Cloudflare Mesh can now route by hostname!

Hey everyone, it's me, Shii-chan! Today I found a small but genuinely handy networking update.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare Mesh nodes can now be given hostname routes in addition to CIDR routes, so you can route to your Cloudflare Mesh nodes by name. This came from Cloudflare's Changelog. It means you can reach resources on your Cloudflare One private network by hostname instead of IP!

The story so far

Until now, to attract traffic to a Mesh node you had to manage IP ranges (CIDR) like 10.0.0.0/16 yourself. That got painful when an internal app's IP was unknown or ephemeral.

What changes

Now you can attract traffic by hostname instead of IP. There are two patterns:

• Private hostname (for example, wiki.internal.local): reach an internal app by name even when its IP is unknown or changing. On Mesh you don't even need to run a DNS server — a hosts-file entry on the node is enough, or you can use a Gateway resolver policy for split DNS.
• Public hostname (for example, www.example.com): route that hostname's traffic through the node and egress via the node's public IP.

Dive Deep

The flow is neat: when a client device requests wiki.internal.local, Cloudflare Gateway answers the DNS query with a token IP (100.80.0.0/16) and rewrites the destination to the real private IP. The hostname route then steers that traffic to the Mesh node, which forwards it to the host on the local network (like 10.0.0.50).

For setup steps, prerequisites, and DNS options, see the Hostname routes docs.

Wrap-up

• Cloudflare Mesh gains hostname routes — route by name, not just CIDR
• Works for both private and public hostnames, no manual IP-range wrangling
• Private hostnames need no DNS server (a hosts file or Gateway resolver is enough)
• Under the hood, Gateway returns a token IP and rewrites it to the real IP

If you run Cloudflare One / Zero Trust and you're tired of babysitting IP ranges for internal apps, this one's for you!