Skip to content
Cloudflare API
Start here
API Reference
Magic Transit

GRE Tunnels

resource cloudflare_magic_wan_gre_tunnel

required Expand Collapse
account_id: String

Identifier

cloudflare_gre_endpoint: String

The IP address assigned to the Cloudflare side of the GRE tunnel.

customer_gre_endpoint: String

The IP address assigned to the customer side of the GRE tunnel.

interface_address: String

A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.

name: String

The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.

optional Expand Collapse
bgp?: Attributes
customer_asn: Int64

ASN used on the customer end of the BGP session

extra_prefixes?: List[String]

Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.

md5_key?: String

MD5 key to use for session authentication.

Note that this is not a security measure. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is only supported for preventing misconfiguration, not for defending against malicious attacks.

The MD5 key, if set, must be of non-zero length and consist only of the following types of character:

  • ASCII alphanumerics: [a-zA-Z0-9]
  • Special characters in the set '!@#$%^&*()+[]{}<>/.,;:_-~= |`

In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark ("), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (?). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected.

description?: String

An optional description of the GRE tunnel.

interface_address6?: String

A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127

automatic_return_routing?: Bool

True if automatic stateful return routing should be enabled for a tunnel, false otherwise.

mtu?: Int64

Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.

ttl?: Int64

Time To Live (TTL) in number of hops of the GRE tunnel.

health_check?: Attributes
direction?: String

The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.

enabled?: Bool

Determines whether to run healthchecks for a tunnel.

rate?: String

How frequent the health check is run. The default value is mid.

target?: Attributes

The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to customer_gre_endpoint address. This field is ignored for bidirectional healthchecks as the interface_address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.

effective: String

The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.

saved?: String

The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.

type?: String

The type of healthcheck to run, reply or request. The default value is reply.

computed Expand Collapse
id: String

Identifier

created_on: Time

The date and time the tunnel was created.

modified: Bool
modified_on: Time

The date and time the tunnel was last modified.

bgp_status: Attributes
state: String
tcp_established: Bool
updated_at: Time
bgp_state: String
cf_speaker_ip: String
cf_speaker_port: Int64
customer_speaker_ip: String
customer_speaker_port: Int64
gre_tunnel: Attributes
id: String

Identifier

cloudflare_gre_endpoint: String

The IP address assigned to the Cloudflare side of the GRE tunnel.

customer_gre_endpoint: String

The IP address assigned to the customer side of the GRE tunnel.

interface_address: String

A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.

name: String

The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.

automatic_return_routing: Bool

True if automatic stateful return routing should be enabled for a tunnel, false otherwise.

bgp: Attributes
customer_asn: Int64

ASN used on the customer end of the BGP session

extra_prefixes: List[String]

Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.

md5_key: String

MD5 key to use for session authentication.

Note that this is not a security measure. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is only supported for preventing misconfiguration, not for defending against malicious attacks.

The MD5 key, if set, must be of non-zero length and consist only of the following types of character:

  • ASCII alphanumerics: [a-zA-Z0-9]
  • Special characters in the set '!@#$%^&*()+[]{}<>/.,;:_-~= |`

In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark ("), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (?). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected.

bgp_status: Attributes
state: String
tcp_established: Bool
updated_at: Time
bgp_state: String
cf_speaker_ip: String
cf_speaker_port: Int64
customer_speaker_ip: String
customer_speaker_port: Int64
created_on: Time

The date and time the tunnel was created.

description: String

An optional description of the GRE tunnel.

health_check: Attributes
direction: String

The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.

enabled: Bool

Determines whether to run healthchecks for a tunnel.

rate: String

How frequent the health check is run. The default value is mid.

target: Attributes

The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to customer_gre_endpoint address. This field is ignored for bidirectional healthchecks as the interface_address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.

effective: String

The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.

saved: String

The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.

type: String

The type of healthcheck to run, reply or request. The default value is reply.

interface_address6: String

A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127

modified_on: Time

The date and time the tunnel was last modified.

mtu: Int64

Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.

ttl: Int64

Time To Live (TTL) in number of hops of the GRE tunnel.

modified_gre_tunnel: Attributes
id: String

Identifier

cloudflare_gre_endpoint: String

The IP address assigned to the Cloudflare side of the GRE tunnel.

customer_gre_endpoint: String

The IP address assigned to the customer side of the GRE tunnel.

interface_address: String

A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.

name: String

The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.

automatic_return_routing: Bool

True if automatic stateful return routing should be enabled for a tunnel, false otherwise.

bgp: Attributes
customer_asn: Int64

ASN used on the customer end of the BGP session

extra_prefixes: List[String]

Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.

md5_key: String

MD5 key to use for session authentication.

