Extending Identity-Driven Access to Private Networks
Cloudflare is expanding its Zero Trust private networking capabilities with session-based access controls. Administrators will soon be able to enforce login intervals and session durations on resources hosted on private networks, adding a layer of re-authentication that has been missing from the model.
The company first introduced the ability to build a private network on its global infrastructure with identity-driven access controls earlier this year. Until now, however, once a user authenticated, that session could persist indefinitely unless it was manually revoked. The upcoming beta feature addresses that gap by letting administrators require periodic re-authentication for private network resources.
Why Traditional Private Networks Fell Behind
Corporate private networks were designed around a strict security perimeter. Users needed to be physically connected to the network to reach sensitive applications, often from a managed device in an office. While that approach provided a degree of control, it was far from perfect—physical connections and Wi-Fi could be compromised, and the network itself offered no granular identity-based enforcement.
As remote work became the norm, the limitations of this model became more apparent. Organizations deployed VPNs to bridge remote users onto the corporate network, but the underlying security problem remained: once inside the perimeter, users could reach nearly any resource by default. Identity-based controls and audit logs were difficult if not impossible to implement.
Operational complexity was another concern. Private networks rely on RFC 1918 reserved IP space, which is limited and prone to overlapping address collisions. Administrators also had to account for overall network load, which could spike when employees used the VPN for video calls or other bandwidth-heavy activities.
The Role of Zero Trust Alternatives
SaaS applications and Zero Trust networking solutions such as Cloudflare Access have made it easier to secure applications without a VPN. Administrators can configure per-application controls like multi-factor authentication and anomaly-based login alerts. Security controls for public-facing applications now far outstrip those available for private network resources.
Still, some use cases demand a more traditional connectivity model. Thick clients outside the browser and arbitrary TCP or UDP protocols are not a natural fit for browser-based access. Cloudflare heard from customers who wanted to adopt a Zero Trust model but also needed to support these legacy private network scenarios.
Bringing Session Rules to the Private Network Model
Cloudflare's approach starts by securely connecting private networks to its global network. That can be done through outbound-only tunnels via Cloudflare Tunnel, or through traditional GRE or IPSec tunnels.
Once a tunnel is established, private IP ranges can be advertised on a Cloudflare instance. Administrators map a tunnel to a CIDR block of IP addresses, each with its own unique identifier and name.
Users access these private IP ranges through the WARP client, which routes their traffic to Cloudflare's network—replacing the traditional VPN client. Administrators can then create granular, identity-based policies that govern which users may reach specific applications on particular IP addresses or, soon, hostnames.
That model eliminated common VPN pain points like latency, management overhead, and traffic backhauling. But it lacked session control. With the beta, administrators will be able to configure session durations for their policies and require users to re-authenticate with multi-factor authentication at set intervals—for example, every 24 hours or after one week.
What's Next
The session control feature is one part of a broader effort to strengthen Cloudflare's Zero Trust private networking. Also launching into beta this week is UDP support, which will allow teams to use existing private DNS nameservers to map application hostnames on local domains. That addresses issues with clashing or ephemeral private IP addresses.
Cloudflare is accepting sign-ups for both betas and notes that its Zero Trust solution is free for the first 50 users.
