Cloudflare Tunnel, Cloudflare Tunnel for SASE, Cloudflare Mesh, Gateway, Cloudflare One - Hostname routing is now generally available, with a new public IP range for initial resolved IPs

<p><a href="https://blog.cloudflare.com/tunnel-hostname-routing/" target="_blank" rel="noopener">Hostname routing<span class="external-link"> ↗︎</span></a> is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors:</p> <ul> <li><strong>Cloudflare Tunnel</strong>: route a <a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/">private hostname</a> (for example, <code>wiki.internal.local</code>) to a private application behind your tunnel, or a <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/">public hostname</a> (for example, <code>bank.example.com</code>) to egress through a specific tunnel and anchor traffic to a dedicated exit node.</li> <li><strong>Cloudflare Mesh</strong>: attract a <a href="https://developers.cloudflare.com/mesh/features/routes/#hostname-routes">private or public hostname's traffic</a> to a Mesh node.</li> </ul> <p>Alongside GA, the default IPv4 range used for <!-- prettier-ignore --><span id="initial resolved IP" data-tooltip data-content="<p>A unique, ephemeral IP address that Gateway assigns to DNS queries when filtering network traffic by hostname. The IP is randomly selected from an IPv4 range (<code>172.64.128.0/20</code> by default, configurable per account) or an IPv6 range (<code>2606:4700:0cf1:4000::/64</code>, not configurable).</p> " class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>initial resolved IPs</span><script type="module" src="https://developers.cloudflare.com/home/runner/work/cloudflare-docs/cloudflare-docs/src/components/cf/GlossaryTooltip.astro?astro&type=script&index=0&lang.ts"></script> (also called token IPs) is changing from a Carrier-Grade NAT (CGNAT) range to a public Cloudflare-owned range:</p> <ul> <li><strong>IPv4</strong>: <code>172.64.128.0/20</code></li> <li><strong>IPv6</strong>: <code>2606:4700:0cf1:4000::/64</code></li> </ul> <p>This is the default range. You can <a href="https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/">configure a custom initial resolved IP range</a> for IPv4 if it conflicts with your existing network.</p> <p><strong>Why this is changing:</strong> Starting with <a href="https://developer.chrome.com/release-notes/142" target="_blank" rel="noopener">Chrome 142<span class="external-link"> ↗︎</span></a>, Local Network Access (LNA) restrictions block background requests to CGNAT addresses (<code>100.64.0.0/10</code>), which included the previous initial resolved IP default (<code>100.80.0.0/16</code>). LNA is implemented at the Chromium engine level, so it affects all Chromium-based browsers (for example, Microsoft Edge, Brave, and Opera), not only Google Chrome. This could silently break hostname-based Gateway features for users of these browsers, and required Chrome Enterprise policy workarounds. The new default range is public Cloudflare address space, so it is not affected by this restriction.</p> <p><strong>What is affected:</strong> Initial resolved IPs are used by several features that associate a DNS query with the network connection that follows it:</p> <ul> <li><a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/">Private</a> and <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/">public</a> hostname routing for Cloudflare Tunnel</li> <li><a href="https://developers.cloudflare.com/mesh/features/routes/#hostname-routes">Hostname routes</a> for Cloudflare Mesh</li> <li><a href="https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/">Access private applications</a> on non-HTTPS ports</li> <li><a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/host-selectors/">Egress policy host selectors</a> (Domain, Host, Application, and Content Categories)</li> </ul> <p>You can check your account's current range, or configure a custom range, at any time from <strong>Networking</strong> &gt; <strong>IP addresses</strong> &gt; <strong>Address space</strong> &gt; <strong>Custom IPs</strong>, or using the <a href="https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/subnets/#(resource)%20zero_trust.networks.subnets.initial_resolved_ip">Initial Resolved IP Subnet API</a>.</p> <a href="https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space/custom-ips" data-nb-button class="group inline-flex w-max shrink-0 items-center justify-center rounded-full font-medium whitespace-nowrap no-underline shadow-xs transition-colors cursor-pointer select-none focus-visible:outline-2 focus-visible:outline-ring focus-visible:outline-offset-2 disabled:cursor-not-allowed disabled:opacity-50 bg-primary text-primary-foreground hover:bg-primary-hover h-9 gap-1.5 px-3 text-sm" target="_blank"> Go to <strong>Custom IPs</strong>&nbsp;&#8599; </a> <p>For full instructions, refer to <a href="https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/">Configure initial resolved IPs</a>. The IPv6 range (<code>2606:4700:0cf1:4000::/64</code>) is unchanged and is not affected by this restriction.</p> <p>The default IPv4 range, and all Cloudflare One IPv6 ranges, are automatically routed through the Cloudflare One Client and do not require any Split Tunnel configuration. Refer to <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges">Automatically managed ranges</a> for details.</p> <p>If you were relying on a Chrome Enterprise policy workaround (such as <code>LocalNetworkAccessRestrictionsTemporaryOptOut</code>) while your account was still on the legacy CGNAT-based range, refer to <a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#google-chrome-restricts-access-to-private-hostnames">Google Chrome restricts access to private hostnames</a> for next steps.</p>