What is this?
CFnew is a Cloudflare Workers/Pages proxy panel that generates VLESS, Trojan and xhttp nodes, converts them into subscription formats for clients like Clash, Surge, Sing-box, Loon, Quantumult X, V2ray and Shadowrocket, and lets you manage everything through a web config page backed by Cloudflare KV.
CFnew is a Cloudflare Workers/Pages proxy panel that generates VLESS, Trojan and xhttp nodes, converts them into subscription formats for clients like Clash, Surge, Sing-box, Loon, Quantumult X, V2ray and Shadowrocket, and lets you manage everything through a web config page backed by Cloudflare KV.Is this an app I install, or a script I run myself?It is not a local app — it is Worker/Pages source code that you deploy directly into your own Cloudflare account, and it runs entirely on Cloudflare's edge network.
It is not a local app — it is Worker/Pages source code that you deploy directly into your own Cloudflare account, and it runs entirely on Cloudflare's edge network.How do I deploy it?Upload the project as a Cloudflare Pages deployment or Worker, then in Settings → Runtime set the compatibility date to 2026-01-20 and save; for the graphical config panel, create a KV namespace and bind it as variable C, then visit /{your-UUID}.
Upload the project as a Cloudflare Pages deployment or Worker, then in Settings → Runtime set the compatibility date to 2026-01-20 and save; for the graphical config panel, create a KV namespace and bind it as variable C, then visit /{your-UUID}.Do I need a Cloudflare account and KV namespace?Yes — you need a Cloudflare account to deploy the Worker/Pages project, and a KV namespace bound as environment variable C if you want the graphical management panel instead of editing variables by hand.
Yes — you need a Cloudflare account to deploy the Worker/Pages project, and a KV namespace bound as environment variable C if you want the graphical management panel instead of editing variables by hand.Any gotchas I should watch for after deploying?You must manually set the compatibility date to 2026-01-20 after deployment or things may break; also the p (custom ProxyIP) and wk (region) variables are mutually exclusive — setting one disables the other's logic.
You must manually set the compatibility date to 2026-01-20 after deployment or things may break; also the p (custom ProxyIP) and wk (region) variables are mutually exclusive — setting one disables the other's logic.Which proxy clients can use the generated subscriptions?It produces ready-to-use configs for Clash, Surge, Sing-box, Loon, Quantumult X, V2ray, Shadowrocket, Stash, NekoRay and V2rayNG, auto-detected by the client's User-Agent.
It produces ready-to-use configs for Clash, Surge, Sing-box, Loon, Quantumult X, V2ray, Shadowrocket, Stash, NekoRay and V2rayNG, auto-detected by the client's User-Agent.What is the ECH feature for?Encrypted Client Hello (ECH) is supported; the panel fetches the latest ECH config via DoH (preferring Google DNS, falling back to Cloudflare DNS) on every subscription refresh and auto-enables TLS-only mode to avoid port-80 interference.
Encrypted Client Hello (ECH) is supported; the panel fetches the latest ECH config via DoH (preferring Google DNS, falling back to Cloudflare DNS) on every subscription refresh and auto-enables TLS-only mode to avoid port-80 interference.Why can't I pick a specific region for the best IP anymore?Cloudflare uses anycast, so the same IP address resolves to different data centers depending on where you connect from — region-based IP selection doesn't actually control where you land. v3.0 removed that logic and ships 10 built-in official addresses spread across different /24 blocks instead.
Cloudflare uses anycast, so the same IP address resolves to different data centers depending on where you connect from — region-based IP selection doesn't actually control where you land. v3.0 removed that logic and ships 10 built-in official addresses spread across different /24 blocks instead.Can I route my traffic through my own outbound proxy?Yes, the s variable lets you chain a SOCKS5, HTTP or HTTPS outbound proxy with Basic auth, and the qj setting decides whether that proxy is preferred, used only as fallback, or required with no fallback at all.
Yes, the s variable lets you chain a SOCKS5, HTTP or HTTPS outbound proxy with Basic auth, and the qj setting decides whether that proxy is preferred, used only as fallback, or required with no fallback at all.What does the built-in latency tester do?It's a bundled multi-threaded tool that pings candidate IPs (manual input, random Cloudflare ranges, or a remote URL list), auto-detects airport codes, and shows true latency after subtracting DNS/TLS handshake time.
It's a bundled multi-threaded tool that pings candidate IPs (manual input, random Cloudflare ranges, or a remote URL list), auto-detects airport codes, and shows true latency after subtracting DNS/TLS handshake time.What are similar projects?CFNext, usque-custom-pro, CFBox, Open-Box, Cloudflare-vless-trojan, edgetunnel, back4app-vless, v2ray
CFNext, usque-custom-pro, CFBox, Open-Box, Cloudflare-vless-trojan, edgetunnel, back4app-vless, v2rayWhich topics is it in?edge-computing, http-proxy, key-value, vless, gfw, socks5, v2ray, cloudflare-workers, serverless, dns, tls, censorship-circumvention
edge-computing, http-proxy, key-value, vless, gfw, socks5, v2ray, cloudflare-workers, serverless, dns, tls, censorship-circumvention