--- title: Workers VPC Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) Workers VPC ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Jun 16, 2026 1. ### [TCP connections via connect() over VPC Networks](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-16-tcp-connect-vpc-networks/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) [VPC Network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) bindings now support the [connect()](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/tcp-sockets/) Socket API for raw TCP connections to private destinations, in addition to HTTP traffic via `fetch()`. This means Workers can now open TCP sockets to any private service reachable through the bound Cloudflare Tunnel, Cloudflare Mesh, or Cloudflare WAN on-ramp — Redis, Memcached, MQTT, custom binary protocols, or any other TCP-based service. * [ wrangler.jsonc ](#tab-panel-3312) * [ wrangler.toml ](#tab-panel-3313) **JSONC** ```jsonc { "$schema": "./node_modules/wrangler/config-schema.json", "vpc_networks": [ { "binding": "PRIVATE_NETWORK", "network_id": "cf1:network", "remote": true } ] } ``` **TOML** ```toml [[vpc_networks]] binding = "PRIVATE_NETWORK" network_id = "cf1:network" remote = true ``` At runtime, use `connect()` on the binding to open a TCP socket to a private destination: **TypeScript** ```ts export default { async fetch(request: Request, env: Env) { // Open a TCP connection to a private Redis instance const socket = await env.PRIVATE_NETWORK.connect("10.0.1.50:6379"); // Write a Redis PING command const writer = socket.writable.getWriter(); await writer.write(new TextEncoder().encode("PING\r\n")); await writer.close(); return new Response(socket.readable); }, }; ``` Note `connect()` over VPC Networks currently supports plaintext TCP only. For more details, refer to [VPC Networks](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) and the [Workers Binding API](https://edgetunnel-b2h.pages.dev/workers-vpc/api/). Jun 05, 2026 1. ### [Filter Workers' public Internet traffic using Gateway policies](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-05-gateway-egress/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) Workers using a [VPC Network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) binding with `network_id: "cf1:network"` now egress to public Internet destinations through [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/). This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today. 1. [Worker](https://edgetunnel-b2h.pages.dev/workers/) Calls `env.EGRESS.fetch()` 2. [VPC binding](https://edgetunnel-b2h.pages.dev/workers-vpc/) ↓ 3. [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) Bind via [cf1:network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) 4. ↓ 5. [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) Policies applied: [ DNS ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/)[ HTTP ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/)[ Network ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) 6. ↓ 7. ↗ Public Internet Any public hostname or IP [ Gateway logs DNS HTTP Network ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) What you get by default: * **Visibility.** Worker egress shows up in Gateway [DNS](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/), [HTTP](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/), and [Network](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) logs alongside your other traffic, so you can audit what your Workers are calling and when. * **Enforcement.** Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block. * [ wrangler.jsonc ](#tab-panel-3314) * [ wrangler.toml ](#tab-panel-3315) **JSONC** ```jsonc { "vpc_networks": [ { "binding": "EGRESS", "network_id": "cf1:network", "remote": true, }, ], } ``` **TOML** ```toml [[vpc_networks]] binding = "EGRESS" network_id = "cf1:network" remote = true ``` * [ JavaScript ](#tab-panel-3316) * [ TypeScript ](#tab-panel-3317) **JavaScript** ```js // Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://api.example.com/data"); ``` **TypeScript** ```ts // Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://api.example.com/data"); ``` For configuration options, refer to [VPC Networks](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/). For policy authoring, refer to [Cloudflare Gateway traffic policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/). May 21, 2026 1. ### [Reach Cloudflare WAN destinations from Workers VPC](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-vpc-networks-cloudflare-wan/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) You can now use [VPC Network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) bindings with `network_id: "cf1:network"` to reach your full private network from Workers, including: * [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes and client devices * Subnet routes and hostname routes announced through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) or Cloudflare Mesh * Destinations connected through [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) on-ramps — GRE, IPsec, and CNI This means a single VPC Network binding can route Worker requests to private services regardless of how those services are connected to Cloudflare: through a Cloudflare Tunnel from a cloud VPC, a Mesh node on a private subnet, or a Cloudflare WAN on-ramp from your data center or branch site. * [ wrangler.jsonc ](#tab-panel-3318) * [ wrangler.toml ](#tab-panel-3319) **JSONC** ```jsonc { "vpc_networks": [ { "binding": "PRIVATE_NETWORK", "network_id": "cf1:network", "remote": true, }, ], } ``` **TOML** ```toml [[vpc_networks]] binding = "PRIVATE_NETWORK" network_id = "cf1:network" remote = true ``` At runtime, the URL you pass to `fetch()` determines the destination: **JavaScript** ```js // Reach a service behind a