Virtual networks

Feature availability

Client modes	Zero Trust plans ↗
Traffic and DNS mode Traffic only mode	All plans

System	Availability
Windows	✅
macOS	✅
Linux	✅
iOS	✅
Android	✅
ChromeOS	✅

Virtual networks provide routing isolation within your Cloudflare account. Each virtual network maintains its own routing table, allowing you to separate traffic between different environments, partners, or applications.

For example, an organization may have separate "production" and "staging" VPC networks that both use the same private IP range (such as 10.128.0.0/24). Without virtual networks, Cloudflare cannot distinguish between 10.128.0.1 in production and 10.128.0.1 in staging. By creating two virtual networks, you can deterministically route traffic to the correct environment. Users select which virtual network they want to connect to in the Cloudflare One Client.

For a conceptual overview of virtual networks, including how they work across Cloudflare products, refer to Virtual networks.

Use cases

Here are a few scenarios where virtual networks may prove useful:

Manage production and staging environments that use the same address space.
Manage acquisitions or mergers between organizations that use the same address space.
Allow IT professional services to access their customer's network for various administration and management purposes.
Allow developers or homelab users to deterministically route traffic through their home network to enforce additional security controls.
Guarantee additional segmentation (beyond just policy enforcement) between networks and resources for security reasons, while keeping all configuration within a single Cloudflare account.

Prerequisites

Install cloudflared on each private network.
Deploy the Cloudflare One Client on user devices.

Create a virtual network

In this example, "private network" refers to a distinct environment (such as staging or production) that has its own overlapping IP address space (10.128.0.1/32 staging and 10.128.0.1/32 production). If your environments use non-overlapping IPs, you do not need a separate tunnel for each. Instead, you can add multiple routes to a single tunnel.

To route overlapping IPs over virtual networks:

Create two unique virtual networks:
1. In the Cloudflare dashboard, go to Networking > Routes > Virtual networks.
  Go to Virtual networks ↗
2. Select Create virtual network.
3. Name your virtual network staging-vnet and select Save.
4. Repeat Steps 1a-1d to create another virtual network called production-vnet.
Create a Cloudflare Tunnel for each private network with overlapping IPs (one tunnel per isolated environment, for example staging and production):
1. Go to Networking > Tunnels.
2. Select Create a tunnel.
3. Name your tunnel Staging tunnel and select Create.
4. Install the connector within your staging environment.
5. Go to Networking > Routes.
  Go to Routes ↗
6. Select Create route > Tunnel CIDR.
7. Select Staging tunnel, enter 10.128.0.1/32 as the network, and select staging-vnet as the virtual network. Select Create route.
8. Repeat Steps 2a-2d to create another tunnel called Production tunnel. Be sure to install the connector within your production environment.
9. Repeat Steps 2e-2g to create a route for Production tunnel with 10.128.0.1/32 assigned to production-vnet.

We now have two overlapping IP addresses routed over staging-vnet and production-vnet respectively. You can use the Cloudflare One Client to switch between virtual networks.

To route overlapping IPs over virtual networks:

Add the following permission to your cloudflare_api_token ↗:
- Cloudflare Tunnel Write

Create two unique virtual networks:

resource "cloudflare_zero_trust_tunnel_cloudflared_virtual_network" "staging_vnet" {
	account_id = var.cloudflare_account_id
	name       = "staging-vnet"
	comment    = "Staging virtual network"
	is_default = false
}

resource "cloudflare_zero_trust_tunnel_cloudflared_virtual_network" "production_vnet" {
	account_id = var.cloudflare_account_id
	name       = "production-vnet"
	comment    = "Production virtual network"
	is_default = false
}

Create a Cloudflare Tunnel for each private network with overlapping IPs (one tunnel per isolated environment, for example staging and production):

resource "cloudflare_zero_trust_tunnel_cloudflared" "staging_tunnel" {
	account_id = var.cloudflare_account_id
	name       = "Staging tunnel"
	config_src = "cloudflare"
}

resource "cloudflare_zero_trust_tunnel_cloudflared" "production_tunnel" {
	account_id = var.cloudflare_account_id
	name       = "Production tunnel"
	config_src = "cloudflare"
}

Route 10.128.0.1/32 through Staging tunnel and assign it to staging-vnet. Route 10.128.0.1/32 through Production tunnel and assign it to production-vnet.

