Cloudflare preferred IPs
For sites on your own Cloudflare account, find faster Cloudflare IPs per China carrier and write them per line to DNS; replace slow ones, fall back to CNAME.
What it solves
The IPs Cloudflare assigns by default are often slow from China's three carriers. Cloudflare preferred IPs samples Cloudflare's official IP ranges (or uses candidates you enter), speed-tests them from mainland China Telecom, Unicom and Mobile through dnspup, picks the fastest few for each carrier and writes them as per-line A records. It re-tests on a schedule, replaces IPs that degrade, falls back to the CNAME on a line where none work, and switches back when they recover.
Turning it on
Cloudflare preferred IPs is an official, free plugin of the commercial edition, included in the default licence of a new commercial control plane. It is a page plugin, so it is fetched from the plugin store and confirmed by an administrator. The community edition does not include it (it builds on aggregated edge's Cloudflare access).
- An administrator gets the plugin in the plugin store, confirms the install under My plugins and picks the tenants.
- The administrator opens System → CF Preferred IPs Settings and enters the control plane API address and a dnspup customer API key (used for speed tests, encrypted, write-only).
- A site user opens Sites → CF Preferred IPs and clicks Authorise. The control plane lists the permissions the plugin needs (read sites, read and manage third-party CDN, read DNS and manage records) and, on approval, issues an identity for this plugin and this tenant only, revocable at any time.
- Pick the sites to optimise.
Main settings
| Setting | What it does |
|---|---|
| dnspup customer API key | Entered by the administrator for carrier speed tests; dnspup quota is billed separately |
| Candidate IPs | Sampled from Cloudflare's official ranges, or your own list (must be inside Cloudflare's ranges) |
| IPs per line | Healthy ones are kept, degraded ones replaced, topped up to the set number |
| Authorisation | One-click per tenant, revocable; after revoking, the plugin pauses and asks to authorise again |
Typical uses
- A site on Cloudflare that should be faster for visitors in China: turn it on and each carrier line resolves to its fastest measured IPs.
- An IP range slows down at peak hours: the scheduled re-test swaps the degraded IPs out.
Limits and notes
- This is not a usage Cloudflare officially supports.
- Only Cloudflare's open proxy ports work: HTTP 80, 8080, 8880, 2052, 2082, 2086, 2095 and HTTPS 443, 2053, 2083, 2087, 2096, 8443.
- It needs a DNS provider with line support: Alibaba Cloud, Huawei Cloud or DNSLA.
- The site must already be on your own Cloudflare account through aggregated edge.