Gateway, Cloudflare Mesh, Workers VPC - Filter Workers' public Internet traffic using Gateway policies

Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway. This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today.

1. Worker

   Calls env.EGRESS.fetch()

2. VPC binding↓
3. Cloudflare Mesh

   Bind via cf1:network

4. ↓
5. Cloudflare Gateway

   Policies applied:

   DNSHTTPNetwork
6. ↓
7. ↗Public Internet

   Any public hostname or IP

Gateway logsDNSHTTPNetwork

What you get by default:

• Visibility. Worker egress shows up in Gateway DNS, HTTP, and Network logs alongside your other traffic, so you can audit what your Workers are calling and when.
• Enforcement. Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block.

{
	"vpc_networks": [
		{
			"binding": "EGRESS",
			"network_id": "cf1:network",
			"remote": true,
		},
	],
}

[[vpc_networks]]
binding = "EGRESS"
network_id = "cf1:network"
remote = true

// Egress to a public destination — subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data");

// Egress to a public destination — subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data");

For configuration options, refer to VPC Networks. For policy authoring, refer to Cloudflare Gateway traffic policies.