Skip to content

Document private application matching precedence #33569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kennyj42 wants to merge 2 commits into
base: production
Choose a base branch
from
Open

Document private application matching precedence #33569

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
24e61e4
Document private application matching precedence
kennyj42 Sep 21, 2026
2a478e6
Add virtual network matching example
kennyj42 Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions ...loudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,23 @@ Users must pass the policies in your Access application before they are granted

An Access application defined by a private hostname takes precedence over an Access application defined by a private IP. For example, assume App-1 points to `wiki.internal.local` and App-2 points to `10.0.0.1`, but `wiki.internal.local` resolves to `10.0.0.1`. Users who go to `wiki.internal.local` will never match App-2; they will be allowed or blocked strictly based on App-1 Access policies (and [Gateway policies](#access-vs-gateway-policies)).

### Overlapping private application destinations

When a request matches destinations in multiple self-hosted private applications, Access selects the application with the most specific matching destination. The application creation order and the order shown in the dashboard do not affect which application is selected.

Access compares destination attributes in the following order:

1. **Hostname or IP specificity:** A matching private hostname takes precedence over any private IP or CIDR. Between matching hostnames, a hostname with more labels takes precedence. For hostnames with the same number of labels, exact labels take precedence over wildcard labels, and partial wildcards take precedence over a full `*` label. Between matching IPs and CIDRs, the destination with fewer IP addresses takes precedence. An exact IPv4 or IPv6 address is the most specific IP destination.
2. **Port specificity:** For otherwise equal destinations, a single port takes precedence over a port range. A smaller port range takes precedence over a larger range, and any port restriction takes precedence over a destination that applies to all ports.
3. **Virtual network specificity:** A destination restricted to a virtual network takes precedence over an otherwise equal destination that applies to all virtual networks. For example, assume App-1 matches `10.0.0.0/24` on all virtual networks and App-2 matches the same CIDR only on the `staging` virtual network. A user connected to `staging` matches App-2, while a user connected to a different virtual network matches App-1.
4. **Protocol specificity:** A destination restricted to TCP or UDP takes precedence over an otherwise equal destination that applies to both protocols.

Destination specificity is evaluated before port specificity. For example, `10.0.1.0/24` on all ports takes precedence over `10.0.0.0/16` on a single port. Access evaluates policies only for the application selected by this matching order.

:::note
This matching order applies to destinations configured on **Self-hosted and private** applications. It does not apply to [legacy private network applications](/cloudflare-one/access-controls/applications/non-http/legacy-private-network-app/).
:::

## Limitations

### Browser Isolation is not compatible with apps on non-`443` ports
Expand Down
Loading