Cloudflare Docs
Magic WAN
Visit Magic WAN on GitHub
Set theme to dark (⇧+D)

Configure static routes

Magic WAN uses a static configuration to route your traffic through Anycast tunnels from Cloudflare’s global network to your locations.

You must assign a route priority to each tunnel–subnet pair in your configuration, as follows:

  • Lower values have greater priority.
  • When the priority values for prefix entries match — as illustrated by the 10.10.10.102/31 subnet in the example routing configuration (in bold) — Cloudflare uses equal-cost multi-path (ECMP) packet forwarding to route traffic.

For more on how Cloudflare uses ECMP packet forwarding, refer to Traffic steering.

For an example edge routing configuration, refer to the example below.

Edge routing configuration example
TunnelSubnetPriority
TUNNEL_1_IAD10.10.10.102/31100
TUNNEL_2_IAD10.10.10.102/31100
TUNNEL_3_ATL10.10.10.102/31100
TUNNEL_4_ATL10.10.10.102/31100
TUNNEL_1_IAD10.10.10.108/31200
TUNNEL_2_IAD10.10.10.108/31200
TUNNEL_3_ATL10.10.10.108/31100
TUNNEL_4_ATL10.10.10.108/31100

​​ Create a static route

  1. Log in to your Cloudflare dashboard, and select your account.
  2. Select Magic WAN > Manage Magic WAN configuration > Configure.
  1. Select the Static Routes tab > Create to add a new route.
  2. Enter the information for your route.
  3. (Optional) We highly recommend testing your route before adding it by selecting Test routes.
  4. If your test was successful, select Add routes when you are done.

​​ Edit a static route

  1. After navigating to the Static routes tab, select Edit next to the route you want to modify.
  2. (Optional) We highly recommend testing your route before adding it by selecting Test routes.
  3. Enter the updated route information and select Edit routes when you are done.

​​ Delete static route

  1. From Static Routes, locate the static route you want to modify and select Delete.
  2. Confirm the action by selecting the checkbox and select Delete.

​​ Scoped routes for Anycast GRE or IPsec tunnels

To reduce latency for your Anycast GRE or IPsec tunnel configurations, especially if you operate your own Anycast network, Cloudflare can steer your traffic by scoping it to specific Cloudflare data center regions. Equal cost routes maintain an equal cost on a global scale so long as the routes are not scoped to specific regions. For example, if you use region-scoped routes, traffic from end users in New York will always land at their Ashburn network unless that tunnel is unhealthy.

When you scope static routes to specific regions, the routes will only exist in the specified regions, and traffic that lands outside the specified regions will not have anywhere to go.

To configure scoping for your traffic, you must provide Cloudflare with Anycast GRE or IPsec tunnel data for each Cloudflare region.

Scoping configuration data example
TunnelRegion code
TUNNEL_1_IADAFR
TUNNEL_2_IADEEUR
TUNNEL_3_ATLENAM
TUNNEL_4_ATLME

Cloudflare has nine geographic regions across the world which are listed below.

Region codes and associated regions
Region CodeRegion
AFRAfrica
APACAsia Pacific
EEUREastern Europe
ENAMEastern North America
MEMiddle East
OCOceania
SAMSouth America
WEURWestern Europe
WNAMWestern North America