Reserved IP addresses

Cloudflare reserves several IPv4 and IPv6 ranges for internal routing and service functionality. Most of these ranges are drawn from the CGNAT address space (100.64.0.0/10). Gateway initial resolved IPs are the exception, using a public Cloudflare-owned range by default. To avoid routing conflicts, your Cloudflare Tunnel, Cloudflare Mesh, or WAN routes should not include subsets of these reserved ranges. Broader routes that contain a reserved range, such as 0.0.0.0/0, are unaffected because longest-prefix match ensures the reserved ranges still take priority.

When planning your private network addressing and configuring Split Tunnel entries, use the tables below to identify which IP ranges Cloudflare has reserved and whether they can be reconfigured.

Unlike the other IPv4 ranges, Gateway initial resolved IPs are drawn from public Cloudflare address space rather than CGNAT (100.64.0.0/10) by default. If your account was created before this default changed, or if you configured a custom range, it may still fall within CGNAT space — refer to Gateway initial resolved IPs.

Cloudflare source IPs are the source addresses used when a Cloudflare service sends traffic to your private networks. This range applies to customers using Unified Routing (beta). Examples of requests that are sourced from this range include:

• Load Balancing — health check requests to private endpoints
• Gateway DNS resolver — DNS resolution for private hostnames
• Cloudflare Workers — requests from Workers to private origins

The default IPv4 range is 100.64.0.0/12. You can change this to a different /12 CIDR to avoid conflicts with your existing IP address management plan. For more information on affected services and configuration instructions, refer to Configure Cloudflare source IPs.

Gateway initial resolved IPs (also called token IPs) are ephemeral addresses used to map hostnames to destination IPs at the network layer, where hostname information is not usually available.

The following features use this range:

• Private hostname routing — routes traffic to private applications behind Cloudflare Tunnel using their hostnames.
• Public hostname routing — egresses traffic through Cloudflare Tunnel to anchor source IPs for public destinations.
• Egress policy host selectors — evaluates Gateway egress policies using hostname-based selectors.
• Access private applications — manage access to private applications using their private hostnames.

Cloudflare assigns initial resolved IPs from the 172.64.128.0/20 (IPv4) or 2606:4700:0cf1:4000::/64 (IPv6) range by default. Unlike earlier CGNAT-based defaults, the IPv4 range is public Cloudflare address space, so it is not affected by Google Chrome's Local Network Access restrictions.

You can configure a custom IPv4 range if the default conflicts with your existing network or private routes. The IPv6 range is not configurable. For instructions, refer to Configure initial resolved IPs.

Device IPs (also called Mesh IPs in Cloudflare Mesh) are virtual addresses assigned to each Cloudflare One Client registration and each mesh node. These IPs identify and route traffic to specific devices for the following features:

• Cloudflare Mesh — mesh nodes and client devices communicate using their Mesh IPs for device-to-device, site-to-site, and mesh connectivity.
• Cloudflare WAN — on-ramps traffic from WAN tunnels to Cloudflare One Client devices.

The default IPv4 range is 100.96.0.0/12. If this range conflicts with services on your private network, you can configure custom IPv4 subnets drawn from RFC 1918 or CGNAT address space. If your account uses Cloudflare WAN, custom subnets require Unified Routing (beta). For configuration instructions, refer to Device IPs.

Private Load Balancer IPs are virtual addresses allocated to Private Network Load Balancers. Each private load balancer receives a /32 address from the 100.112.0.0/16 range by default, which serves as the load balancer's virtual IP for traffic distribution to private endpoints. Alternatively, you can configure a custom RFC 1918 ↗ /32 address for each load balancer.

For deployments that use the Cloudflare One Client, ensure that the reserved IP ranges required by your deployment route through WARP Split Tunnels to Cloudflare. Configuration depends on whether your Split Tunnels mode is set to Exclude IPs and domains or Include IPs and domains.

In Exclude IPs and domains mode, the Cloudflare One Client excludes the CGNAT range (100.64.0.0/10) from its routing by default. You must delete the reserved IP ranges that fall within CGNAT space from your Split Tunnels exclude list, or the associated features will stop working.

Gateway initial resolved IPs are the exception: the default range (172.64.128.0/20) is public Cloudflare address space, not CGNAT, so it is not excluded by default in Exclude mode — no Split Tunnel changes are required for this range. This only applies if you configured a custom initial resolved IP range within CGNAT space. In that case, treat it the same as the other CGNAT-based ranges.

Cloudflare recommends adding back the IPs that are not explicitly used for Cloudflare One services. This reduces the risk of conflicts with existing private network configurations that may use CGNAT address space.

Use the following calculator to determine which IP ranges to add back based on the Cloudflare One features you use. For example, if your deployment requires Cloudflare source IPs (100.64.0.0/12) and device IPs (100.96.0.0/12), delete 100.64.0.0/10 from Split Tunnels and add back 100.80.0.0/12 and 100.112.0.0/12.

In Include IPs and domains mode, the Cloudflare One Client sends only traffic for the included routes to Cloudflare. You must explicitly add the reserved IP ranges that your deployment depends on. For example, if you use hostname routing or egress policy host selectors, add 172.64.128.0/20 (or your custom IPv4 range) and 2606:4700:0cf1:4000::/64 to your Split Tunnels include list.