--- title: VPC Networks description: Bind Workers to an entire Cloudflare Tunnel or Cloudflare Mesh without pre-registering hosts. image: https://developers.cloudflare.com/dev-products-preview.png --- > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/workers-vpc/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # VPC Networks VPC Networks allow your Workers to access any service in your private network without pre-registering individual hosts or ports. You can bind to a specific [Cloudflare Tunnel](https://developers.cloudflare.com/workers-vpc/configuration/tunnel/) to reach any service behind that tunnel, or bind to [Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/) to reach any Mesh node, client device, subnet route or hostname route announced through Cloudflare Tunnel or Mesh, or destination reachable through a [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) on-ramp (GRE, IPsec, or CNI). At runtime, the URL you pass to `fetch()` or the address you pass to `connect()` determines the destination — any hostname or IP address reachable through the bound Cloudflare Tunnel or through Cloudflare Mesh. Use `fetch()` for HTTP traffic, and [connect()](https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/) for raw TCP connections (Redis, MQTT, custom protocols, and other non-HTTP services). This differs from [VPC Services](https://developers.cloudflare.com/workers-vpc/configuration/vpc-services/), which require you to create a separate binding for each target host and port combination. Note Workers VPC is currently in beta. Features and APIs may change before general availability. While in beta, Workers VPC is available for free to all Workers plans. ## Bind to a Cloudflare Tunnel Note Binding directly to a Cloudflare Tunnel through a VPC Network binding requires the **Connectivity Directory Admin** role. Reference a specific Cloudflare Tunnel directly by its UUID: * [ wrangler.jsonc ](#tab-panel-11677) * [ wrangler.toml ](#tab-panel-11678) JSONC ``` { "vpc_networks": [ { "binding": "MY_VPC", "tunnel_id": "550e8400-e29b-41d4-a716-446655440000", "remote": true } ]} ``` TOML ``` [[vpc_networks]]binding = "MY_VPC"tunnel_id = "550e8400-e29b-41d4-a716-446655440000"remote = true ``` The `remote` flag must be set to `true` to enable remote bindings during local development. ## Bind to Cloudflare Mesh [Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/) (formerly WARP Connector) connects your services, devices, and Workers through Cloudflare's global network. When you bind a Worker to Cloudflare Mesh using `network_id: "cf1:network"`, your Worker can reach: * Any Mesh node or client device in your account * Subnet routes and hostname routes announced through Cloudflare Tunnel or Cloudflare Mesh * Destinations reachable through [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) on-ramps (GRE, IPsec, and CNI) * Public Internet destinations through [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-policies/) — with your existing Zero Trust traffic policies enforced and traffic logged in DNS, HTTP, and Network logs All of this without specifying a particular Cloudflare Tunnel UUID. Use `cf1:network` when: * Your Workers need to reach private services across multiple Cloudflare Tunnels, Mesh nodes, or Cloudflare WAN on-ramps * You want to access your entire private network from a Worker without managing individual Cloudflare Tunnel bindings * Your private network topology may change (new connections, new nodes, new routes) and you do not want to update Worker configuration each time * You want Worker egress to public destinations to flow through Cloudflare Gateway for policy enforcement and visibility Note Your account must have at least one active [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/), [Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/) node, or [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) on-ramp that can reach the target services. For destinations behind Cloudflare WAN on-ramps (GRE, IPsec, or CNI), your network must also route the [Cloudflare source IP range](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-cloudflare-source-ips/) (`100.64.0.0/12` by default) back through the on-ramp so reply traffic returns to Cloudflare. This is part of standard Cloudflare WAN onboarding. If you have already configured this for Gateway, Load Balancing, or other Cloudflare services that reach your private network through Cloudflare WAN, no additional setup is required. Bind to Cloudflare Mesh using `network_id: "cf1:network"`: * [ wrangler.jsonc ](#tab-panel-11679) * [ wrangler.toml ](#tab-panel-11680) JSONC ``` { "vpc_networks": [ { "binding": "MY_VPC", "network_id": "cf1:network", "remote": true } ]} ``` TOML ``` [[vpc_networks]]binding = "MY_VPC"network_id = "cf1:network"remote = true ``` ## Runtime usage ### HTTP via `fetch()` Access any HTTP service in your network at runtime using `fetch()`: TypeScript ``` export default { async fetch(request: Request, env: Env) { // Access a service by private IP const response = await env.MY_VPC.fetch("http://10.0.1.50/data"); // Access another service on a different port const dbResponse = await env.MY_VPC.fetch("http://10.0.5.42:5432"); return response; },}; ``` When a VPC Network cannot establish a connection to your target service, `fetch()` throws an exception. ### TCP via `connect()` Open raw TCP connections to any private destination using [connect()](https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/). This is useful for non-HTTP protocols like Redis, Memcached, MQTT, or custom binary protocols: TypeScript ``` export default { async fetch(request: Request, env: Env) { // Open a TCP connection to a private Redis instance const socket = await env.MY_VPC.connect("10.0.1.50:6379"); // Write a Redis PING command const writer = socket.writable.getWriter(); await writer.write(new TextEncoder().encode("PING\r\n")); await writer.close(); return new Response(socket.readable); },}; ``` When a VPC Network cannot establish a TCP connection, `connect()` throws an exception. Note `connect()` over VPC Networks currently supports plaintext TCP only. ## VPC Networks vs VPC Services VPC Networks and [VPC Services](https://developers.cloudflare.com/workers-vpc/configuration/vpc-services/) both connect Workers to private infrastructure, but they make different trade-offs. * **Use VPC Services** when you have a known set of targets and want each binding scoped to a specific host and port. * **Use VPC Networks** when you need broader access — an entire Cloudflare Tunnel or all of Cloudflare Mesh — and want the URL in your `fetch()` call to control routing at runtime. The following table summarizes the differences: | Feature | VPC Networks | VPC Services | | -------------------- | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | Scope | A single Cloudflare Tunnel, or Cloudflare Mesh and Cloudflare WAN routes | Specific host + port | | Configuration | tunnel\_id (single Cloudflare Tunnel) or cf1:network (account-wide) | service\_id | | Protocols | HTTP (fetch()) and TCP (connect()) | HTTP (fetch()) or TCP (via [Hyperdrive](https://developers.cloudflare.com/hyperdrive/)) | | Service registration | Not required | Required for each target | | Use when | Dynamic discovery, network-wide access, reaching services across your account | Fixed, cataloged services | ## Next steps * Set up [Cloudflare Tunnel](https://developers.cloudflare.com/workers-vpc/configuration/tunnel/) * [Set up Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/get-started/) * [Set up Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/get-started/) * Try the [Connect Workers to Cloudflare Mesh](https://developers.cloudflare.com/workers-vpc/examples/connect-to-cloudflare-mesh/) example * Learn about the [Workers Binding API](https://developers.cloudflare.com/workers-vpc/api/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/#page","headline":"VPC Networks · Cloudflare Workers VPC","description":"Bind Workers to an entire Cloudflare Tunnel or Cloudflare Mesh without pre-registering hosts.","url":"https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/","inLanguage":"en","image":"https://developers.cloudflare.com/dev-products-preview.png","dateModified":"2026-06-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/workers-vpc/","name":"Workers VPC"}},{"@type":"ListItem","position":3,"item":{"@id":"/workers-vpc/configuration/","name":"Configuration"}},{"@type":"ListItem","position":4,"item":{"@id":"/workers-vpc/configuration/vpc-networks/","name":"VPC Networks"}}]} ```