Cross-zone Worker subrequest to a BYOIP hostname sees CF-Connecting-IP 2a06:98c0:3600::103

Symptom

Origin or WAF rules see client IP 2a06:98c0:3600::103 for requests from a Worker in another zoneIP-based allowlists or rate limits behave differently for Worker subrequests to BYOIP hostnames

Cause

Cloudflare-proxied BYOIP destinations now follow standard Workers subrequest handling. For cross-zone subrequests, CF-Connecting-IP is set to the Workers client IP 2a06:98c0:3600::103. Same-zone subrequests still carry the real client IP.

Fix

Do not key rules on the CF-Connecting-IP of cross-zone Worker subrequests. Match on the CF-Worker header or the cf.worker.upstream_zone field, or pass the original client IP in your own header.

ApplyCopy

Custom rule expression: cf.worker.upstream_zone eq "example.com"

Affected

Workers subrequests to Cloudflare-proxied BYOIP hostnames in another zone, from 2026-10-30

Sources

• https://developers.cloudflare.com/changelog/

Last verified 2026-10-30 · Confirmed by 0 builders