What is the challenge?
What protects the rest of your network — the parts that don't sit behind a web proxy?
L7 protection covers your web apps, but the rest of your network — VPN concentrators, mail servers, gaming infrastructure, voice/SIP, custom TCP services, internal data centers — is exposed directly to the internet. A volumetric L3/L4 attack against a /24 you own can take down everything in that range simultaneously: web, DNS, email, the office VPN. Most ISPs offer DDoS scrubbing as an add-on with a manual escalation flow. By the time you call, you're already down.
Architecture
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
Cloudflare's Solution
How Cloudflare solves it
- BGP-routed protection for your whole prefix. Cloudflare advertises your IP prefixes via BGP. All inbound traffic to those IPs first lands on Cloudflare's network, gets scrubbed, and the clean traffic returns to you over GRE tunnels, IPsec, direct CNI cross-connects, or private network interconnects.
- L3/L4 DDoS — always on, unmetered. SYN floods, UDP floods, amplification, reflection, GRE floods — mitigated automatically in seconds. Cloudflare has absorbed multi-terabit attacks for years; the network is built for it.
- Magic Firewall: stateful L3/L4 filtering. Apply allow/deny rules to your entire network from a single policy: drop traffic from specific countries, block ports, allow only known partners. Programmable via dashboard or API.
- Anycast scrubbing at every PoP. Unlike scrubbing centers in a few regions, Cloudflare scrubs at every one of 330+ locations. Attacks are dropped close to their source, not after they've crossed continents.
- Cleaner, faster traffic returns. Clean traffic returns over Cloudflare's backbone, often with lower latency than the public-internet path would have given you. Acceleration is a side effect of the security architecture.
FAQ
Common questions
Do I need to own my own IP prefixes for Magic Transit?
Yes — Magic Transit is for organizations that own /24 or larger IP space and route it via BGP. If you're a smaller customer who doesn't own IP space, Magic WAN + Magic Firewall + Spectrum together cover similar use cases without requiring your own prefix.
What's the latency impact?
Often *negative* — clean traffic crosses Cloudflare's optimized backbone instead of going direct via the public internet. Customers in regions with bad transit see meaningful improvements. Customers already close to their users see neutral latency change.
How does Magic Transit connect back to my data center?
Several options: GRE tunnels (most common), IPsec tunnels (when you need encryption), direct CNI (Cloudflare Network Interconnect) where you cross-connect inside an interconnection facility, or private network interconnects with public cloud providers.
Is Magic Transit only for huge enterprises?
Pricing is tiered, but Magic Transit is widely deployed across mid-market enterprises with their own IP space — not just Fortune 500s. If you have a publicly-routable network and you're paying for any kind of DDoS protection today, it's worth comparing.
Let's Test!
Try it live
Demo coming soon
An interactive demo for Magic Transit is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.
Dive Deeper