Closing the UDP gap in Cloudflare’s Zero Trust platform
Cloudflare’s Zero Trust platform has, since late 2020, offered organizations a way to replace legacy VPNs with a combination of Cloudflare Tunnel on the infrastructure side and the Cloudflare WARP client on user devices. The setup removes the need for traditional VPN concentrators, internal firewalls, and load balancers, and it applies Zero Trust rules across the entire organization. Until now, however, that private network replacement only covered TCP traffic.
Today Cloudflare is opening a waitlist for early access to UDP support on its Zero Trust platform. That addition also unlocks internal DNS resolution, meaning organizations no longer have to manually migrate private hostnames into DNS override rules. Users can sign up for the Teams plan for free, and interested parties can join the UDP and Internal DNS waitlist.
How a Cloudflare private network is assembled
The infrastructure side uses Cloudflare Tunnel, a command-line daemon deployed in an environment that establishes secure, outbound-only, load-balanced links from a single application, a set of applications, or an entire network segment to Cloudflare’s edge. The client side is handled by Cloudflare WARP, a WireGuard-based device client that can be pushed to an entire organization through existing MDM tooling. The WARP client creates a secure link from each user’s device to Cloudflare, and administrators can then tag applications and enforce identity- and device-based Zero Trust policies per request.
Why UDP matters for VPN replacement
The most common reason organizations kept their legacy VPNs in place was blanket support for UDP-based traffic. UDP is essential for applications that require near real-time communication, such as video streaming, VoIP, and gaming, where dropping a packet is preferable to halting a stream until retransmission. Developers also choose UDP when they want to implement custom connection, transmission, and quality controls rather than rely on TCP’s standardized mechanisms.
Supporting UDP end-to-end through the Zero Trust platform unlocks several significant use cases:
Internal DNS resolvers
Corporate networks typically rely on internal DNS resolvers so users can reach resources by hostname instead of numeric IP addresses. DNS queries are usually a single small UDP request and reply, which is precisely why UDP support across the Zero Trust platform is a prerequisite for replacing a VPN. Internal DNS means organizations can point at their existing private hostnames—no manual re-keying of hundreds of entries into DNS override rules.
Thick client applications
Many business-critical applications communicate over UDP. Legacy Outlook versions, for example, often operate as thick clients, where local computation handles most work and only sync interactions with Exchange servers go out over UDP. Supporting these applications end-to-end removes one more barrier to decommissioning the legacy VPN.
Setting up a private network today
Organizations can already build a private network on Cloudflare using the existing developer documentation. The critical path involves installing and authenticating cloudflared on the network, creating a named tunnel, and configuring it with the IP/CIDR range of the private network. That configuration tells the WARP agent to route any requests to that range through the tunnel. Once configured, the tunnel is started with a simple run command.
For the user side, the process starts by downloading and installing the Cloudflare WARP agent on a device. Next, an administrator defines who may access the network through a device enrollment policy under Settings > Devices > Device Enrollment. After that policy is in place, a user enrolls the device from the WARP desktop client under Preferences > Account > Login with Teams.
The final step is removing the private IP range from the Exclude list under Settings > Network > Split Tunnels, so that traffic is actually routed to Cloudflare and sent through the private network tunnel. In-product guides within the Teams Dashboard provide validation at each step. The Teams Dashboard also offers shortcuts to create the first tunnel under Access > Tunnels and to enroll a first device under My Team > Devices.
Roadmap after UDP
Cloudflare plans to build on this foundation after launch, adding Zero Trust access rules for each request to each internal DNS hostname. The company is also working on performance measurement efforts to keep the platform fast as it scales beyond TCP-only private networking.
