Workers VPC now speaks raw TCP through connect()!

Hey everyone, it's Shiichan! Today I found a cheerful update that opens up one more path from your Workers to your private servers.

Cloudflare Changelog developers.cloudflare.com

What was announced?

This one comes from Cloudflare's Changelog. Workers VPC network bindings now support raw TCP connections through the connect() Socket API! On top of the existing HTTP traffic via fetch(), you can now open TCP sockets too.

What can you reach? Private services that are accessible through a Cloudflare Tunnel, Cloudflare Mesh, or Cloudflare WAN on-ramp. Think Redis, Memcached, MQTT, custom binary protocols — anything that speaks plain TCP.

The story so far

Until now, VPC Network bindings were centered on HTTP via fetch(). That was great for services that talk HTTP, but services like Redis and Memcached that speak raw TCP were a bit harder to reach directly.

What changes

From your Workers, you can now open a socket straight to a TCP service sitting deep inside your private network! Send a PING to Redis, hit Memcached, subscribe over MQTT — things that used to need an extra relay in the middle can now be written with a single binding. If you want to use your own private DB or message queue from Workers, this is a lovely step forward.

Dive Deep

Setup is nice and simple. You just add a VPC Network binding to wrangler.jsonc.

{
  "vpc_networks": [
    {
      "binding": "PRIVATE_NETWORK",
      "network_id": "cf1:network",
      "remote": true
    }
  ]
}

Then at runtime you call connect() on the binding. Here's an example that connects to a private Redis and sends a PING.

const socket = await env.PRIVATE_NETWORK.connect("10.0.1.50:6379");

const writer = socket.writable.getWriter();
await writer.write(new TextEncoder().encode("PING\r\n"));
await writer.close();

One thing to note: for now, connect() over VPC Networks supports plaintext TCP only — no TLS yet. If you want more detail, check out VPC Networks and the Workers Binding API.

Wrap-up

• Workers VPC network bindings now support TCP connections via connect()
• You can open TCP sockets to private Redis, Memcached, MQTT, and more over Cloudflare Tunnel, Mesh, or WAN
• Setup is just a binding in wrangler.jsonc; at runtime you call connect()
• Plaintext TCP only for now (no TLS yet)

If you're on the backend side and want to use private-network TCP services straight from Workers, this update is a perfect fit for you!