From 24e61e45d9195daa04cb02f766aaa36564019abf Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Mon, 21 Sep 2026 11:14:51 -0500 Subject: [PATCH 1/2] Document private application matching precedence --- .../non-http/self-hosted-private-app.mdx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx index 28932bb6e22..087db408e23 100644 --- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx +++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx @@ -149,6 +149,23 @@ Users must pass the policies in your Access application before they are granted An Access application defined by a private hostname takes precedence over an Access application defined by a private IP. For example, assume App-1 points to `wiki.internal.local` and App-2 points to `10.0.0.1`, but `wiki.internal.local` resolves to `10.0.0.1`. Users who go to `wiki.internal.local` will never match App-2; they will be allowed or blocked strictly based on App-1 Access policies (and [Gateway policies](#access-vs-gateway-policies)). +### Overlapping private application destinations + +When a request matches destinations in multiple self-hosted private applications, Access selects the application with the most specific matching destination. The application creation order and the order shown in the dashboard do not affect which application is selected. + +Access compares destination attributes in the following order: + +1. **Hostname or IP specificity:** A matching private hostname takes precedence over any private IP or CIDR. Between matching hostnames, a hostname with more labels takes precedence. For hostnames with the same number of labels, exact labels take precedence over wildcard labels, and partial wildcards take precedence over a full `*` label. Between matching IPs and CIDRs, the destination with fewer IP addresses takes precedence. An exact IPv4 or IPv6 address is the most specific IP destination. +2. **Port specificity:** For otherwise equal destinations, a single port takes precedence over a port range. A smaller port range takes precedence over a larger range, and any port restriction takes precedence over a destination that applies to all ports. +3. **Virtual network specificity:** A destination restricted to a virtual network takes precedence over an otherwise equal destination that applies to all virtual networks. +4. **Protocol specificity:** A destination restricted to TCP or UDP takes precedence over an otherwise equal destination that applies to both protocols. + +Destination specificity is evaluated before port specificity. For example, `10.0.1.0/24` on all ports takes precedence over `10.0.0.0/16` on a single port. Access evaluates policies only for the application selected by this matching order. + +:::note +This matching order applies to destinations configured on **Self-hosted and private** applications. It does not apply to [legacy private network applications](/cloudflare-one/access-controls/applications/non-http/legacy-private-network-app/). +::: + ## Limitations ### Browser Isolation is not compatible with apps on non-`443` ports From 2a478e67be7dcc01fa919c088afab550705013f2 Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Mon, 21 Sep 2026 11:30:56 -0500 Subject: [PATCH 2/2] Add virtual network matching example --- .../applications/non-http/self-hosted-private-app.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx index 087db408e23..59c2bfcb175 100644 --- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx +++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx @@ -157,7 +157,7 @@ Access compares destination attributes in the following order: 1. **Hostname or IP specificity:** A matching private hostname takes precedence over any private IP or CIDR. Between matching hostnames, a hostname with more labels takes precedence. For hostnames with the same number of labels, exact labels take precedence over wildcard labels, and partial wildcards take precedence over a full `*` label. Between matching IPs and CIDRs, the destination with fewer IP addresses takes precedence. An exact IPv4 or IPv6 address is the most specific IP destination. 2. **Port specificity:** For otherwise equal destinations, a single port takes precedence over a port range. A smaller port range takes precedence over a larger range, and any port restriction takes precedence over a destination that applies to all ports. -3. **Virtual network specificity:** A destination restricted to a virtual network takes precedence over an otherwise equal destination that applies to all virtual networks. +3. **Virtual network specificity:** A destination restricted to a virtual network takes precedence over an otherwise equal destination that applies to all virtual networks. For example, assume App-1 matches `10.0.0.0/24` on all virtual networks and App-2 matches the same CIDR only on the `staging` virtual network. A user connected to `staging` matches App-2, while a user connected to a different virtual network matches App-1. 4. **Protocol specificity:** A destination restricted to TCP or UDP takes precedence over an otherwise equal destination that applies to both protocols. Destination specificity is evaluated before port specificity. For example, `10.0.1.0/24` on all ports takes precedence over `10.0.0.0/16` on a single port. Access evaluates policies only for the application selected by this matching order.