Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- For dashboard configuration, set a pool's Endpoint steering to Hash; through the API, set session_affinity=ip_cookie.
- Cloudflare One Client traffic is identified by device; other on-ramps, such as Cloudflare WAN, use source IP.
- Private load balancers handle Layer 3/4 traffic and do not read or set cookies or HTTP headers; session_affinity_ttl does not apply.
- Affinity selects an endpoint, defined by an IP address and virtual network. It does not pin a Tunnel or Mesh replica.
Know what stays on the same endpoint
To keep a private-network client on the same endpoint, set a pool's Endpoint steering to Hash in the Cloudflare dashboard, or set session_affinity=ip_cookie through the API. Cloudflare announced the capability on November 4, 2026. The endpoint must remain healthy, and a pool or client-identifier change can alter the selection.
An endpoint is an IP address paired with a virtual network. Endpoints can be reached through Cloudflare Tunnel, Cloudflare Mesh, or Cloudflare WAN. For an internal application that keeps session state on one server, endpoint affinity can keep a client on that endpoint; it does not guarantee the same connector replica will carry the traffic.
Use Hash in the dashboard
In the load balancer pool settings, set Endpoint steering to Hash. The dashboard does not expose a separate session affinity control for private load balancers. Hash uses the client identifier to choose an endpoint within the pool.
The selection stays stable while the client identifier is the same, the endpoint remains healthy, and the pool configuration is unchanged. A health or pool change can still move the client.
Set ip_cookie through the API
For API configuration, set session_affinity to ip_cookie on the load balancer. For Cloudflare One Client traffic, Cloudflare uses the device as the stable identifier, so a change to the device's IP address can still map to the same endpoint. Other on-ramps, such as a Cloudflare WAN site, use the source IP.
The name ip_cookie does not mean that a cookie is set. Private load balancers handle Layer 3/4 traffic and do not read or set cookies or HTTP headers. No cookie is stored, so session_affinity_ttl does not apply.
Understand the limits of endpoint affinity
A client can move if its endpoint becomes unhealthy or if you add, remove, or reweight endpoints in the pool. Affinity does not keep a client on an unhealthy endpoint.
Affinity selects an endpoint (an IP address plus a virtual network), not a specific Tunnel or Mesh replica. Cloudflare sends traffic to the replica closest to the data center handling the request. The same client can use different replicas over time, and those replicas may reach the endpoint from different source IPs. An application that depends on a stable source IP may still see different addresses.
Cloudflare's documentation discusses putting a proxy in front of the application or running a single cloudflared replica for a Tunnel. A single replica removes replica redundancy. These are separate architecture choices; endpoint affinity does not apply them automatically, and they should not be treated as default changes.
Check whether the on-ramp matches your need
For example, imagine an employee laptop switching from home Wi-Fi to a mobile hotspot while connected through Cloudflare One Client. The device identifier does not change just because the client's IP changes. If the endpoint remains healthy and the pool is unchanged, the laptop can stay on the same endpoint.
Cloudflare WAN traffic uses source IP as its identifier. That means a source IP change also changes the identifier used for affinity, so you should not expect the previous endpoint mapping to remain.
Choose dashboard Hash or API ip_cookie when you need endpoint affinity within a pool. If your application requires a fixed connector replica or a fixed source IP, neither setting guarantees that.
Sources
Frequently Asked Questions
Is this free and available to every account and region?
The announcement and session-affinity documentation reviewed here do not establish plan eligibility, regional availability, pricing, or quotas for every account. Check your account's product permissions and contract before configuration; the announcement does not establish free or unconditional worldwide access.
How many seconds does endpoint failover take?
The reviewed sources explain that health changes can move a client, but do not establish a failover or convergence-time guarantee for this article. Endpoint affinity also does not replace the application's own session-recovery design.