cloudflare / cloudflare/cloudflared

🐛IPv4-only VPC egress connector receives IPv6 destinations without IPv4 fallback

Closed
#1,738 0 comments 0 reactions 0 assignees View on GitHub
Priority: Normal Type: Bug
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

## Description

I am using Cloudflare Workers VPC egress with a `cloudflared` connector
running on a Google Cloud Compute Engine VM that has IPv4-only networking.

The VM has:

- IPv4 address and default IPv4 route
- No IPv6 address
- No IPv6 default route
- Working IPv4 internet connectivity

However, when Cloudflare Workers sends outbound HTTPS requests through the
VPC egress connector, `cloudflared` receives IPv6 destination addresses.

The connector then tries to connect to those IPv6 addresses and fails with:

```text
originService=warp-routing
destAddr=[IPv6 address]:443
connect: network is unreachable

```
This causes requests from the Worker to fail, including requests to:
- auth.openai.com
- chatgpt.com
The same behavior occurs when using another IPv4-only machine, so this does
not appear to be specific to one GCP VM.
Expected behavior
An IPv4-only VPC egress connector should either:
1. Receive IPv4 destination addresses; or
2. Automatically fall back to IPv4 when the origin connector has no IPv6 route.
An IPv4-only connector should not be unusable merely because the destination
hostname has an AAAA record.
Environment
- Google Cloud Compute Engine
- IPv4-only VPC/subnet
- Cloudflare Workers VPC egress
- cloudflared version: 2026.9.1
- WARP routing enabled
- Connector transport: QUIC
Evidence
IPv4 access from the VM works:
auth.openai.com over IPv4: reachable
chatgpt.com over IPv4: reachable
IPv6 access from the VM fails as expected because the VM has no IPv6 route:
connect: network is unreachable
Relevant cloudflared log:
ERR error="unable to dial tcp to origin [IPv6 address]:443:
dial tcp [IPv6 address]:443: connect: network is unreachable"
originService=warp-routing
Questions
1. Is IPv4-only connectivity supported for Workers VPC egress?
2. Is there a configuration option to force IPv4 or enable IPv4 fallback?
3. Why does WARP routing send IPv6 destinations to an IPv4-only connector?
4. Is this expected behavior or a known issue?

Contributor guide

Open the contributing guide

Research direction

Start by tracing the cloudflared WARP routing path identified by originService=warp-routing and reproduce the IPv6 dial failure on an IPv4-only connector using the listed Workers VPC egress setup. Compare destination selection for auth.openai.com and chatgpt.com with the VM’s IPv4-only connectivity. Done means IPv4-only connectors receive IPv4 destinations or reliably fall back to IPv4 when IPv6 is unreachable.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.