Cloudflare WAN IPsec on-ramp const response = await env.PRIVATE_NETWORK.fetch("http://10.50.0.100:8080/api"); ``` Note For destinations behind Cloudflare WAN on-ramps (GRE, IPsec, or CNI), your network must route the [Cloudflare source IP range](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-cloudflare-source-ips/) back through the on-ramp so reply traffic returns to Cloudflare. Without this route, stateful flows will fail. This is part of standard Cloudflare WAN onboarding. For configuration options, refer to [VPC Networks](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/). Apr 14, 2026 1. ### [VPC Networks and Cloudflare Mesh support now in public beta](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-14-vpc-networks/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) [VPC Network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) bindings now give your Workers access to any service in your private network without pre-registering individual hosts or ports. This complements existing [VPC Service](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-services/) bindings, which scope each binding to a specific host and port. You can bind to a [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) by `tunnel_id` to reach any service on the network where that tunnel is running, or bind to your [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) network using `cf1:network` to reach any Mesh node, client device, or subnet route in your account: * [ wrangler.jsonc ](#tab-panel-3320) * [ wrangler.toml ](#tab-panel-3321) **JSONC** ```jsonc { "vpc_networks": [ { "binding": "MESH", "network_id": "cf1:network", "remote": true } ] } ``` **TOML** ```toml [[vpc_networks]] binding = "MESH" network_id = "cf1:network" remote = true ``` At runtime, `fetch()` routes through the network to reach the service at the IP and port you specify: **JavaScript** ```js const response = await env.MESH.fetch("http://10.0.1.50:8080/api/data"); ``` For configuration options and examples, refer to [VPC Networks](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) and [Connect Workers to Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/workers-vpc/examples/connect-to-cloudflare-mesh/). Mar 20, 2026 1. ### [Observability for Workers VPC Services](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-20-metrics-and-settings-dashboard/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) Each VPC Service now has a **Metrics** tab so you can monitor connection health and debug failures without leaving the dashboard. ![Workers VPC Metrics dashboard showing connections, latency, and errors charts](https://edgetunnel-b2h.pages.dev/_astro/2026-03-20-metrics-dashboard.6kfnbqQd_1Oc7Ft.webp) * **Connections** — See successful and failed connections over time, broken down by what is responsible: your origin (Bad Upstream), your configuration (Client), or Cloudflare (Internal). * **Latency** — Track connection and DNS resolution latency trends. * **Errors** — Drill into specific error codes grouped by category, with filters to isolate upstream, client, or internal failures. You can also view and edit your VPC Service configuration, host details, and port assignments from the **Settings** tab. For a full list of error codes and what they mean, refer to [Troubleshooting](https://edgetunnel-b2h.pages.dev/workers-vpc/reference/troubleshooting/). Feb 13, 2026 1. ### [Origin CA certificate support for Workers VPC](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-13-origin-ca-certificate-support/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) Workers VPC now supports [Cloudflare Origin CA certificates](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/origin-ca/) when connecting to your private services over HTTPS. Previously, Workers VPC only trusted certificates issued by publicly trusted certificate authorities (for example, Let's Encrypt, DigiCert). With this change, you can use free Cloudflare Origin CA certificates on your origin servers within private networks and connect to them from Workers VPC using the `https` scheme. This is useful for encrypting traffic between the tunnel and your service without needing to provision certificates from a public CA. For more information, refer to [Supported TLS certificates](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-services/#supported-tls-certificates). Nov 05, 2025 1. ### [Announcing Workers VPC Services (Beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-09-25-workers-vpc/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) **Workers VPC Services** is now available, enabling your Workers to securely access resources in your private networks, without having to expose them on the public Internet. #### What's new * **VPC Services**: Create secure connections to internal APIs, databases, and services using familiar Worker binding syntax * **Multi-cloud Support**: Connect to resources in private networks in any external cloud (AWS, Azure, GCP, etc.) or on-premise using Cloudflare Tunnels **JavaScript** ```js export default { async fetch(request, env, ctx) { // Perform application logic in Workers here // Sample call to an internal API running on ECS in AWS using the binding const response = await env.AWS_VPC_ECS_API.fetch("https://internal-host.example.com"); // Additional application logic in Workers return new Response(); }, }; ``` #### Getting started Set up a Cloudflare Tunnel, create a VPC Service, add service bindings to your Worker, and access private resources securely. [Refer to the documentation](https://edgetunnel-b2h.pages.dev/workers-vpc/) to get started. ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product/workers-vpc/#page","headline":"Workers VPC Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product/workers-vpc/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```