cloudflare-vpc-services
Configure Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. This skill covers tunnel setup, VPC service creation, wrangler binding configuration, and the critical rules that prevent common errors like dns_error and requests leaking to public endpoints.
Cloudflare VPC Services enables Workers to securely access private APIs in AWS, Azure, GCP, or on-premise networks through encrypted tunnels.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-04-20
Cloudflare VPC Services enables Workers to securely access private APIs in AWS, Azure, GCP, or on-premise networks through encrypted tunnels. Configure Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. This skill covers tunnel setup, VPC service creation, wrangler binding configuration, and the critical rules that prevent common errors like dns_error and requests leaking to public endpoints.
Use it when
- Cloudflare VPC Services dns_error typically stems from incorrect URL formatting, mismatched service IDs.
- Cloudflare VPC Services relies on cloudflared tunnels to establish encrypted connections.
Verify before relying
Read SKILL.md below before installing (11 files). Open directory: indexed for reading, not audited.
Install
nodnarbnitram/claude-code-extensions/cloudflare-vpc-services · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I set up Cloudflare VPC Services to securely route Workers to private APIs?
Cloudflare VPC Services enables Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. Start by creating a VPC service in the Cloudflare dashboard, then configure a cloudflared tunnel to bridge your private network. In wrangler.toml, bind the VPC service to your Worker using the service ID. Finally, use fetch() with the correct internal URL format—absolute URLs pointing to your private endpoint—to route requests through the encrypted tunnel instead of the public internet.
What causes dns_error and connection issues with VPC service bindings?
Cloudflare VPC Services dns_error typically stems from incorrect URL formatting, mismatched service IDs, or firewall rules blocking UDP port 7844 (required for QUIC protocol). Verify that your fetch() call uses an absolute URL matching your VPC service configuration, that the service binding environment variable is correctly declared in wrangler.toml, and that your private network allows outbound traffic on port 7844. Port mismatch errors also occur when the internal service listens on a different port than your VPC binding expects.
How do I configure cloudflared tunnels and QUIC protocol for Workers VPC access?
Cloudflare VPC Services relies on cloudflared tunnels to establish encrypted connections. Install cloudflared (version 2025.7.0 or later for full QUIC support), then authenticate and create a tunnel pointing to your private network's gateway. Enable QUIC protocol in your tunnel configuration for optimal performance. The tunnel handles UDP 7844 traffic automatically; ensure your firewall permits this port bidirectionally. Once the tunnel is active, Workers can route requests through it by referencing the VPC service binding.
What are the correct fetch() patterns and URL formatting for internal services?
Cloudflare VPC Services requires absolute URLs in fetch() calls—never relative paths. Format your URL as https://your-internal-hostname:port/path, matching exactly what your VPC service binding specifies. The hostname must resolve within your private network, and the port must align with your internal service's listening port. Avoid hardcoding IPs; use hostnames for better maintainability. Requests formatted incorrectly may leak to public endpoints or trigger dns_error, so validate your URL structure against your VPC service configuration.
How do I access private APIs from Cloudflare Workers using VPC services?
Cloudflare VPC Services lets Workers access private APIs by combining three components: a cloudflared tunnel bridging your private network, a VPC service binding in your Worker, and correctly formatted fetch() calls. First, deploy a cloudflared tunnel from your private network to Cloudflare. Next, create a VPC service in the dashboard linking to that tunnel. Finally, bind the service in wrangler.toml and call fetch() with the internal service's absolute URL. This routes traffic securely without exposing your private APIs to the public internet.
How do I migrate existing Workers to use VPC bindings for on-premise networks?
Cloudflare VPC Services migration involves updating your wrangler.toml to add VPC service bindings, then refactoring fetch() calls to use internal URLs instead of public endpoints. First, establish a cloudflared tunnel from your on-premise network to Cloudflare. Create a VPC service pointing to that tunnel. Add the binding to wrangler.toml with the service ID. Finally, update your Worker code to replace public API URLs with internal hostnames and ports. Test thoroughly to ensure requests route correctly and no traffic leaks to public endpoints.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Cloudflare VPC Services
> Enable Workers to securely access private APIs and services through encrypted tunnels without public internet exposure.
⚠️ BEFORE YOU START
This skill prevents 5 common errors and saves ~60% tokens.
| Metric | Without Skill | With Skill |
|---|---|---|
| Setup Time | 45+ min | 10 min |
| Common Errors | 5 | 0 |
| Token Usage | ~8000 | ~3000 |
Known Issues This Skill Prevents
dns_errorfrom outdated cloudflared version or wrong protocol- Requests leaving VPC due to using public hostnames instead of internal
- Port mismatch - fetch() port is ignored, service config port is used
- Missing absolute URLs in fetch() calls
- Incorrect tunnel ID or service binding configuration
Quick Start
Step 1: Verify Tunnel
(truncated - see the full file via the links below)
File tree — 11 files
.claude/skills/cloudflare-vpc-services/README.md
.claude/skills/cloudflare-vpc-services/SKILL.md
.claude/skills/cloudflare-vpc-services/references/README.md
.claude/skills/cloudflare-vpc-services/references/api-patterns.md
.claude/skills/cloudflare-vpc-services/scripts/README.md
.claude/skills/cloudflare-vpc-services/scripts/list-vpc-services.sh
.claude/skills/cloudflare-vpc-services/scripts/set-api-token.sh
.claude/skills/cloudflare-vpc-services/scripts/tail-worker.sh
.claude/skills/cloudflare-vpc-services/templates/vpc-service-hostname.json
.claude/skills/cloudflare-vpc-services/templates/vpc-service-ip.json
.claude/skills/cloudflare-vpc-services/templates/wrangler-vpc.jsonc
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Set up Cloudflare VPC Services to securely route Workers to private APIs”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Expose any local HTTP service to the internet using your own domain through Cloudflare Tunnel, with zero inbound firewall configuration or certificate hassle. The skill handles tunnel creation, DNS setup, and cloudflared installation automatically while you manage the Cloudflare account and API token. Supports multiple sites on a single tunnel for efficient resource use.
Systematically identifies and resolves Cloudflare Tunnel connectivity failures that block remote access. Checks container status, validates tunnel tokens, analyzes logs for Error 1033 and QUIC issues, and provides targeted recovery commands.
Replace VPN access to internal services using Cloudflare's Zero Trust platform, which combines identity verification, device compliance checks, and encrypted tunnels to protect dashboards, admin panels, and on-premises apps. Enforce DNS-level threat filtering and support remote teams without opening inbound ports.
Rustunnel lets you create public tunnels for local services across HTTP, TCP, UDP, and peer-to-peer protocols. Use it to test webhooks, share development environments, access databases remotely, or run load-balanced pools—all controlled through MCP tools that integrate with Claude Code and other AI agents.
This skill guides you through creating a new Cloudflare Tunnel from scratch, handling token generation, .env configuration, and container restart. It covers prerequisite checks, dashboard setup, hostname routing, and connectivity verification to get your tunnel operational.
This skill guides you through evidence-based troubleshooting of Cloudflare configuration problems by querying the Cloudflare API to examine actual settings rather than making assumptions. It covers common issues including redirect loops, SSL certificate errors, DNS misconfigurations, and origin server errors, providing specific API calls and diagnostic logic for each.
More skills configuring-firewalls (MIT) · k8s-vind (MIT) · cloudflare-one-migrations (Apache-2.0) · cloudflare-one (Apache-2.0) · Cloudflare Manager (unlicensed)