Layer 4 load balancing extends into private networks

Cloudflare has expanded its Private Network Load Balancing solution to cover non-HTTP(S) traffic. The new capability, available to enterprise customers, combines Cloudflare Spectrum, Cloudflare Tunnels, and Cloudflare load balancers so that any TCP or UDP service can be balanced across private origins. This removes the requirement for dedicated on-premise load balancing hardware for layer 4 workloads.

The distinction between layer 7 and layer 4 load balancing comes down to where in the OSI model the ingress path operates. Layer 7 covers HTTP(S), where Cloudflare applies services such as CDN, WAF, Bot Management, and DDoS protection. Layer 4 operates at the transport layer and supports a broader set of protocols — SSH, FTP, NTP, SMTP — with a more generalized treatment. Cloudflare's public layer 4 load balancing is powered by Spectrum, which acts as a reverse proxy at layer 4 and shields origin IP addresses from direct attack.

From three traffic flows to four

Before this release, Cloudflare load balancing supported three main traffic flows:

  • Internet-facing layer 7 load balancers for HTTP(S) traffic to public origins
  • Internet-facing layer 4 (Spectrum) load balancers for TCP- and UDP-based services to public origins
  • Publicly accessible layer 7 load balancers connecting to private origins over Cloudflare Tunnels

The hardware alternative to these solutions carries significant operational baggage. Load balancer appliances require purchases, licensing, bandwidth modules, and periodic end-of-life replacements that can consume years of planning and cutover effort. Cloudflare's model distributes load balancers across its global Anycast network in over 300 cities, with customers connecting to a nearby data center where policies are applied.

Spectrum now reaches private IP endpoints

The announcement adds a fourth traffic flow: layer 4 (Spectrum) load balancing to private origins. Any set of internal TCP or UDP applications can now be locally load balanced through Cloudflare, gaining Spectrum's L3/L4 DDoS protection and session persistence while keeping origins inaccessible from the public Internet. Origins can live in private data centers, public clouds, private clouds, or on-premise.

Without this feature, balancing to private networks demanded expensive hardware or direct physical connections to cloud providers. It also required careful ACL management to restrict which source IPs could reach the origins. With Spectrum as the ingress path, the origins stay fully protected and unreachable from the Internet; access flows exclusively through the Cloudflare load balancer.

How private origin routing works

The implementation centers on integrations with Apollo, the unifying service from Cloudflare's Zero Trust team. Apollo accepts incoming traffic from supported on-ramps, applies Zero Trust logic, and routes traffic to egress through supported off-ramps. Previously, Apollo enabled WARP clients to reach private origins over Cloudflare Tunnels. Now it handles load balanced Spectrum traffic as well.

When a customer creates a load balanced Spectrum app with a hostname, port, and a Cloudflare load balancer as the origin, Spectrum queries Cloudflare's internal load balancing service, Director, to find the appropriate endpoint. In earlier implementations, this endpoint had to be publicly addressable. Now, when Director returns a private origin, Spectrum passes the origin's IP address and virtual network ID to Apollo, which proxies the connection to the private target.

These new integrations between Spectrum, Apollo, and Director allow load balancing to leverage virtual networks so traffic stays off the public Internet. The architecture also lays groundwork for future integrations with other on-ramps and off-ramps such as WARP, opening possibilities for load balancing authenticated device traffic to private networks.

Configuration details for the feature are available in Cloudflare's load balancing documentation. Cloudflare indicates support for internal traffic balancing, enhanced layer 4 session affinity, new steering methods, and additional traffic ingress options are planned next.