Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Session duration applies to Cloudflare Access infrastructure applications. Set it when creating or editing an application in the dashboard or through the API.
- The default is 24 hours. Expiry closes active SSH connections through that application; it does not guarantee 24 hours of uninterrupted operation.
- When several infrastructure applications match one target, the shortest session duration applies.
- The announcement does not specify minimum or maximum values, the API field, or migration timing for existing applications and connected sessions.
What changes for SSH through an infrastructure application
The October 14 announcement adds configurable session duration to infrastructure applications. When it expires, active SSH connections through that application are closed and users need to reconnect. This scope is Cloudflare Access infrastructure applications; it does not establish a universal 24-hour limit for every SSH service.
Previously, infrastructure applications did not enforce a session duration limit. Cloudflare explains that connections could sometimes last beyond 24 hours, but were never guaranteed beyond 10 hours because of Gateway connection limits. That historical qualification does not announce a new fixed 10-hour disconnect rule.
Check the application's setting before relying on the default
Cloudflare says administrators can set session duration when creating or editing an infrastructure application in the dashboard or through the API. The default is 24 hours. The announcement does not list minimum or maximum allowed values or the API field, so check the current interface definition before automating changes rather than borrowing a field from another application type.
For existing applications, the announcement gives no explicit configuration migration schedule or timing for when connected sessions adopt a new value. The 24-hour default alone cannot tell you how much time an existing terminal has left. It also does not establish that changing the setting immediately extends or interrupts every active session.
The shortest duration wins when applications overlap
When a target matches several infrastructure applications, Cloudflare explicitly applies the shortest session duration. Checking only one application can miss the shorter setting that constrains the target.
Consider a hypothetical target matching applications A and B, where A has the shorter effective duration. Extending B does not remove the shortest-match rule while A still matches with a shorter setting. Review all matching applications rather than adding their durations together.
A 14-hour maintenance job needs more than a 24-hour default
Suppose you plan a hypothetical 14-hour maintenance job through a remote terminal. The 24-hour default does not guarantee completion: the target may match a shorter application, and network or other connection constraints may interrupt the session. An application session duration is not a promise that a job will finish.
As operational advice, use your team's existing procedures for saving progress, recoverable execution and checking task state after a disconnect. Those preparations do not extend an Access session or replace its access policy. Repeated reconnection should not be treated as a way around the organization's session limits.
Keep a configuration record before maintenance
Before maintenance, have the responsible operator record the target, every matching application, current session durations and the expected maintenance window. If a change is planned, follow the authorized dashboard or API process and retain the original value, change owner and rollback arrangements. This is operational advice; the announcement does not require every user to change settings immediately.
If a connection drops, record the time and terminal behavior, then check matching application settings and existing network alerts. One disconnect alone cannot establish whether session expiry, another connection constraint or a network problem caused it. Any reconnection should continue to follow the current Access policy.
The announcement gives no plan, regional or pricing changes for this capability and makes no promise of uninterrupted connections for an arbitrary duration. Confirm these unspecified conditions alongside the treatment of existing sessions when planning a change.
Sources
Frequently Asked Questions
Does a disconnected SSH session mean the server-side job has stopped?
The closed connection alone cannot establish that. The announcement describes SSH session expiry, not the outcome of remote processes. Check task state, output and saved progress through your established procedures before continuing or retrying, so a job still running is not started twice.
Is this the same change as strict service-token authentication?
They address different problems. This announcement concerns SSH session duration in infrastructure applications; strict service-token authentication concerns authorization of requests carrying token headers. Identify the application type and symptom before treating an HTTP 401/403 and an expired SSH session as the same cause.
Can I use the announcement date as the start time for every existing connection?
No. October 14 is the date on the announcement, not the start time of each connection. It supplies no migration timing rule for existing sessions. Use the actual application settings and relevant session evidence instead.