Cloudflare Tunnel: 50,000 routes and Tunnels for Platforms

Cloudflare announced two changes to Cloudflare Tunnel on 16 October 2026. First, the default limit for routes went up from 1,000 to 50,000 per account. That limit covers CIDR routes and hostname routes for private network traffic, and Cloudflare Tunnel and Cloudflare Mesh share it. Every account got the new limit automatically. Second, Tunnels for Platforms lets one account run more than its 1,000 included tunnels. Each extra tunnel costs $4.50 a month, and Enterprise customers can arrange committed or usage-based pricing.

If you connect private networks and kept hitting the old route ceiling, you don’t need to do anything. If you build a platform that gives every customer, device or preview environment its own tunnel, you can now keep the whole fleet in one account. You buy capacity from the dashboard, and the cloudflared daemon, the API and the dashboard all work the same way they did before.

What Tunnels for Platforms is

A Cloudflare Tunnel connects your servers to Cloudflare without giving them a publicly routable IP address. A small daemon called cloudflared runs in your infrastructure and opens outbound-only connections to Cloudflare’s network. Traffic then reaches your services through those connections. Each tunnel is a persistent object in your Cloudflare account, and one or more cloudflared replicas connect to it.

Tunnels for Platforms is a paid subscription that raises the number of tunnels a single account can hold. Without it, an account can have 1,000 tunnels. With it, the limit is 1,000 plus however many extra tunnels you buy. It adds nothing new to the tunnels themselves. They run the same daemon and use the same API. What it gives you is the ability to have one tunnel for every customer, device or environment without spreading them across several Cloudflare accounts.

The route limit is a separate thing. A route tells Cloudflare which tunnel should carry private network traffic for an IP range or a private hostname. The 50,000 figure caps how many of those an account can hold, and it is the default for every account.

What Cloudflare changed on 16 October 2026

50,000

routes per account by default

Up from 1,000. CIDR and hostname routes, shared by Tunnel and Mesh.

1,000

tunnels included in every account

Included at no cost. Tunnels for Platforms adds more.

$4.50

per additional tunnel per month

Cloudflare's list price for tunnels beyond the first 1,000.

The Cloudflare changelog post lists four products: Cloudflare Tunnel, Cloudflare Tunnel for SASE, Cloudflare Mesh and Cloudflare One. Cloudflare updated the account limits page, the routing page and the new Tunnels for Platforms page on the same day.

Routes per account (CIDR plus hostname)

routes

Before

1,000

From 16 October 2026

50,000

Routes, published applications and tunnels have separate limits

Most of the confusion around this announcement comes from three different limits that people group under one word. Find out which one you’re actually hitting before you change anything.

Routes: private network traffic, 50,000 per account

A route sends private network traffic to a tunnel. A CIDR route such as 172.16.0.0/16 sends traffic for that IP range down a given tunnel. A hostname route does the same thing for a private hostname. This is the limit that went from 1,000 to 50,000. One budget covers the whole account, and Cloudflare Tunnel and Cloudflare Mesh draw from it together.

Published applications: bounded by a 1 MB configuration per tunnel

A published application maps a public hostname, such as app.example.com, to a local service, such as http://localhost:8080. Cloudflare’s docs say plainly that published applications are a different thing from routes, and they don’t count toward the route limit. Their limit is set per tunnel by configuration size. A remotely managed tunnel’s configuration can be up to 1 MB. Each published application adds one ingress rule, and a typical rule takes 100 to 200 bytes. That works out to roughly 5,000 to 10,000 published applications per tunnel. Long hostnames, paths and many origin parameters make each rule bigger, so the tunnel holds fewer of them.

