BGP route filtering is here for IPsec and GRE tunnels!
Hi, it's Shii-chan! Here's some good news for networking fans.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog says Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering.
Why it matters
Being able to control which routes you accept and which you advertise over BGP keeps unintended paths out. Narrowing routes per tunnel is a big deal in network operations.
What changes
You can create reusable filter profiles and assign them to tunnels.
Dive Deep
A filter profile specifies:
- An action: allow or deny
- A list of CIDR targets
- A matching mode: exact, more-specific, or prefix-length
Limits and usage:
- Each tunnel supports one import filter and one export filter
- Create and assign profiles through the dashboard, API, or Terraform
- Profile changes apply without resetting the BGP session
For configuration details, see the "Filter BGP routes" docs for Cloudflare WAN and for Magic Transit.
Wrap-up
- BGP import/export filtering on IPsec and GRE tunnels
- Reusable filter profiles (allow/deny plus CIDRs)
- One import and one export filter per tunnel
- Dashboard, API, and Terraform support, with no session reset on changes
Perfect if you want fine-grained route control on Cloudflare WAN or Magic Transit!
