Private network and fixed addresses

Internal tools often need internal data: an ERP, a database behind the office firewall, an API that only answers from an address it knows. On Enterprise, a workspace can do both of these, once we’ve set it up for you:

• Private network. You run a small connector inside your network. It dials out to Cloudflare and keeps that connection open. Apps you choose reach the services you add, through it, and nothing else on your network.
• Fixed addresses. Your apps’ requests to the internet leave from addresses we give your workspace, so a firewall or a partner’s API can allow them. Only addresses reserved for your workspace alone tell your apps apart from anyone else’s.

Nothing here gives anyone a way in to your apps. The connector carries your apps’ requests into your network and their answers back, and nothing else: it isn’t a route to an app, and an app’s address is still reached only through sign-in.

Add a network

A network is one connector’s tunnel. Owners and admins add one, once they’ve signed in in the last few minutes, since the answer holds the connector’s token:

jiayang network add acme office

The answer is the command that runs its connector. Run it on a machine inside your network that can reach the services you’ll add, with cloudflared, which you get from Cloudflare:

cloudflared tunnel --no-autoupdate run --token <token>

The token lets whoever has it run this network’s connector, so keep it as you’d keep a password. You can run the same command on a second machine for a spare. jiayang network connector acme office prints it again, for an owner or admin who signed in in the last few minutes, and each time it’s shown is in the audit log as private_network.token.

In the dashboard it’s under Private network in the sidebar, which shows whether each network’s connector is running.

Add a service

A service is one host on a network, and the ports your apps reach it on. Give it a name, the host your apps will ask for, and a port for https, http or both:

jiayang network service add acme erp --network office --host erp.corp.example --https-port 443

The host is a name your network’s DNS answers, or an address on your network: 10.x, 172.16 to 172.31.x, 192.168.x, 100.64 to 100.127.x, or a unique local IPv6 address (fc00::/7). A public address works too. Names under .internal and .localhost are kept for the platform itself, so use the address or another name for those. Loopback, link-local and other reserved addresses are refused, so the connector’s machine and a cloud’s metadata service stay out of reach.

Over https, the service’s certificate is checked in full by default. --tls ca checks its certificate chain but not the name on it. --tls off doesn’t check it.

Let an app reach it

No app reaches a service until an owner or admin grants it:

jiayang network grant acme/payroll erp

Within 10 seconds, the app’s requests to https://erp.corp.example/ go through your connector to that service. In the app’s code, it’s an ordinary request:

const orders = await fetch("https://erp.corp.example/api/orders");

Only the scheme and port the service takes go through: here, https on 443. A request for an address on your network that isn’t one of the app’s services is refused, as it always is. So is a request for one of your services’ names from an app that isn’t granted it: the name is your company’s, so it never goes to the internet instead. The app’s secrets for the host are added on the way out, as for any host. A grant is its own allow, so an app whose outbound list is on reaches the services it’s granted without the list naming them. The list still decides which internet hosts it reaches.

jiayang network revoke acme/payroll erp takes it away, and anyone who can edit the app can do that. jiayang network show acme/payroll lists what an app reaches, and so does the app’s Settings tab. jiayang network list acme lists everything.

Removing a service stops every app reaching it within 10 seconds, and its name is then an ordinary internet host again. A network can be removed once it has no services left. Every change is in the audit log: private_network.add, private_network.remove, private_service.add, private_service.remove, private_grant.put and private_grant.remove, and webhooks and Slack can be told of each.

If the workspace leaves Enterprise, its apps stop reaching its services within 10 seconds, and a request for one is refused. What it set up is kept, and works again if it comes back to Enterprise.

Fixed addresses

Fixed addresses come with an Enterprise contract, as Cloudflare leases them to us per contract. We give your workspace its addresses, and from then on every request your apps make to the internet leaves from them, the ones made with the company AI key included. Queries to a connected Postgres database are the exception: Cloudflare Hyperdrive makes those connections, from Cloudflare’s shared ranges, never from your fixed addresses. The Private network page and jiayang network list acme show them in the form a firewall’s allowlist takes:

Fixed addresses (this workspace's alone): 104.16.0.7/32, 104.16.0.8/31

The audit log says when we gave them, as egress_ips.assign. Add them to your firewall before you rely on them. Requests to your private network’s services go through your connector, not from these addresses.

Addresses are either reserved for your workspace alone or shared with other Enterprise workspaces, and the line above says which. Shared addresses don’t identify your workspace: every app of every other workspace given them sends from them too. Allowing them lets those apps in as well, so don’t use them as the only thing that lets a request through. Only addresses reserved for your workspace alone are safe to allow on their own. Ask us for those if a firewall or a partner needs them.

If the workspace leaves Enterprise, its apps’ requests leave from Cloudflare’s shared addresses instead, and the addresses come back if it returns to Enterprise. Shared addresses only ever carry Enterprise workspaces’ requests.

Limits

A workspace can have up to 5 networks and 25 services. One network reaches every service its connector can, so most companies need one, or one per site.