cloudflare-vpc-services

Configure Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. This skill covers tunnel setup, VPC service creation, wrangler binding configuration, and the critical rules that prevent common errors like dns_error and requests leaking to public endpoints.

Cloudflare VPC Services enables Workers to securely access private APIs in AWS, Azure, GCP, or on-premise networks through encrypted tunnels.

AI-generated summary based on this skill's SKILL.md

★ 14 ⁮ 6 MIT updated 2026-04-20 by nodnarbnitram

Install

nodnarbnitram/claude-code-extensions/cloudflare-vpc-services · repository language: Python

Manual (git clone) CLI (skillfed)

git clone https://github.com/nodnarbnitram/claude-code-extensions
cp -r claude-code-extensions/.claude/skills/cloudflare-vpc-services ~/.claude/skills/cloudflare-vpc-services

npx skillfed install nodnarbnitram/claude-code-extensions/cloudflare-vpc-services

Frequently asked questions

AI-generated answers based on this skill's SKILL.md and metadata

How do I set up Cloudflare VPC Services to securely route Workers to private APIs?

Cloudflare VPC Services enables Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. Start by creating a VPC service in the Cloudflare dashboard, then configure a cloudflared tunnel to bridge your private network. In wrangler.toml, bind the VPC service to your Worker using the service ID. Finally, use fetch() with the correct internal URL format—absolute URLs pointing to your private endpoint—to route requests through the encrypted tunnel instead of the public internet.

What causes dns_error and connection issues with VPC service bindings?

Cloudflare VPC Services dns_error typically stems from incorrect URL formatting, mismatched service IDs, or firewall rules blocking UDP port 7844 (required for QUIC protocol). Verify that your fetch() call uses an absolute URL matching your VPC service configuration, that the service binding environment variable is correctly declared in wrangler.toml, and that your private network allows outbound traffic on port 7844. Port mismatch errors also occur when the internal service listens on a different port than your VPC binding expects.

How do I configure cloudflared tunnels and QUIC protocol for Workers VPC access?

Cloudflare VPC Services relies on cloudflared tunnels to establish encrypted connections. Install cloudflared (version 2025.7.0 or later for full QUIC support), then authenticate and create a tunnel pointing to your private network's gateway. Enable QUIC protocol in your tunnel configuration for optimal performance. The tunnel handles UDP 7844 traffic automatically; ensure your firewall permits this port bidirectionally. Once the tunnel is active, Workers can route requests through it by referencing the VPC service binding.

What are the correct fetch() patterns and URL formatting for internal services?

Cloudflare VPC Services requires absolute URLs in fetch() calls—never relative paths. Format your URL as https://your-internal-hostname:port/path, matching exactly what your VPC service binding specifies. The hostname must resolve within your private network, and the port must align with your internal service's listening port. Avoid hardcoding IPs; use hostnames for better maintainability. Requests formatted incorrectly may leak to public endpoints or trigger dns_error, so validate your URL structure against your VPC service configuration.

How do I access private APIs from Cloudflare Workers using VPC services?

Cloudflare VPC Services lets Workers access private APIs by combining three components: a cloudflared tunnel bridging your private network, a VPC service binding in your Worker, and correctly formatted fetch() calls. First, deploy a cloudflared tunnel from your private network to Cloudflare. Next, create a VPC service in the dashboard linking to that tunnel. Finally, bind the service in wrangler.toml and call fetch() with the internal service's absolute URL. This routes traffic securely without exposing your private APIs to the public internet.

How do I migrate existing Workers to use VPC bindings for on-premise networks?

Cloudflare VPC Services migration involves updating your wrangler.toml to add VPC service bindings, then refactoring fetch() calls to use internal URLs instead of public endpoints. First, establish a cloudflared tunnel from your on-premise network to Cloudflare. Create a VPC service pointing to that tunnel. Add the binding to wrangler.toml with the service ID. Finally, update your Worker code to replace public API URLs with internal hostnames and ports. Test thoroughly to ensure requests route correctly and no traffic leaks to public endpoints.

SKILL.md

rendered from the published skill — quoted content, verbatim