Load balance private network traffic

Connectors such as Cloudflare Tunnel and Cloudflare Mesh make a private network reachable, but they do not let you control how traffic is spread across servers and sites. To do that, put a private load balancer in front of your private services.

A private load balancer gets an IP address that users reach through Cloudflare One. When a user connects to that IP, Cloudflare picks a healthy endpoint (a private IP address and its virtual network) based on your steering policy, and sends the traffic to it through whichever connector routes that endpoint.

Connector redundancy and load balancing work together. A typical setup has one tunnel or Mesh node per site, with replicas for redundancy, and one load balancer pool per site.

Private load balancers accept traffic from the Cloudflare One Client, Cloudflare WAN, and other on-ramps. They can send traffic to endpoints behind any of these connectors:

• Cloudflare Tunnel: Add the private IPs from your tunnel's CIDR routes as endpoints, with the tunnel's virtual network. Refer to Set up Private Network Load Balancing with Client-to-Tunnel.
• Cloudflare Mesh: Add private IPs from a Mesh node's CIDR routes, or a node's Mesh IP, as endpoints, with the virtual network that contains the node's route. Routes use the default virtual network unless you assign them to another one. The setup is the same as for Client-to-Tunnel, with Mesh routes in place of tunnel routes.
• Cloudflare WAN: Add private IPs reachable through your GRE, IPsec, or CNI connections, with your default virtual network. Refer to Set up Private Network Load Balancing with Cloudflare WAN.

An endpoint is identified by its IP address and virtual network. For Cloudflare Tunnel and Cloudflare Mesh endpoints, Cloudflare sends the traffic through the route that covers that IP address in that virtual network.

Cloudflare Tunnel and Cloudflare Mesh share the same routing table. Within a virtual network, a CIDR can be assigned to only one tunnel or Mesh node, so you cannot add the same CIDR to both a tunnel and a Mesh node. For redundancy on the same route, run cloudflared replicas or Mesh replicas instead of separate connectors.

To reach the same IP address at several sites through Cloudflare Tunnel or Cloudflare Mesh, assign each site's route to its own virtual network, and put each site's endpoints in a separate pool.

Cloudflare WAN uses a separate routing table whose routes are not tied to a virtual network, so a WAN route can cover the same CIDR as a tunnel or Mesh route. A WAN prefix can also have several next hops, with different priorities or as equal-cost routes, so a WAN site can have redundant tunnels on the same prefix. For details, refer to Traffic steering.

You can mix connectors in the same load balancer, with one pool per site or connector. For example, use a site connected with Cloudflare WAN as the primary pool, and a site connected with a Mesh node as the failover pool.

To send each user to the same endpoint, set the pool's endpoint steering to Hash, or set session affinity to ip_cookie with the API. Both key on the Cloudflare One Client device, or on the source IP for other on-ramps.

This pins the endpoint, not the connector replica. For applications that tie a session to the source IP, refer to Source IP seen by your application.

Some applications, such as firewall or appliance admin interfaces, end a session when the client's source IP changes. What the application sees depends on the connector:

• Cloudflare Tunnel: cloudflared opens the connection to your application, so the application sees the IP of the host running cloudflared. Cloudflare sends traffic to the replica closest to the Cloudflare data center handling the request, so with several replicas the same user can arrive from different host IPs.
• Cloudflare Mesh: Only one replica of a Mesh node is active at a time, so traffic arrives through a single host until a failover moves it to the new active replica. For how return traffic reaches the node, refer to Return traffic routing.

If your application needs a stable source IP behind Cloudflare Tunnel, use a single tunnel replica per endpoint, put a proxy in front of the application, or connect that site with a Mesh node instead.

• Endpoints must be IP addresses. Private hostname routes and Mesh hostname routes cannot be used as load balancer endpoints.