Point to Custom IPs dashboard UI; document automatic Split Tunnel inclusion

Two related fixes for initial resolved IPs now that the Networking >
IP addresses > Address space > Custom IPs UI (stratus MR !41739) is
live in production:

- Swap the Zero Trust > Team & Resources > Devices > Device profiles
  UI instructions back to Networking > IP addresses > Address space >
  Custom IPs, with a Go button, in configure-initial-resolved-ips.mdx
  and the GA changelog. Re-add the dash-route entry for this deeplink
  to core-manually-defined.json.

- Per WDAPI-4489, the Cloudflare One Client now automatically includes
  the default initial resolved IP range (172.64.128.0/20) in Split
  Tunnels Include mode, and automatically excludes it (along with the
  entire 2606:4700:0cf1::/48 IPv6 range, which also covers device IPs
  and Cloudflare source IPs on IPv6) from Exclude mode exclusions, at
  runtime on the device. This is not stored in the device profile and
  is not returned via the public API.

  Added a new 'Automatically managed ranges' section to split-tunnels.mdx
  as the canonical explanation, and updated reserved-ips.mdx,
  configure-initial-resolved-ips.mdx, and the Cloudflare Mesh
  routes.mdx / client-devices.mdx docs to stop instructing manual Split
  Tunnel configuration for these ranges. Custom (non-default) initial
  resolved IP ranges still require manual Split Tunnel configuration,
  since it is not confirmed whether the automatic behavior tracks a
  custom range.

Author: nikitacano

src/content/changelog/tunnel/2026-08-11-hostname-routing-ga-public-initial-resolved-ips.mdx

@@ -10,7 +10,7 @@ products:
 date: 2026-08-11
 ---
 
-import { Render, GlossaryTooltip } from "~/components";
+import { DashButton, Render, GlossaryTooltip } from "~/components";
 
 [Hostname routing](https://blog.cloudflare.com/tunnel-hostname-routing/) is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors:
 
@@ -30,8 +30,12 @@ Alongside GA, the default IPv4 range used for <GlossaryTooltip term="initial res
 - [Access private applications](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) on non-HTTPS ports
 - [Egress policy host selectors](/cloudflare-one/traffic-policies/egress-policies/host-selectors/) (Domain, Host, Application, and Content Categories)
 
-You can check your account's current range, or configure a custom range, at any time from **Zero Trust** > **Team & Resources** > **Devices** > **Device profiles**, or using the [Initial Resolved IP Subnet API](/api/resources/zero_trust/subresources/networks/subresources/subnets/#(resource)%20zero_trust.networks.subnets.initial_resolved_ip).
+You can check your account's current range, or configure a custom range, at any time from **Networking** > **IP addresses** > **Address space** > **Custom IPs**, or using the [Initial Resolved IP Subnet API](/api/resources/zero_trust/subresources/networks/subresources/subnets/#(resource)%20zero_trust.networks.subnets.initial_resolved_ip).
+
+<DashButton url="/?to=/:account/ip-addresses/address-space/custom-ips" />
 
 For full instructions, refer to [Configure initial resolved IPs](/cloudflare-one/networks/routes/configure-initial-resolved-ips/). The IPv6 range (`2606:4700:0cf1:4000::/64`) is unchanged and is not affected by this restriction.
 
+The default IPv4 range, and all Cloudflare One IPv6 ranges, are automatically routed through the Cloudflare One Client and do not require any Split Tunnel configuration. Refer to [Automatically managed ranges](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) for details.
+
 If you were relying on a Chrome Enterprise policy workaround (such as `LocalNetworkAccessRestrictionsTemporaryOptOut`) while your account was still on the legacy CGNAT-based range, refer to [Google Chrome restricts access to private hostnames](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#google-chrome-restricts-access-to-private-hostnames) for next steps.

src/content/dash-routes/core-manually-defined.json

@@ -9,6 +9,11 @@
 		"name": "Virtual networks",
 		"parent": ["Networking", "Routes"]
 	},
+	{
+		"deeplink": "/?to=/:account/ip-addresses/address-space/custom-ips",
+		"name": "Custom IPs",
+		"parent": ["Networking", "IP addresses", "Address space"]
+	},
 	{
 		"deeplink": "/?to=/:account/data-catalog/overview",
 		"name": "R2 Data Catalog",

src/content/docs/cloudflare-one/networks/connectors/cloudflare-mesh/client-devices.mdx

