Workers VPC - TCP connections via connect() over VPC Networks

VPC Network bindings now support the connect() Socket API for raw TCP connections to private destinations, in addition to HTTP traffic via fetch().

This means Workers can now open TCP sockets to any private service reachable through the bound Cloudflare Tunnel, Cloudflare Mesh, or Cloudflare WAN on-ramp — Redis, Memcached, MQTT, custom binary protocols, or any other TCP-based service.

{
  "$schema": "./node_modules/wrangler/config-schema.json",
  "vpc_networks": [
    {
      "binding": "PRIVATE_NETWORK",
      "network_id": "cf1:network",
      "remote": true
    }
  ]
}

[[vpc_networks]]
binding = "PRIVATE_NETWORK"
network_id = "cf1:network"
remote = true

At runtime, use connect() on the binding to open a TCP socket to a private destination:

export default {
	async fetch(request: Request, env: Env) {
		// Open a TCP connection to a private Redis instance
		const socket = await env.PRIVATE_NETWORK.connect("10.0.1.50:6379");

		// Write a Redis PING command
		const writer = socket.writable.getWriter();
		await writer.write(new TextEncoder().encode("PING\r\n"));
		await writer.close();

		return new Response(socket.readable);
	},
};

Note

connect() over VPC Networks currently supports plaintext TCP only.

For more details, refer to VPC Networks and the Workers Binding API.