resource "cloudflare_zero_trust_tunnel_cloudflared_route" "staging_tunnel_route" {
	account_id         = var.cloudflare_account_id
	tunnel_id          = cloudflare_zero_trust_tunnel_cloudflared.staging_tunnel.id
	network            = "10.128.0.1/32"
	comment            = "Staging tunnel route"
	virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.staging_vnet.id
}

resource "cloudflare_zero_trust_tunnel_cloudflared_route" "production_tunnel_route" {
	account_id         = var.cloudflare_account_id
	tunnel_id          = cloudflare_zero_trust_tunnel_cloudflared.production_tunnel.id
	network            = "10.128.0.1/32"
	comment            = "Production tunnel route"
	virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.production_vnet.id
}

Get the token for each tunnel.
Using the tunnel tokens, run Staging tunnel in your staging environment and run Production tunnel in your production environment. Refer to Install and run the tunnel.

To route overlapping IPs over virtual networks for locally-managed tunnels:

Create a Cloudflare Tunnel for each private network with overlapping IPs (one tunnel per isolated environment, for example staging and production):
1. Within your staging environment, authenticate cloudflared:
```
cloudflared login
```
2. Create a tunnel to connect your staging network to Cloudflare.
```
cloudflared tunnel create staging-tunnel
```
3. Within your production environment, authenticate cloudflared:
```
cloudflared login
```
4. Create a tunnel to connect your production network to Cloudflare.
```
cloudflared tunnel create production-tunnel
```

The following steps may be executed from any cloudflared instance.

Create two unique virtual networks.

cloudflared tunnel vnet add staging-vnet
cloudflared tunnel vnet add production-vnet

Before moving on, run the following command to verify that your newly created virtual networks are listed correctly:
```
cloudflared tunnel vnet list
```

Configure your tunnels with the IP/CIDR range of your private networks, and assign the tunnels to their respective virtual networks.

cloudflared tunnel route ip add --vnet staging-vnet 10.128.0.3/32 staging-tunnel
cloudflared tunnel route ip add --vnet production-vnet 10.128.0.3/32 production-tunnel

Verify that the IP routes are listed correctly:
```
cloudflared tunnel route ip list
```
We now have two overlapping IP addresses routed over staging-vnet and production-vnet respectively.
1. Within your staging environment, create a configuration file for staging-tunnel. The configuration file will be structured as follows:
```
tunnel: <Tunnel-UUID>
credentials-file: /root/.cloudflared/credentials-file.json
warp-routing:
   enabled: true
```
2. Run your tunnel.
```
cloudflared tunnel run staging-tunnel
```
3. Within your production environment, repeat Steps 6 and 7 for production-tunnel.
You can use now the Cloudflare One Client to switch between virtual networks.

Delete a virtual network

To delete a virtual network:

In the Cloudflare dashboard, go to Networking > Routes.
Go to Routes ↗
On the Routes tab, check that no routes are assigned to the virtual network you are trying to delete. If the virtual network is in use, delete those routes or reassign them to a different virtual network first.
Go to the Virtual networks tab and find your virtual network.
Select the three-dot menu and choose Delete.

You can optionally delete the tunnel associated with your virtual network.

To delete a virtual network for locally-managed tunnels:

Delete all IP routes in the virtual network. For example,

cloudflared tunnel route ip delete --vnet staging-vnet 10.128.0.3/32

(Optional) Delete the tunnel associated with the virtual network.
```
cloudflared tunnel delete staging-tunnel
```

Delete the virtual network.

cloudflared tunnel vnet delete staging-vnet

You can verify that the virtual network was successfully deleted by typing cloudflared tunnel vnet list.

Connect to a virtual network

Windows, macOS, and Linux

Open the Cloudflare One Client.
Go to Home.
In the VNET dropdown, choose the virtual network you want to connect to (for example, staging-vnet).

Open the Cloudflare One Client.
Go to Settings > Traffic and DNS mode > Virtual Networks.
Choose the virtual network you want to connect to, for example staging-vnet.

When you visit 10.128.0.3/32, the Cloudflare One Client will route your request to the staging environment.

iOS, Android, and ChromeOS

Launch the Cloudflare One Agent app.
Go to Advanced > Connection options > Virtual networks.
Choose the virtual network you want to connect to, for example staging-vnet.

When you visit 10.128.0.3/32, the Cloudflare One Client will route your request to the staging environment.