Workers Straight into Your Private Network! VPC Network Bindings Hit Public Beta!

Hey everyone, it's Shii-chan! Today's news gets Workers a lot closer to your own private network. So exciting!

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, Workers VPC announced that VPC Network bindings are now in public beta. With them, your Workers can reach any service in your private network without pre-registering individual hosts or ports.

The story so far

Up to now there were VPC Service bindings, which scope each binding to a specific host and port. That meant registering a new one every time you added a destination. VPC Network bindings instead attach to a whole network, so that setup work shrinks.

What changes

There are two ways to bind:

• Bind to a Cloudflare Tunnel by tunnel_id to reach any service on the network where that tunnel is running
• Bind to your Cloudflare Mesh network with cf1:network to reach any Mesh node, client device, or subnet route in your account

So instead of registering every "this IP, this port" up front, you connect at the network level and then reach whatever destination you want at runtime.

Dive Deep

You configure it in your wrangler config file. Connecting to Mesh looks like this:

{
  "vpc_networks": [
    {
      "binding": "MESH",
      "network_id": "cf1:network",
      "remote": true
    }
  ]
}

Then at runtime, fetch() routes through the network to the IP and port you specify:

const response = await env.MESH.fetch("http://10.0.1.50:8080/api/data");

For more configuration options and examples, check out VPC Networks and Connect Workers to Cloudflare Mesh.

Wrap-up

• Workers VPC's VPC Network bindings are now in public beta
• Connect a Worker to a whole network without registering hosts and ports one by one
• Bind via tunnel_id for Cloudflare Tunnel, or cf1:network for Cloudflare Mesh
• At runtime, fetch() routes to any IP and port you pick

This is a great fit if you want your Workers to reach internal APIs or databases!