How Automatic Return Routing solves IP overlap (opens in new tab)
Cloudflare’s Automatic Return Routing (ARR) addresses overlapping private IP ranges by routing return traffic based on the tunnel that initiated a connection, rather than relying solely on destination IPs. This allows identical networks to coexist without NAT, VRFs, or manually maintained route mappings. ARR is being introduced as an optional Closed Beta capability for Cloudflare One customers. ## The Ambiguity of Overlapping Private Networks - Public Internet routing assumes each IP address identifies one logically unique destination. - Private networks often reuse the same ranges, such as `10.0.1.0/24`, creating ambiguity when connected through Cloudflare. - Common causes include: - Mergers and acquisitions involving duplicate internal addressing. - Extranets connecting partners or vendors with conflicting IP schemes. - Repeated “cookie-cutter” architectures across branches or customer deployments. - If two sites use the same source IP, return traffic cannot be distinguished by a conventional routing table and may be sent to the wrong site. ## Limitations of Traditional Solutions - **Virtual Routing and Forwarding (VRF):** - Separates overlapping networks with independent routing tables. - Adds operational overhead. - Route leaking between VRFs becomes complex and brittle at scale. - **Network Address Translation (NAT):** - Maps overlapping ranges to unique managed addresses. - Works reliably but requires administrative mappings for every site or partner. - Cloudflare designed ARR to eliminate this per-site configuration for common use cases such as Internet and private data center access. ## How Automatic Return Routing Works - ARR replaces ambiguous route-based decisions with stateful flow tracking. - When a packet begins a flow, Cloudflare records the specific connection or tunnel that delivered it. - Supported originating connections include: - IPsec tunnels - GRE tunnels - Network Interconnects - For subsequent packets, Cloudflare checks whether they match an existing flow. - Existing flows reuse their stored forwarding decisions instead of being evaluated from scratch. - New flows are processed through the relevant Cloudflare One components—such as Gateway, DLP, and Firewall—and ARR records the initiating tunnel. - Return traffic is then sent back through that same tunnel, answering “where did this conversation originate?” rather than “which network owns this IP?” ## Practical Implication ARR enables overlapping private networks to communicate through Cloudflare One without NAT or complex VRF designs. It is intended as a zero-touch approach to reducing routing administration, and is available initially in Closed Beta.