Gateway, Cloudflare Mesh, Workers VPC – Filter Workers’ public Internet traffic using Gateway policies

Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway. This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today.

1. Worker

   Calls env.EGRESS.fetch()

2. VPC binding ↓
3. Cloudflare Mesh

   Bind via cf1:network

4. ↓
5. Cloudflare Gateway

   Policies applied:

   DNS HTTP Network
6. ↓
7. ↗ Public Internet

   Any public hostname or IP

Gateway logs DNS HTTP Network

What you get by default:

• Visibility. Worker egress shows up in Gateway DNS, HTTP, and Network logs alongside your other traffic, so you can audit what your Workers are calling and when.
• Enforcement. Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block.

• wrangler.jsonc

  {
    "vpc_networks": [
      {
        "binding": "EGRESS",
        "network_id": "cf1:network",
        "remote": true,
      },
    ],
  }

• wrangler.toml

  [[vpc_networks]]
  binding = "EGRESS"
  network_id = "cf1:network"
  remote = true

• JavaScript

  // Egress to a public destination — subject to your Gateway policies and logged
  const response = await env.EGRESS.fetch("https://api.example.com/data");

• TypeScript

  // Egress to a public destination — subject to your Gateway policies and logged
  const response = await env.EGRESS.fetch("https://api.example.com/data");

For configuration options, refer to VPC Networks. For policy authoring, refer to Cloudflare Gateway traffic policies.

Source: Cloudflare

Latest Posts