Tunnels: 1,000 included, more with Tunnels for Platforms

Every account includes 1,000 tunnels at no cost. Tunnels for Platforms changes only this number. The other Tunnel limits stay as they were: 1,000 virtual networks per account, 25 active cloudflared replicas per tunnel, and the configuration size cap for published applications. Mesh keeps its own limit of 50 Mesh nodes per account.

graph TB A[What are you adding?] --> B{Public hostnames on a tunnel?} B -->|yes| C[Per tunnel 1 MB config limit] C --> D[Spread apps across more tunnels] B -->|no| E{Private CIDR or hostname routes?} E -->|yes| F[Account limit now 50,000 routes] E -->|no| G{More than 1,000 tunnels?} G -->|yes| H[Buy Tunnels for Platforms capacity] G -->|no| I[Included, nothing to buy] style F fill:#d1fae5,stroke:#6ee7b7,color:#065f46 style H fill:#d1fae5,stroke:#6ee7b7,color:#065f46

These limits interact. If you need to publish more applications than one tunnel’s configuration holds, the docs say to distribute them across multiple tunnels. That uses up your tunnel count, which brings you back to Tunnels for Platforms once you pass 1,000.

Who Tunnels for Platforms is built for

Cloudflare describes the product for teams that create one tunnel per device, per end customer or per environment. It names four groups:

• SaaS providers that give each end customer a tunnel to reach systems in that customer’s private network or on-premises environment.
• IoT and device makers that give each deployed camera, router, sensor or industrial controller its own tunnel.
• Developer tools and ephemeral environments that create short-lived tunnels for local development, CI/CD pipelines and preview environments.
• AI and agent platforms that connect each customer’s AI agents and MCP servers to private resources through that customer’s own tunnel.

Before this change, a fleet that grew past 1,000 tunnels had to be split across several Cloudflare accounts. The Tunnels for Platforms page names that as the problem it removes: you add capacity as the fleet grows and keep it in one account. Nothing changes for tunnels you already run. The docs state that no changes to your tunnels or cloudflared deployments are required.

Checking how close your account is to each limit

Start by finding out which limit you’re closest to.

1. Open the Cloudflare dashboard and go to Networking > Tunnels. The Usage card shows your tunnel limit. This is also where the purchase button lives.
2. Count your private network routes. Routes live under the account’s teamnet/routes endpoint, the same one you POST to when you create a route. A GET on it lists them:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes" \
  --request GET \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

3. For each tunnel that serves many public hostnames, check the size of its configuration. If you’re adding hostnames one tunnel at a time and getting close to thousands per tunnel, plan to split them before you reach the 1 MB cap.
4. If you also run Cloudflare Mesh, add its CIDR and hostname routes to your count. Tunnel and Mesh share the 50,000 budget.

Buying tunnels beyond the first 1,000

The purchase happens in the dashboard:

1. Go to Networking > Tunnels.
2. In the Usage card, select Buy more tunnels.
3. Enter the number of additional tunnels you need.
4. Review the order summary and payment method, then select Activate.

The new limit shows up in the Usage card within a few minutes. Your limit equals 1,000 plus the number of tunnels you bought. Enterprise customers who want committed capacity or usage-based billing should go through their account team.

You can work out the monthly bill before you buy. Every tunnel that exists in the account counts, including inactive tunnels:

TUNNELS=2500      # tunnels you expect to exist, active or not
INCLUDED=1000     # included in every account
EXTRA=$(( TUNNELS > INCLUDED ? TUNNELS - INCLUDED : 0 ))
echo "Additional tunnels: $EXTRA"
echo "Monthly cost (USD): $(echo "$EXTRA * 4.50" | bc)"

Changing or cancelling the subscription

Go to Manage Account > Billing > Subscriptions and find Tunnels for Platforms. You can raise or lower the number of extra tunnels, or cancel, at any time. Changing the number never deletes a tunnel. If the new limit is below the number of tunnels you have, existing tunnels keep working. Cloudflare blocks new tunnel creation until you delete enough tunnels or buy more capacity.

Creating one tunnel per customer through the API

No one creates thousands of tunnels by clicking. The docs recommend running the tunnel lifecycle through the Cloudflare API or Terraform. Here’s the API flow for one customer’s tunnel, using a remotely managed tunnel.

1. Create an API token with Account > Cloudflare Tunnel > Edit, plus Zone > DNS > Edit if you’ll publish hostnames.
2. Create the tunnel with a deterministic name. Cloudflare suggests a pattern like tunnel-<CUSTOMER_ID>-<REGION>:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "name": "tunnel-cust4821-eu",
    "config_src": "cloudflare"
  }'

The response contains an id and a token. Store both against the customer record.

