelog/) lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs.  
If you are looking for older product updates, refer to the following locations.  
Older product updates

  * [Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/access/)
  * [Browser Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/browser-isolation/)
  * [CASB](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/casb/)
  * [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/tunnel/)
  * [Data Loss Prevention](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/dlp/)
  * [Digital Experience Monitoring](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/dex/)
  * [Email security](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/email-security/)
  * [Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/gateway/)
  * [Multi-Cloud Networking](https://edgetunnel-b2h.pages.dev/multi-cloud-networking/changelog/)
  * [Cloudflare Network Firewall](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/changelog/)
  * [Magic Network Monitoring](https://edgetunnel-b2h.pages.dev/network-flow/changelog/)
  * [Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/changelog/)
  * [Magic WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/changelog/)
  * [Network Interconnect](https://edgetunnel-b2h.pages.dev/network-interconnect/changelog/)
  * [Risk score](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/risk-score/)
  * [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/changelog/cloudflare-one-client/)

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product/cloudflare-tunnel-sase/#page","headline":"Cloudflare Tunnel for SASE Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product/cloudflare-tunnel-sase/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```