Note that this is not a security measure. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is only supported for preventing misconfiguration, not for defending against malicious attacks.

The MD5 key, if set, must be of non-zero length and consist only of the following types of character:

  • ASCII alphanumerics: [a-zA-Z0-9]
  • Special characters in the set '!@#$%^&*()+[]{}<>/.,;:_-~= |`

In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark ("), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (?). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected.

bgp_status: Attributes
state: String
tcp_established: Bool
updated_at: Time
bgp_state: String
cf_speaker_ip: String
cf_speaker_port: Int64
customer_speaker_ip: String
customer_speaker_port: Int64
created_on: Time

The date and time the tunnel was created.

description: String

An optional description of the GRE tunnel.

health_check: Attributes
direction: String

The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.

enabled: Bool

Determines whether to run healthchecks for a tunnel.

rate: String

How frequent the health check is run. The default value is mid.

target: Attributes

The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to customer_gre_endpoint address. This field is ignored for bidirectional healthchecks as the interface_address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.

effective: String

The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.

saved: String

The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.

type: String

The type of healthcheck to run, reply or request. The default value is reply.

interface_address6: String

A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127

modified_on: Time

The date and time the tunnel was last modified.

mtu: Int64

Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.

ttl: Int64

Time To Live (TTL) in number of hops of the GRE tunnel.

cloudflare_magic_wan_gre_tunnel

resource "cloudflare_magic_wan_gre_tunnel" "example_magic_wan_gre_tunnel" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  cloudflare_gre_endpoint = "203.0.113.1"
  customer_gre_endpoint = "203.0.113.1"
  interface_address = "192.0.2.0/31"
  name = "GRE_1"
  automatic_return_routing = true
  bgp = {
    customer_asn = 0
    extra_prefixes = ["string"]
    md5_key = "md5_key"
  }
  description = "Tunnel for ISP X"
  health_check = {
    direction = "bidirectional"
    enabled = true
    rate = "low"
    target = {
      saved = "203.0.113.1"
    }
    type = "request"
  }
  interface_address6 = "2606:54c1:7:0:a9fe:12d2:1:200/127"
  mtu = 0
  ttl = 0
}

data cloudflare_magic_wan_gre_tunnel

required Expand Collapse
gre_tunnel_id: String

Identifier

account_id: String

Identifier

computed Expand Collapse
id: String

Identifier

gre_tunnel: Attributes
id: String

Identifier

cloudflare_gre_endpoint: String

The IP address assigned to the Cloudflare side of the GRE tunnel.

customer_gre_endpoint: String

The IP address assigned to the customer side of the GRE tunnel.

interface_address: String

A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.

name: String

The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.

automatic_return_routing: Bool

True if automatic stateful return routing should be enabled for a tunnel, false otherwise.

bgp: Attributes
customer_asn: Int64

ASN used on the customer end of the BGP session

extra_prefixes: List[String]

Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.

md5_key: String

MD5 key to use for session authentication.

Note that this is not a security measure. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is only supported for preventing misconfiguration, not for defending against malicious attacks.

The MD5 key, if set, must be of non-zero length and consist only of the following types of character:

  • ASCII alphanumerics: [a-zA-Z0-9]
  • Special characters in the set '!@#$%^&*()+[]{}<>/.,;:_-~= |`

In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark ("), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (?). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected.

bgp_status: Attributes
state: String
tcp_established: Bool
updated_at: Time
bgp_state: String
cf_speaker_ip: String
cf_speaker_port: Int64
customer_speaker_ip: String
customer_speaker_port: Int64
created_on: Time

The date and time the tunnel was created.

description: String

An optional description of the GRE tunnel.

health_check: Attributes
direction: String

The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.

enabled: Bool

Determines whether to run healthchecks for a tunnel.

rate: String

How frequent the health check is run. The default value is mid.

target: Attributes

The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to customer_gre_endpoint address. This field is ignored for bidirectional healthchecks as the interface_address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.

effective: String

The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.

saved: String

The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.

type: String

The type of healthcheck to run, reply or request. The default value is reply.

interface_address6: String

A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127

modified_on: Time

The date and time the tunnel was last modified.

mtu: Int64

Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.

ttl: Int64

Time To Live (TTL) in number of hops of the GRE tunnel.

cloudflare_magic_wan_gre_tunnel

data "cloudflare_magic_wan_gre_tunnel" "example_magic_wan_gre_tunnel" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  gre_tunnel_id = "023e105f4ecef8ad9ca31a8372d0c353"
}