Magic Transit

Unmatched, hardware-free DDoS protection for customer networks

Protect public-facing subnets using the Cloudflare global network, without the slowdowns of routing network traffic to scrubbing centers or capacity limitations of hardware boxes. With 280 Tbps of network capacity, 23x greater than the largest DDoS attacks ever recorded, Cloudflare can mitigate attacks of any size.

Shield icon
DDoS protection at massive scale

No more backhauling traffic to DDoS scrubbing centers. Magic Transit uses Cloudflare's global network to absorb and filter attacks.

Stopwatch icon
Ultra-low Time to Mitigate (TTM)

Malicious traffic is identified and blocked at a Cloudflare data center closest to the source, usually within 3 seconds.

Network scale orange
Reduce your TCO

Replace expensive hardware and increase operational agility with network functions delivered and billed as a service.


On-premises and hybrid infrastructure protected via our global network

Diagram of Cloudflare Magic Transit preventing a DDoS attack

Magic Transit delivers network protection from Cloudflare data centers. Using Border Gateway Protocol (BGP) route announcements, inbound traffic is ingested at the closest Cloudflare data center.

Clean traffic is routed rapidly over Cloudflare’s network and can be handed off over GRE tunnels, private network interconnects (PNI), or other forms of peering to the customer network.

Diagram of Cloudflare Magic Transit preventing a DDoS attack

Learn how to develop a strategy for your network modernization


2023 Gartner Peer Insights “Voice of the Customer”: DDoS Mitigation Solutions

Gartner Peer Insights Customers' Choice 2023 award

Cloudflare is named a Customers’ Choice in the Gartner® Peer Insights™ “Voice of the Customer”: DDoS Mitigation Solutions

Read the report
Gartner Peer Insights Customers' Choice 2023 award

What our customers are saying

"Cloudflare has reliable infrastructure and an extremely competent and responsive team. They are well-positioned to deflect even the largest of attacks."

CTO — Wikimedia Foundation

Top Magic Transit use cases

Magic Transit stops DDoS attacks directed at your infrastructure. Get the benefits of cloud-based DDoS protection for public-facing infrastructure

DDoS attack icon
Protect against layer 3 DDoS

With data from attacks observed across our global network, Cloudflare can block and mitigate any type of DDoS attack in seconds.

Origin server icon
Delivers defense in depth

Use Cloudflare's 320-city global network at the front lines of your network protection.

Shield icon
A part of Cloudflare’s comprehensive DDoS protection

Works together with Spectrum (Layer 4) and Cloudflare DDoS (Layer 7) to address different techniques in the cyberattack kill chain.

Helping organizations worldwide protect themselves from DDoS attacks

Get Magic Transit for your enterprise