@@ -72,9 +72,10 @@ Depending on your Cloudflare networking configuration, you may need to remove ad
 In Include mode, add the following to your include list:
 
 - `100.96.0.0/12` — Mesh IPs (device IPs)
-- `172.64.128.0/20` and `2606:4700:0cf1:4000::/64` — [Hostname routing](/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#hostname-routes) (if used; requires MASQUE)
 - Any CIDR routes you have [configured for your Mesh nodes](/cloudflare-one/networks/connectors/cloudflare-mesh/routes/)
 
+The IPv4 range used for [hostname routing](/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#hostname-routes) (`172.64.128.0/20`; requires MASQUE) and all Cloudflare One IPv6 ranges are [automatically routed through Cloudflare](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) and do not need to be added manually.
+
 ## Firewall considerations
 
 Some operating systems block inbound traffic from the Mesh IP range by default:

src/content/docs/cloudflare-one/networks/connectors/cloudflare-mesh/routes.mdx

@@ -228,13 +228,14 @@ For a deeper look at the packet flow behind hostname routing, refer to the [anno
 
   <Render file="tunnel/enable-gateway-proxy" product="cloudflare-one" />
 
-- **Route all of the following ranges through Cloudflare** in the [Split Tunnel](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) configuration of **both** the Mesh node's device profile **and** your client device profiles. In Include mode, add each range; in Exclude mode, ensure none of them (or their parent ranges) are excluded.
+- **Route the following IPv4 ranges through Cloudflare** in the [Split Tunnel](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) configuration of **both** the Mesh node's device profile **and** your client device profiles. In Include mode, add each range; in Exclude mode, ensure none of them (or their parent ranges) are excluded.
 
-  | Purpose                     | IPv4            | IPv6                       |
-  | --------------------------- | --------------- | -------------------------- |
-  | Mesh device IP range        | `100.96.0.0/12` | `2606:4700:cf1:1000::/64`  |
-  | Cloudflare source IP range  | `100.64.0.0/12` | `2606:4700:cf1:5000::/64`  |
-  | Hostname routing (token IPs) | `172.64.128.0/20` | `2606:4700:0cf1:4000::/64` |
+  | Purpose                     | IPv4            |
+  | --------------------------- | --------------- |
+  | Mesh device IP range        | `100.96.0.0/12` |
+  | Cloudflare source IP range  | `100.64.0.0/12` |
+
+  The hostname routing (token IP) range (`172.64.128.0/20`) and all Cloudflare One IPv6 ranges are [automatically routed through Cloudflare](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) and do not need to be added manually.
 
 - **Remove the hostname's top-level domain from [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/)** on client devices, so the DNS query is sent to Cloudflare Gateway for resolution.
 

src/content/docs/cloudflare-one/networks/routes/configure-initial-resolved-ips.mdx

@@ -8,7 +8,7 @@ sidebar:
   order: 4
 ---
 
-import { CURL, Render, Tabs, TabItem, GlossaryTooltip } from "~/components";
+import { CURL, DashButton, Render, Tabs, TabItem, GlossaryTooltip } from "~/components";
 
 <GlossaryTooltip term="initial resolved IP">Initial resolved IPs</GlossaryTooltip> (also called token IPs) are ephemeral addresses that Gateway assigns to DNS queries so it can associate hostname-based traffic with the correct policy or tunnel at the network layer, where hostname information is not usually available. Refer to [Gateway initial resolved IPs](/cloudflare-one/networks/routes/reserved-ips/#gateway-initial-resolved-ips) for a list of features that depend on this range.
 
@@ -24,16 +24,18 @@ If you configure a custom IPv4 range within Carrier-Grade NAT (CGNAT) address sp
 
 ## Prerequisites
 
-- You have the [Cloudflare One Networks Write](/fundamentals/api/reference/permissions/) permission (for API access), or dashboard access to **Zero Trust** > **Team & Resources** > **Devices** > **Device profiles**.
+- You have the [Cloudflare One Networks Write](/fundamentals/api/reference/permissions/) permission (for API access), or dashboard access to **Networking** > **IP addresses** > **Address space** > **Custom IPs**.
 - Your new range does not conflict with existing routes or other reserved [Cloudflare One subnets](/cloudflare-one/networks/routes/reserved-ips/) in your account.
 
