Load Balancing, Cloudflare Tunnel, Cloudflare Mesh - Steer Cloudflare One users and private networks to the same endpoint with session affinity and hash steering in private load balancers

Private load balancers can now keep each user on the same endpoint. This helps with applications that keep session state on a single server.

Cloudflare One Client or Cloudflare WAN site

Connects to 100.112.0.0

Private load balancer

Picks a healthy endpoint based on your steering policy

Health monitorsSteeringSession affinity

• Pool 1Cloudflare Tunnel
  • 10.0.0.1vnet-a
• Pool 2Cloudflare Mesh node
  • 10.1.0.1default
• Pool 3Cloudflare WAN
  • 10.2.0.1default

Endpoint = IP address + virtual network

Two options are available:

• Hash endpoint steering. In the dashboard, set a pool's Endpoint steering to Hash. Each user is mapped to an endpoint within the pool.
• Session affinity. With the API, set session_affinity to ip_cookie on the load balancer. Each user stays on the same endpoint while it remains healthy and your pools do not change. Refer to Session affinity.

For traffic from the Cloudflare One Client, Cloudflare identifies the user by their device, so a user stays on the same endpoint even if their IP address changes. For other traffic, such as from a Cloudflare WAN site, Cloudflare uses the source IP address.

This works for endpoints reached through Cloudflare Tunnel, Cloudflare Mesh, and Cloudflare WAN. Affinity pins the endpoint, not the cloudflared or Mesh replica that carries the traffic.

To learn how private load balancing fits with your connectors, refer to Load balance private network traffic.