Set up private IPs with Tunnel

Consider the following steps to learn how to configure Cloudflare local traffic management (LTM) solution, using Cloudflare Tunnel as the off-ramp to securely connect to your private or internal services.

1. Configure a Cloudflare tunnel with an assigned virtual network

The specific configuration steps can vary depending on your infrastructure and services you are looking to connect. If you are not familiar with Cloudflare Tunnel, the pages linked on each step provide more guidance.

1. Create a tunnel.
2. Deploy the tunnel to connect to your data center.
3. Create a virtual network and assign it to the tunnel you configured in the previous steps.

Dashboard

To create a virtual network:

1. Within the Zero Trust dashboard ↗, go to Settings > WARP Client and find the Virtual networks setting.
2. Select Add new or Manage > Create virtual network to create virtual networks.
3. Define your virtual network name and select Save.

To assign the virtual network to the tunnel:

1. Go to Networks > Tunnels.
2. Select the tunnel you created in the previous steps and select Configure.
3. Under Private Network, select Add a private network.
4. Specify an IP range under CIDR and select the virtual network under Additional settings.
5. Select Save private network.

cli

To create a virtual network:

cloudflared tunnel vnet add <VNET_NAME>

To assign the virtual network to the tunnel:

cloudflared tunnel route ip add --vnet <VNET_NAME> <IP_RANGE> <TUNNEL_NAME>

2. Configure Cloudflare Load Balancing

Once you have Cloudflare tunnels with associated virtual networks (VNets) configured, the VNets can be specified for each endpoint when you create or edit a pool. This will enable Cloudflare load balancers to use the correct tunnel and securely reach the private IP endpoints.

The specific configuration will vary depending on your use case. Refer to the following steps to understand the workflow.

1. Create the Load Balancing monitor according to your needs.
2. Create the pool specifying your private IP addresses and corresponding virtual networks.

Note

• Currently, Cloudflare does not support entering the same endpoint IP addresses more than once, even when using different virtual networks.
• All endpoints with private IPs must have virtual_network_id specified.

Dashboard

You can create a pool within the load balancer workflow or in the Pools section of the dashboard:

1. Go to Traffic > Load Balancing.

2. Select Manage Pools and then Create.

3. For your pool, enter the following information:

   • A name (must be unique)
   • A description to provide more detail on the name
   • A choice for Endpoint Steering, which affects how your pool routes traffic to each endpoint

4. For each endpoint, enter the following information:

   • A name (must be unique)
   • The endpoint address or associated hostname
   • (Optional) A Virtual Network. Required when the endpoint has a private IP address.
   • A Weight
   • (Optional) A hostname by clicking Add host header

Note

If your endpoint is a website or application hosted on Cloudflare Pages, you will need to fill in the host header field with the project domain for it to resolve correctly.

5. Repeat this process for additional endpoints in the pool.

6. (Optional) Set up coordinates for Proximity Steering on the pool.

7. On the pool, update the following information:

   • Health Threshold:

     The Health Threshold is the number of healthy endpoints for the pool as a whole to be considered Healthy and receive traffic based on pool order in a load balancer. Increasing this number makes the pool more reliable, but also more likely to become unhealthy.

   • Monitor: Attach a monitor
   • Health Monitor Regions: Choose whether to check pool health from multiple locations, which increases accuracy but can lead to probe traffic to your endpoint
   • Pool Notifications: You can set up new alerts - and view existing alerts - to be notified when pools are enabled or disabled, or pools or endpoints have changes in their health status.

8. When finished, select Save.

API

To get a list of your current virtual networks, use the List virtual networks API operation.

Enable virtual/private IP support by adding the virtual_network_id field to the origins in you API request. Refer to the Cloudflare Load Balancer API documentation for more information on how to create a pool using the API.

Consider the following example for updating an existing Load Balancer pool with a Virtual IP origin using cURL.

Warning

All origins with private IPs must have virtual_network_id specified.

curl --request PATCH \
https://api.cloudflare.com/client/v4/accounts/{account_id}/load_balancers/pools/{pool_id} \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
  "origins": [
    {
      "name": "origin-1",
      "address": "10.0.0.1",
      "enabled": true,
      "weight": 1,
      "virtual_network_id": "a5624d4e-044a-4ff0-b3e1-e2465353d4b4"
    }
  ]
}'

3. Create the load balancer, specifying the pool and monitor you created in the previous steps, as well as the desired global traffic steering policies and custom rules.

Spectrum limitations

If you will use the load balancer with Spectrum, consider the applicable limitations on load balancing and monitoring options.