3. Attach what the tunnel reaches. For a customer’s private network, add a route. This uses one of your 50,000 routes:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "network": "172.16.0.0/16",
    "tunnel_id": "'"$TUNNEL_ID"'",
    "comment": "cust4821 private network"
  }'

For a public hostname, PUT an ingress configuration to cfd_tunnel/$TUNNEL_ID/configurations that ends with a catch-all rule such as http_status:404, then create a proxied CNAME pointing to <TUNNEL_ID>.cfargotunnel.com.

4. Run cloudflared at the customer’s site with the token:

docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token "$TUNNEL_TOKEN"

5. Verify it with a GET on cfd_tunnel/$TUNNEL_ID. Cloudflare’s guide says a healthy tunnel shows four connections to its network and "status": "healthy".

graph TB A[New customer or device] --> B{Tunnel with this name exists?} B -->|yes| C[Reuse the existing tunnel] B -->|no| D[Create tunnel through the API] C --> E[Run cloudflared with the token] D --> E E --> F[Reconcile against your records] F --> G{Owner still exists?} G -->|yes| F G -->|no| H[Delete tunnel to free capacity] style H fill:#d1fae5,stroke:#6ee7b7,color:#065f46

Creating a tunnel takes a few seconds. If customers expect a tunnel the moment they sign up, Cloudflare suggests keeping a pool of tunnels created ahead of time and refilling it in the background. Pool tunnels count toward your limit and your bill like any other tunnel, so size the pool with that in mind.

What happens when the account hits its tunnel limit

The limit only applies when you create a tunnel. When the account reaches it, existing tunnels and their connections carry on as normal. Requests to create a new tunnel fail until you delete one or raise the limit. That makes the failure easy to miss: production traffic looks fine while onboarding quietly breaks for the next customer or device. Handle a failed create in your provisioning code as a capacity problem that someone needs to know about, and alert on it the same way you’d alert on a failed deploy.

Mistakes that cost money or break onboarding at fleet scale

Paying for tunnels nobody uses. Every tunnel in the account counts toward the limit and the bill, including tunnels with no connected replicas. Stopping cloudflared doesn’t delete a tunnel. The fix is a reconcile job: compare the tunnels in the account with your own records, and delete any tunnel whose device, customer or environment is gone. The tunnel connections API shows which tunnels have no active connections:

curl -s "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  | jq '.result | {name, status, connections: (.connections | length)}'

Ephemeral environments leak tunnels fastest. Tie deletion to the same pipeline step that tears down the preview environment.

Duplicate tunnels from retries. A create request can time out after Cloudflare has already made the tunnel. If you retry blindly, you end up with two. Use unique, deterministic names, and check whether a tunnel with that name already exists before you retry.

Bursting the API. Bulk provisioning hits the Cloudflare API rate limits. Retry 429 and 5xx responses with exponential backoff and random jitter. Queue create and delete operations and send them at a steady rate.

One replica per tunnel in production. Cloudflare recommends at least two cloudflared replicas per tunnel for high availability. The cap is 25 active replicas per tunnel. Keep in mind that a load balancer treats all replicas of one tunnel UUID as a single endpoint. If you need traffic steering or session affinity across hosts, give each host its own tunnel, which also adds to your tunnel count.

Counting published applications as routes. Teams that publish thousands of public hostnames sometimes read this announcement as their fix. Public hostnames were never part of the route limit. Their ceiling is the 1 MB configuration per tunnel, and the fix is more tunnels.

Forgetting that Mesh shares the route budget. If you run Cloudflare Tunnel and Cloudflare Mesh in the same account, both use the same 50,000 routes. Plan route growth for both together.

Leaving DNS records pointing at stopped tunnels. If a tunnel stops, its DNS record is not deleted, and visitors see a 1016 error. When you remove a customer’s tunnel, remove its records too.

Watching a Cloudflare tunnel fleet with Polylane

Polylane detects production issues and fixes them by opening pull requests. It connects to Cloudflare, so when a Worker behind a tunnel breaks, it works out why, and the fix arrives ready for your team’s normal review.

Running on Cloudflare? See how Polylane monitors Cloudflare in production.