Breakout traffic

Breakout traffic allows you to define which applications should bypass Cloudflare's security filtering, and go directly to the Internet. It works via DNS requests inspection. This means that if your network is caching DNS requests, Breakout traffic will only take effect after you cache entries expire and your client issues a new DNS request that the Magic WAN Connector can detect. This can take several minutes.

Warning

Breakout traffic will not work for applications that use DNS-over-HTTPS.

		flowchart LR
		accTitle: In this example, the applications go directly to the Internet, skipping Cloudflare's security. filtering
		a(Magic WAN Connector) --> b(Cloudflare) -->|Filtered traffic|c(Internet)

		a-- Breakout traffic ---d(Application1) & e(Application2) --> c

		classDef orange fill:#f48120,color: black
		class a,b orange
		

In the graph above, Applications 1 and 2 are configured to bypass Cloudflare's security filtering, and go straight to the Internet

Note

We recommend routing all traffic through our global network for comprehensive security filtering and access controls. However, there may be specific cases where you want a subset of traffic to bypass Cloudflare's security filtering and route it directly to the Internet. You can scope this breakout traffic to specific applications from the Cloudflare dashboard.

Refer to Traffic steering to learn how Cloudflare routes traffic.

Add an application

You need to configure Breakout traffic for each of your existing sites, as it is a per-site configuration.

Dashboard

1. Log in to the Cloudflare dashboard ↗, and select your account.
2. Select Magic WAN > Connector on-ramps (beta).
3. Select the Connector you want to configure > Edit.
4. Select Traffic Steering.
5. In Breakout traffic, select Add.
6. Select one or more applications that should bypass Cloudflare filtering from the list. You can also use the search box.
7. Select Add applications.

The traffic for the application you chose will now go directly to the Internet and bypass Cloudflare's filtering.

API

Note

You will need your account ID and API Key to use the API.

1. Send a GET request to list the applications associated with an account.

   Required API token permissions

   At least one of the following token permissions is required:

   • Magic WAN Write
   • Magic WAN Read
   • Magic Transit Prefix Read
   • Magic Transit Prefix Write

   List Apps

   curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/apps \
     --request GET \
     --header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
     --header "X-Auth-Key: $CLOUDFLARE_API_KEY"

     {
       "result": [
         {
           "managed_app_id": "<APP_ID>",
           "name": "<APP_NAME>",
           "type": "File Sharing",
           "hostnames": [
             "<app_name.com>",
             "<app-name.info>"
           ]
         }
       ]
     }

   Take note of the "managed_app_id" value for any application you want to add.

2. Send a POST request to add new apps to the breakout traffic policy.

   Required API token permissions

   At least one of the following token permissions is required:

   • Magic WAN Write
   • Magic Transit Prefix Write

   Create a new App

   curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/apps \
     --request POST \
     --header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
     --header "X-Auth-Key: $CLOUDFLARE_API_KEY" \
     --json '{
       "name": "<MANAGED_APP_ID>",
       "type": "<BREAKOUT_OR_PRIORITY>"
     }'

   {
     "result": {
       "account_app_id": "<APP_ID>",
       "name": "<APP_NAME>",
       "type": "<BREAKOUT_OR_PRIORITY>"
     },
     "success": true,
     "errors": [],
     "messages": []
   }

Delete an application

Dashboard

1. Log in to the Cloudflare dashboard ↗, and select your account.
2. Select Magic WAN > Connector on-ramps (beta).
3. Select the Connector you want to configure > Edit.
4. Select Traffic Steering.
5. In Breakout traffic, find the application you want to delete, and select the three dots next to it.
6. Select Remove.
7. (Optional) If you have several pages of applications, you can use the search box to quickly find the application you are looking for.

API

Note

You will need your account ID and API Key to use the API.

1. Send a GET request to list the applications associated with a site.

   Required API token permissions

   At least one of the following token permissions is required:

   • Magic WAN Write
   • Magic WAN Read
   • Magic Transit Prefix Read
   • Magic Transit Prefix Write

   List Apps

   curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/apps \
     --request GET \
     --header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
     --header "X-Auth-Key: $CLOUDFLARE_API_KEY"

     {
       "result": [
         {
           "managed_app_id": "<APP_ID>",
           "name": "<APP_NAME>",
           "type": "File Sharing",
           "hostnames": [
             "<app_name.com>",
             "<app-name.info>"
           ]
         }
       ]
     }

   Take note of the "account_app_id" value for the application that want to delete.

2. Send a DELETE request to delete an application from the breakout traffic policy.

   Required API token permissions

   At least one of the following token permissions is required:

   • Magic WAN Write
   • Magic Transit Prefix Write

   Delete Account App

   curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/magic/apps/$ACCOUNT_APP_ID \
     --request DELETE \
     --header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
     --header "X-Auth-Key: $CLOUDFLARE_API_KEY"

   {
     "result": {
       "account_app_id": "<APP_ID>",
       "name": "<APP_NAME>",
       "type": "<BREAKOUT_OR_PRIORITY>"
     },
     "success": true,
     "errors": [],
     "messages": []
   }

WARP traffic

If you have Magic WAN Connector and WARP clients deployed in your premises, Magic WAN Connector automatically routes WARP traffic to the Internet rather than Magic WAN IPsec tunnels. This prevents traffic from being encapsulated twice.

You may need to configure your firewall to allow this new traffic. Make sure to allow the following IPs and ports:

• Destination IPs: 162.159.193.0/24, 162.159.197.0/24
• Destination ports: 443, 500, 1701, 2408, 4443, 4500, 8095, 844 Refer to WARP with firewall for more information on this topic.