Initial resolved IPs (also called token IPs) are ephemeral addresses that Gateway assigns to DNS queries so it can associate hostname-based traffic with the correct policy or tunnel at the network layer, where hostname information is not usually available. Refer to Gateway initial resolved IPs for a list of features that depend on this range.
By default, initial resolved IPs are assigned from:
- IPv4:
172.64.128.0/20 - IPv6:
2606:4700:0cf1:4000::/64
This is the default range. You can configure a custom initial resolved IP range for IPv4 if it conflicts with your existing network.
The IPv6 range is not configurable.
- You have the Cloudflare One Networks Write permission (for API access), or dashboard access to Networking > IP addresses > Address space > Custom IPs.
- Your new range does not conflict with existing routes or other reserved Cloudflare One subnets in your account.
-
Go to Networking > IP addresses > Address space > Custom IPs.
Go to Custom IPs ↗ -
Find the row where Assign to is Initial Resolved IP to see your account's current IPv4 range in the Prefix column.
Send a GET request to the Get Initial Resolved IP Subnet endpoint for the address family you want to check:
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/zerotrust/subnets/initial_resolved_ip/$ADDRESS_FAMILY" \
--request GET \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"-
Go to Networking > IP addresses > Address space > Custom IPs.
Go to Custom IPs ↗ -
Find the row where Assign to is Initial Resolved IP, select the three dots menu, and select Edit.
-
Enter your new IPv4 range in IP address.
-
Select Save.
Send a PUT request to the Update Initial Resolved IP Subnet endpoint with your desired network range:
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/zerotrust/subnets/initial_resolved_ip/$ADDRESS_FAMILY" \
--request PUT \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"comment": "example comment",
"name": "IPv4 Gateway initial resolved IPs",
"network": "172.64.128.0/20"
}'The new CIDR must not conflict with existing private routes or other reserved subnets in your account. If it does, the request fails and the response describes the conflicting route or subnet.
The default IPv4 range is automatically routed through the Cloudflare One Client and does not require any Split Tunnel configuration. If you configure a custom range, update your Split Tunnel configuration so that traffic to the new range routes through the Cloudflare One Client, and remove the old range if it is no longer used by any other reserved IP purpose.
Initial resolved IPs have a TTL of approximately 10 minutes. DNS queries resolved before you change your range continue to use the previous range until that TTL expires. After that, new DNS queries receive an initial resolved IP from the new range.