Cloudflare Adds Source-Subnet Traffic Steering: Recheck Proxy Egress and Breakout Rules

Cloudflare announced on September 2, 2026 that Cloudflare One Appliance operators can define custom applications for breakout and prioritized traffic directly in the dashboard. A custom application can be matched by hostname, destination IP subnet and the newly added source-subnet field. Existing applications can also be edited or removed from the same interface, while API and Terraform workflows remain available.

For teams running authorized web scraping, data collection, market research, ad verification or regional proxy testing, source-subnet matching is operationally important. It can separate traffic from different worker pools even when they reach the same destination. It can also create a silent direct path around an explicit proxy if rule scope, DNS behavior or precedence is misunderstood.

The update is a configuration convenience, not evidence that a workload used its intended exit. After any rule change, verify the complete route from worker to destination.

What changed

Cloudflare's update adds three practical dashboard capabilities:

• define a custom application using hostnames, destination IP subnets and/or source subnets;
• assign that application to breakout or prioritized traffic;
• edit or remove existing application definitions without an API round trip.

Source-subnet matching complements the prior ability to base breakout criteria on the source LAN interface. This is useful when several logical worker pools share an interface but must follow different routing policies.

The change does not modify residential proxy products or guarantee a public exit location. It changes how an enterprise network can classify and steer traffic before it reaches an upstream proxy gateway or the public Internet.

Why proxy teams should care

A data-collection worker can have several possible egress paths:

1. application to an explicit HTTP or SOCKS proxy;
2. application to an enterprise inspection layer, then to a commercial proxy;
3. direct Internet breakout from the local appliance;
4. private transit to another region before proxy egress;
5. an unintended bypass caused by a hostname, subnet or source match.

If a new source-subnet rule sends a worker pool to breakout traffic, an application-level proxy setting may still be used—or it may be bypassed by system routing, a PAC decision, a service mesh or a fallback path. The observable result must decide, not the intended diagram.

Inventory source identities before editing rules

Build a table for every authorized worker group:

worker_pool_alias
source_subnet
source_interface
workload_purpose
approved_destinations
required_proxy_gateway
allowed_breakout
required_region
address_family
policy_owner
policy_version

Use aliases rather than hostnames that expose customers, users or internal projects. Do not place proxy credentials, cookies, tokens or personal data in network-policy notes.

Confirm that dynamic worker platforms do not reuse source subnets across unrelated trust levels. A source subnet is only a useful policy boundary when its membership is controlled and observable.

Test rule precedence explicitly

One flow may match a hostname rule, a destination subnet rule and a source-subnet rule at the same time. Document which rule should win and prove it with an authorized canary.

Create a test matrix with:

Include overlapping hostname and IP rules, IPv4 and IPv6 destinations, and a request whose DNS answer changes during the test window.

Recheck DNS-dependent behavior

Cloudflare's breakout documentation notes that DNS caching can delay application recognition until cached entries expire and a client issues a new DNS request visible to the appliance. This means a dashboard rule can be correct while an existing worker continues on an older path.

Record resolver identity, cache state, A and AAAA answers, policy activation time and the first request that uses the new decision. Do not clear shared production DNS caches simply to accelerate a test. Use a controlled worker or wait for the documented cache lifecycle.

Test hostname behavior separately from literal IP destinations. A hostname policy may not cover an application that resolves early and connects to an address through a different layer.

Prove the proxy path end to end

Use a controlled destination and safe markers. For every test request, record:

operation_id
worker_pool_alias
source_subnet_alias
destination_alias
resolved_address_family
appliance_policy_version
selected_action
proxy_gateway_alias
observed_exit_region
direct_path_detected
accepted_outcome

A successful HTTP response is not enough. The pass condition must include the intended gateway, an allowed exit region, the expected destination response and no direct fallback.

Where possible, block direct egress in the test environment. A failure is safer and easier to diagnose than a transparent path that silently sends traffic outside the approved proxy.

Separate priority from permission

Prioritized traffic receives scheduling preference; it does not gain new authorization to access a destination. Likewise, breakout traffic describes a network path, not permission to bypass destination terms, authentication, robots guidance, rate limits or privacy requirements.

Keep application authorization and network classification as separate controls. A source subnet should never become a blanket approval for every process that happens to run inside it.

Roll out with a bounded canary

Apply the new custom application to a small, named worker pool first. Use one policy version, a fixed destination set, no unrelated proxy changes and a strict rollback condition.

Measure:

• percentage of requests using the required proxy gateway;
• direct-path detections;
• requested-to-observed region match;
• proxy authentication and tunnel success;
• DNS cache transition time;
• p50 and p95 connection time;
• first-attempt accepted-outcome rate;
• retry volume and cost per accepted result.

Expand only after both IPv4 and IPv6 paths pass. If a rule unexpectedly changes egress, stop the affected pool rather than rotating exits or increasing retries.

Validation checklist

• [ ] Every source subnet has an owner and workload purpose.
• [ ] Worker membership cannot cross trust boundaries silently.
• [ ] Hostname, destination-subnet and source-subnet precedence is documented.
• [ ] Explicit proxy, private path and breakout expectations are distinct.
• [ ] DNS cache behavior is included in the change window.
• [ ] A and AAAA destinations are tested separately.
• [ ] Direct egress is blocked or detected.
• [ ] Proxy gateway and observed exit are verified independently.
• [ ] Sticky sessions are restarted when routing identity changes.
• [ ] Retry budgets cannot hide a wrong route.
• [ ] Logs use aliases and contain no credentials or cookies.
• [ ] Policy version and rollback criteria are recorded.

Related 98IP guidance covers NO_PROXY routing tests, SOCKS5 remote DNS verification, and multi-region proxy routing acceptance.

FAQ

Does source-subnet steering replace application proxy settings?

No. It operates at a different network layer. Test their interaction because an application, operating system, PAC file, mesh or appliance can make separate decisions.

Will a new hostname rule affect existing connections immediately?

Not necessarily. DNS caches and established connections can preserve earlier decisions. Test a fresh controlled flow and document transition behavior.

Can breakout traffic be treated as proxy failover?

Only when direct egress is explicitly approved and validated. For workloads that require a proxy, direct breakout should normally fail closed rather than act as an invisible backup.

Should 407 or 429 responses change the appliance rule?

Not automatically. A 407 points to proxy authentication or configuration. A 429 is a destination pacing signal. Diagnose the layer before changing routing.

Compliance note

Use traffic steering and proxy infrastructure only for authorized systems and lawful workloads. Respect destination terms, access controls, rate limits, privacy obligations and regional data rules. Do not use source-subnet policies, breakout paths or proxy rotation to evade controls. Minimize logs and protect network topology as sensitive operational data.

Source note: Cloudflare, “Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard,” published September 2, 2026.