Automatic Return Routing Solves IP Overlap

🔑 Enhanced Key Takeaways

• •ARR entered beta in November 2025 as part of Magic WAN (now Cloudflare WAN) and requires enabling the new Unified Routing mode[1][2].
• •ARR tracks specific flow details including source/destination IPs, ports or identifiers, and the originating tunnel to match return packets[2].
• •ARR supports new TCP connections (SYN), UDP, and ICMP echo requests destined for Internet egress, WARP clients, or private networks via Cloudflare Tunnel/WARP Connector[2].
• •Flow matching takes precedence over the Cloudflare Virtual Network routing table, applying only to return paths while outbound uses configured routes[2].

🛠️ Technical Deep Dive

• •On eligible inbound traffic, Cloudflare WAN creates a stateful flow entry recording source IP, destination IP, protocol-specific ports/identifiers, and the specific IPsec/GRE tunnel or network interconnect[2].
• •For return packets matching the flow, routing bypasses the routing table and directs traffic back to the exact learned connection[2].
• •Feature is enabled per-connection on tunnels or interconnects, operating in route-less mode where static/dynamic routes are optional[1][2].
• •Currently in beta, limited to Unified Routing mode, and does not affect initial outbound requests which follow static/BGP routes[1][2].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline