Skip to content

SolutionsCloudflare network services

Keep your network online under attack.

We put Cloudflare Magic Transit in front of your IP ranges, so DDoS attacks are dropped at Cloudflare's edge and only clean traffic reaches you. Then Cloudflare WAN replaces MPLS, one site at a time.

Book a network reviewSee how it works
Cloudflare Magic Transit

Definition

What is Cloudflare Magic Transit?

Magic Transit is Cloudflare's DDoS protection for whole networks. Cloudflare announces your IP prefixes over BGP, so traffic reaches its edge first; attacks are dropped there and clean traffic returns to you through tunnels.

Bank of Cyprus · Cloudflare case study

Average automatic mitigation time
~5 seconds
Onboarding
Two weeks
Large-scale attacks blocked, no manual intervention
3 months

“The peace of mind is priceless, and our experience with Cloudflare and Parsectix has contributed significantly to achieving that.”

Stelios ParpasManager Security Operations Center, Bank of Cyprus
Read the case study

Phase 1 · Protect

How does Magic Transit stop an attack?

Attacks are absorbed at Cloudflare's edge. Only clean traffic, filtered by a policy your team reviews, travels home.

DDoS protection

Attacks stop at the edge.

Cloudflare detects and drops attack traffic automatically. Your team sees the event; nobody has to act on it.

Cloudflare DDoS protectionIllustrative event

Severity: high

UDP flood toward 203.0.113.0/24

ResourcePrefix 203.0.113.0/24 · data centre 1

  1. 14:02Attack traffic detected at Cloudflare's edge
  2. 14:02Mitigation rule applied automatically
  3. 14:02Clean traffic continues over the tunnel
  4. 14:47Attack ends, event forwarded to your SIEM

ResolvedMitigated at the edge, no manual change.

Cloudflare Network Firewall

Firewall policy as reviewed code.

Rules for every prefix and site live in Terraform: reviewed, tested and reversible.

cloudflare/network-firewall.tfTerraform · HCL+1−1
resource "cloudflare_ruleset" "network_firewall" {  kind  = "root"  phase = "magic_transit"  rules = [{    action     = "block"Removed:     expression = "tcp.dstport == 22"Added:     expression = "tcp.dstport == 22 and not ip.src in $admins"reviewed  }]}
Policy checktest · admins reach port 22FAIL · 1 failed→PASS · 0 failed
Tunnels and health checks

Clean traffic, home over tunnels.

GRE or IPsec tunnels to each site, with health checks that steer traffic off a failing link.

terraform plan+ cloudflare_magic_wan_gre_tunnel.dc1_primary+ cloudflare_magic_wan_gre_tunnel.dc1_backup+ cloudflare_magic_wan_static_route.dc1_primary+ cloudflare_magic_wan_static_route.dc1_backupPlan: 4 to add, 0 to change, 0 to destroy.# after apply: tunnel health checksPASSdc1_primary  healthyPASSdc1_backup   healthy

Phase 2 · Modernise

Why replace MPLS with Cloudflare WAN?

Once the network is protected, the same edge can connect your sites. Cloudflare WAN, formerly Magic WAN, replaces MPLS one site at a time.

How your sites connect

MPLS today

  • Branch traffic backhauled through the data centreHub and spoke
  • A firewall appliance to run at every sitePer site
  • Each new site waits on a circuitProvisioning
  • Policy configured box by boxPer device

Cloudflare WAN

  • Sites connect to the nearest Cloudflare data centreAnycast
  • One Network Firewall policy for every siteOne policy
  • Internet links, IPsec tunnels or a direct interconnectAny link
  • Policy changes as reviewed codeTerraform

How the work runs

How does the move happen?

Protect first, then modernise. Each step runs alongside your current network until it is proven.

  1. Step 01

    Assess.

    Your prefixes, BGP sessions, sites and circuits, mapped.

  2. Step 02

    Protect.

    Magic Transit and Network Firewall go live in front of your data centres.

  3. Step 03

    Connect.

    Sites move to Cloudflare WAN one by one, MPLS running alongside.

  4. Step 04

    Operate.

    Policy changes and tuning, managed with your team.

FAQ

Common questions.

A WAF protects websites and APIs at layer 7. Magic Transit protects whole IP networks at layers 3 and 4, including services that are not web traffic.

Magic Transit announces prefixes of /24 or larger. If you do not have one, Cloudflare can protect your network with Cloudflare-owned IP addresses.

Cloudflare states that Magic Transit usually mitigates attacks within three seconds; service levels are Cloudflare's, set out in your Cloudflare agreement. In Cloudflare's Bank of Cyprus case study, the average automatic mitigation time is ~5 seconds.

Yes. In 2026 Cloudflare renamed Magic WAN to Cloudflare WAN and Magic Firewall to Cloudflare Network Firewall. The services and your configuration are unchanged.

Next step

Protect the network first.

Bring your prefixes and sites. We show you where Magic Transit would sit in front of them.

Book a network review