How Cloudflare Mesh works

Cloudflare Mesh is a private network for services and devices in your Cloudflare account. It gives each enrolled participant a private address and carries traffic between participants through Cloudflare.

Participants can be Linux servers, laptops, phones, or desktops. They communicate over TCP, UDP, or Internet Control Message Protocol (ICMP) without public IP addresses or services exposed to the public Internet. Host firewalls on each participant still control which Mesh traffic it accepts.

Connect each participant to Cloudflare with the same client.

Every participant runs the Cloudflare One Client, which keeps an encrypted connection to Cloudflare open for Mesh traffic. A Mesh node runs the client in headless mode on a Linux server, virtual machine, or container. A client device runs the same software with a user interface on a laptop, phone, or desktop.

Cloudflare assigns each participant a Mesh IP from 100.96.0.0/12, a carrier-grade NAT range ↗︎ that avoids common private ranges such as 10.0.0.0/8. Other Cloudflare One documentation calls these device IPs, and you can configure a custom subnet if the default conflicts with your network.

Any participant can start traffic to another participant's Mesh IP, so device-to-device, device-to-server, and server-to-server connections all work. Client-to-client connectivity does not require a Mesh node.

All traffic passes through Cloudflare, so Gateway network policies, device posture checks, and identity controls can govern each connection. Connectivity and access are separate: a participant can be online while policy blocks its traffic.

For setup instructions, refer to Get started.

Reach resources that cannot run the Cloudflare One Client.

A Mesh node is directly reachable through its own Mesh IP. A route makes resources behind that node reachable as well.

• CIDR routes send traffic for an IPv4 or IPv6 range through a node.
• Hostname routes send traffic for a private or public hostname through a node.

Return traffic must also route through the Mesh node. For more information, refer to Routes.

Keep routed networks available when a node host fails.

A Mesh node has a stable identity in your Cloudflare account. Multiple Linux hosts can register as replicas of that node and advertise the same routes. One replica is active while the others stay on standby. If the active replica disconnects, Cloudflare promotes a standby for traffic to the advertised CIDR routes.

High availability protects routed prefixes, not direct access to a replica's Mesh IP. For more information, refer to High availability.

Mesh uses the MASQUE protocol by default. Hostname routes, IPv6 CIDR routes, and high availability require MASQUE. If a Mesh node device profile uses WireGuard, only direct participant connectivity and IPv4 CIDR routes work.

Mesh and Cloudflare Tunnel both connect private infrastructure to Cloudflare. They use different connection models:

Use Mesh when participants need private IP connectivity in either direction, including long-lived connections such as database replication and remote administration. Use Tunnel to publish specific applications or route clients to resources behind an outbound-only connector.

Choose the participant or network you want to connect.

• Run Mesh in containers: deploy a node with Docker or Kubernetes.
• Tips and best practices: plan routes, updates, and cloud deployments.
• Reserved IP addresses: review ranges reserved by Cloudflare One.