JA EN
shiichan

Unified Routing now supports IP lists, IDS, and SIP rules!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hey, it's Shii! Today I found a networking update that quietly landed on Cloudflare's Changelog. It might look small, but it's a welcome update if you're running a Cloudflare One environment, so let me walk you through it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, Advanced Network Firewall's IP lists, IDS (intrusion detection system), and SIP rules are now supported for accounts using Unified Routing mode. You'll need a Cloudflare Advanced Network Firewall subscription to use these features.

Cloudflare also said support for Threat Intel Lists, Rate Limiting, and Managed Rulesets is planned for later. So not every feature is there yet, they're filling in the missing pieces bit by bit.

The story so far

Unified Routing is a new data plane that routes many connection types, Cloudflare One Client, Cloudflare Tunnel, IPsec, GRE, and Cloudflare Network Interconnect (CNI), through a single unified system. Previously, Zero Trust routing (Tunnel, Mesh) and WAN routing (IPsec, GRE, CNI) ran as two separate systems, and cross-system traffic didn't consistently apply longest-prefix-match routing.

Unified Routing is still in beta, and Cloudflare is gradually moving traffic onto this unified system. Before this update, Advanced Network Firewall's IP lists, IDS, and SIP rules simply didn't work under Unified Routing mode, so if you needed them, you had to stay on legacy routing.

What changes

Now you can keep using IP lists (which block or allow traffic by IP address), IDS (which detects malicious traffic patterns), and SIP rules (which protect against attacks targeting SIP, a protocol used for VoIP) even after switching to Unified Routing mode. Teams running Cloudflare Network Firewall, Magic Transit, or Cloudflare WAN can now move to Unified Routing without giving up their firewall capabilities.

Dive Deep

The nice thing about Unified Routing is that route selection consistently applies longest-prefix matching across every traffic type and connection method. On top of that, it also brings:

  • Automatic Return Routing (ARR): handles return traffic automatically, no static or dynamic routes needed
  • BGP over IPsec/GRE: enables dynamic route exchange
  • IPv6 support
  • Customizable IP ranges
  • Support for Cloudflare Mesh connectivity over IPsec, GRE, and CNI

That said, it's still beta, so a few limitations remain.

  • Performance is capped at roughly 150 Mbps per onramp
  • Basic packet capture excludes ARR and BGP traffic
  • Advanced Network Firewall's ASN lists, threat intel, and rate limiting are still unsupported (only IP lists, IDS, and SIP rules got support this time)
  • Gateway filtering doesn't work for traffic between IPsec, GRE, and CNI endpoints
  • For private-to-private traffic, Load Balancer doesn't support Cloudflare Source IPs

For the full list of limitations, check Cloudflare's Traffic steering beta limitations doc before you dive into Unified Routing.

Wrap-up

  • Cloudflare Advanced Network Firewall's IP lists, IDS, and SIP rules now work with Unified Routing mode
  • You'll need an Advanced Network Firewall subscription to use them
  • Support for Threat Intel Lists, Rate Limiting, and Managed Rulesets is planned next
  • Unified Routing is still in beta, with limits around performance and firewall features

If you're running your network on Cloudflare One or Magic WAN and thinking about moving to Unified Routing, this is one update you don't want to miss!

Related posts