Cloudflare adds BGP route filters for GRE and IPsec tunnels

Cloudflare announced on 15 October that Magic Transit and Cloudflare WAN support import and export filtering for Border Gateway Protocol (BGP) routes exchanged over GRE and IPsec tunnels. Operators can manage reusable filter profiles through the dashboard, API or Terraform, and the company says profile changes do not reset BGP sessions. Release announcement

What changed

Profiles define which address prefixes match and whether those matches are allowed or denied. Matching can cover an exact prefix, the prefix and its more-specific routes, or a specified range of prefix lengths. Each tunnel can have one import profile and one export profile.

The action matters beyond the matching routes: an allow profile rejects everything outside its matches, while a deny profile accepts everything outside them. Import filtering governs what Cloudflare receives from the peer; export filtering governs routes selected for advertisement to that peer. Magic Transit configuration guide

Why it matters for BYOIP

For teams using their own address space with Magic Transit, this provides another place to express the intended routing boundary between their equipment and Cloudflare. It follows the earlier BGP-over-tunnels general-availability release.

For operators, the useful question is which prefixes each connection should exchange during normal operation and failover. A written inventory makes that decision reviewable: include the intended origin, permitted more-specifics and the service that depends on each route. Compare that inventory with observed advertisements before deciding which filter to apply.

The announcement concerns tunnel route exchange. It does not announce a change to BYOIP ownership checks or Internet-wide route authorization. Keep those responsibilities in the onboarding review described in our Cloudflare provider profile.

What to check

Two documented limits deserve particular attention. Prefixes configured in a tunnel's extra_prefixes field bypass export filtering. Also, the 5,000-route inbound routing-information-base limit is enforced before import filtering, so rejected routes still consume that allowance. A filter therefore cannot be assumed to solve an oversized incoming route table. Cloudflare WAN configuration guide

• Compare the intended prefixes with both filter directions, including any deliberately permitted more-specific announcements.
• Review the tunnel's explicit prefix settings alongside the filter; checking the profile alone can miss an exception.
• Test expected acceptance, rejection and failover on a limited deployment before expanding the policy. Record a rollback configuration.
• Check reachability as well as session health. A session that remains established does not prove that the resulting routes meet the application's needs.

Sources and further reading

The dated announcement establishes the release; the linked configuration guides describe its behavior and constraints. The checks above are editorial recommendations, not results of hands-on testing.