cloudflare / cloudflare/cloudflared
🐛IPv4-only VPC egress connector receives IPv6 destinations without IPv4 fallback
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
## Description
I am using Cloudflare Workers VPC egress with a `cloudflared` connector
running on a Google Cloud Compute Engine VM that has IPv4-only networking.
The VM has:
- IPv4 address and default IPv4 route
- No IPv6 address
- No IPv6 default route
- Working IPv4 internet connectivity
However, when Cloudflare Workers sends outbound HTTPS requests through the
VPC egress connector, `cloudflared` receives IPv6 destination addresses.
The connector then tries to connect to those IPv6 addresses and fails with:
```text
originService=warp-routing
destAddr=[IPv6 address]:443
connect: network is unreachable
```
This causes requests from the Worker to fail, including requests to:
- auth.openai.com
- chatgpt.com
The same behavior occurs when using another IPv4-only machine, so this does
not appear to be specific to one GCP VM.
Expected behavior
An IPv4-only VPC egress connector should either:
1. Receive IPv4 destination addresses; or
2. Automatically fall back to IPv4 when the origin connector has no IPv6 route.
An IPv4-only connector should not be unusable merely because the destination
hostname has an AAAA record.
Environment
- Google Cloud Compute Engine
- IPv4-only VPC/subnet
- Cloudflare Workers VPC egress
- cloudflared version: 2026.9.1
- WARP routing enabled
- Connector transport: QUIC
Evidence
IPv4 access from the VM works:
auth.openai.com over IPv4: reachable
chatgpt.com over IPv4: reachable
IPv6 access from the VM fails as expected because the VM has no IPv6 route:
connect: network is unreachable
Relevant cloudflared log:
ERR error="unable to dial tcp to origin [IPv6 address]:443:
dial tcp [IPv6 address]:443: connect: network is unreachable"
originService=warp-routing
Questions
1. Is IPv4-only connectivity supported for Workers VPC egress?
2. Is there a configuration option to force IPv4 or enable IPv4 fallback?
3. Why does WARP routing send IPv6 destinations to an IPv4-only connector?
4. Is this expected behavior or a known issue?
Contributor guide
Research direction
Start by tracing the cloudflared WARP routing path identified by originService=warp-routing and reproduce the IPv6 dial failure on an IPv4-only connector using the listed Workers VPC egress setup. Compare destination selection for auth.openai.com and chatgpt.com with the VM’s IPv4-only connectivity. Done means IPv4-only connectors receive IPv4 destinations or reliably fall back to IPv4 when IPv6 is unreachable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100