JA EN
shiichan

Now Your Workers' Outbound Traffic Flows Through Cloudflare Gateway!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#serverless#security

Hey everyone, Shiichan here! Today there is a quiet-but-handy update around Cloudflare Workers networking, so let me walk you through it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog: you can now filter your Workers' outbound Internet traffic (egress) with Cloudflare Gateway policies.

This applies to any Worker that uses a VPC Network binding with network_id: "cf1:network". When that Worker reaches out to a public Internet destination, the traffic now flows through Gateway.

The story so far

Until now, your Zero Trust traffic policies (DNS, HTTP, Network, and egress) applied to devices running WARP, but not to the traffic your Workers themselves send out. So asking "what is this Worker calling, and when?" from the Gateway side, or blocking it there, was harder than it needed to be.

What changes

Now your Workers' traffic gets policies applied the same way WARP users do! Two things come by default:

  • Visibility. Worker egress shows up in your Gateway DNS, HTTP, and Network logs alongside your other traffic, so you can audit what your Workers call and when.
  • Enforcement. Any existing policy whose selectors match a Worker request applies as-is, including allow/block lists, DNS category filtering, and HTTP destination rules. If you already block a category for your workforce, your Workers inherit that block.

Dive Deep

The path looks like this: the Worker calls env.EGRESS.fetch() -> the VPC binding -> Cloudflare Mesh ties it together via cf1:network -> Cloudflare Gateway applies policies -> the public Internet.

Setup is just adding a VPC network binding to your usual wrangler file.

{
  "vpc_networks": [
    {
      "binding": "EGRESS",
      "network_id": "cf1:network",
      "remote": true
    }
  ]
}

Then you fetch from your code as usual, and that traffic becomes subject to your policies and gets logged.

// Egress to a public destination - subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data")

You can review the records from the Gateway logs.

Wrap-up

  • Egress from a Worker with a network_id: "cf1:network" VPC Network binding now routes through Cloudflare Gateway
  • Your existing Zero Trust policies (DNS, HTTP, Network) apply to Workers traffic as-is
  • Worker outbound traffic shows up in Gateway logs, so auditing gets easier
  • Setup is just adding the VPC binding in wrangler and calling env.EGRESS.fetch()

If you run Zero Trust on Cloudflare and also build with Workers, this update makes controlling and seeing your egress a whole lot easier!

Related posts