Cloudflare One Appliance Can Now Break Out Traffic by Source!

Hi there, it's me, Shiichan! Today I found a networking update that looks quiet but quietly makes life easier, so let me share it with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on the Cloudflare Changelog, they announced that Cloudflare One Appliance can now match breakout (local egress) and traffic prioritization rules by source too. Until now these rules keyed off the destination application, but from here on you can build rules based on "where the traffic came from," not only "where it's headed."

The story so far

Breakout and prioritization rules were basically written around the destination application. So even when you just wanted to send all traffic from a given VLAN straight out locally, you had to enumerate destinations one by one.

What changes

When you want to break a guest VLAN out to the local Internet, or prioritize traffic from a specific subnet, you no longer have to list out destination applications one at a time. Here is how the announcement puts it.

the natural way to break out a guest VLAN to the local Internet, or to prioritize traffic from a specific subnet, without enumerating destination applications.

Dive Deep

There are two kinds of source you can pin a rule to.

• Source LAN interface: the VLANs connected to that interface are automatically included
• Source IP specification: individual addresses, IP ranges, or CIDR blocks for finer control

The configuration details are gathered in the Breakout traffic docs.

Wrap-up

• Cloudflare One Appliance breakout and prioritization rules can now match on source, not just destination
• The source can be a "LAN interface" or an "IP/range/CIDR"
• Splitting off a guest VLAN or prioritizing a specific subnet no longer needs a list of destination apps
• A practical, hands-on update for anyone running their branch network on Cloudflare One Appliance