 ## Check your current range
 
 <Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
 
-1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Devices** > **Device profiles**.
-2. Select the **Initial resolved IP** filter.
-3. View your account's current IPv4 range in the **IP subnet range** field.
+1. Go to **Networking** > **IP addresses** > **Address space** > **Custom IPs**.
+
+   <DashButton url="/?to=/:account/ip-addresses/address-space/custom-ips" />
+
+2. Find the row where **Assign to** is **Initial Resolved IP** to see your account's current IPv4 range in the **Prefix** column.
 
 </TabItem> <TabItem label="API">
 
@@ -53,11 +55,13 @@ Send a `GET` request to the [Get Initial Resolved IP Subnet](/api/resources/zero
 
 <Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
 
-1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Devices** > **Device profiles**.
-2. Select the **Initial resolved IP** filter.
-3. Select **Configure**.
-4. Enter your new IPv4 range in **IP subnet CIDR**.
-5. Select **Save**.
+1. Go to **Networking** > **IP addresses** > **Address space** > **Custom IPs**.
+
+   <DashButton url="/?to=/:account/ip-addresses/address-space/custom-ips" />
+
+2. Find the row where **Assign to** is **Initial Resolved IP**, select the three dots menu, and select **Edit**.
+3. Enter your new IPv4 range in **IP address**.
+4. Select **Save**.
 
 </TabItem> <TabItem label="API">
 
@@ -84,6 +88,6 @@ The new CIDR must not conflict with existing private routes or other reserved su
 Only the IPv4 range is configurable. The IPv6 initial resolved IP range (`2606:4700:0cf1:4000::/64`) is fixed and does not need to be changed to resolve Chromium's Local Network Access restrictions, which do not affect IPv6.
 :::
 
-After you change your range, update your [Split Tunnel configuration](/cloudflare-one/networks/routes/reserved-ips/#split-tunnel-configuration) so that traffic to the new range routes through the Cloudflare One Client, and remove the old range if it is no longer used by any other reserved IP purpose.
+The default IPv4 range is [automatically routed through the Cloudflare One Client](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) and does not require any Split Tunnel configuration. If you configure a custom range, update your [Split Tunnel configuration](/cloudflare-one/networks/routes/reserved-ips/#split-tunnel-configuration) so that traffic to the new range routes through the Cloudflare One Client, and remove the old range if it is no longer used by any other reserved IP purpose.
 
 Initial resolved IPs have a TTL of approximately 10 minutes. DNS queries resolved before you change your range continue to use the previous range until that TTL expires. After that, new DNS queries receive an initial resolved IP from the new range.

src/content/docs/cloudflare-one/networks/routes/reserved-ips.mdx

@@ -82,7 +82,7 @@ For deployments that use the [Cloudflare One Client](/cloudflare-one/team-and-re
 
 In **Exclude IPs and domains** mode, the Cloudflare One Client excludes the CGNAT range (`100.64.0.0/10`) from its routing by default. You must delete the reserved IP ranges that fall within CGNAT space from your Split Tunnels exclude list, or the associated features will stop working.
 
-[Gateway initial resolved IPs](#gateway-initial-resolved-ips) are the exception: the default range (`172.64.128.0/20`) is public Cloudflare address space, not CGNAT, so it is **not** excluded by default in Exclude mode — no Split Tunnel changes are required for this range. This only applies if you configured a custom initial resolved IP range within CGNAT space. In that case, treat it the same as the other CGNAT-based ranges.
+[Gateway initial resolved IPs](#gateway-initial-resolved-ips) are the exception: the default range (`172.64.128.0/20`) is public Cloudflare address space, not CGNAT, so it is **not** excluded by default in Exclude mode. The Cloudflare One Client also automatically removes this range, along with the entire `2606:4700:0cf1::/48` IPv6 range (which also covers [device IPs](#device-ips) and [Cloudflare source IPs](#cloudflare-source-ips) on IPv6), from any exclusions you configure — refer to [Automatically managed ranges](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges). No Split Tunnel changes are required for these ranges. This only applies to the default IPv4 range: if you configured a custom initial resolved IP range within CGNAT space, treat it the same as the other CGNAT-based ranges below.
 
 Cloudflare recommends adding back the IPs that are not explicitly used for Cloudflare One services. This reduces the risk of conflicts with existing private network configurations that may use CGNAT address space.
 
@@ -98,4 +98,4 @@ Use the following calculator to determine which IP ranges to add back based on t
 
 ### Include mode
 
-In **Include IPs and domains** mode, the Cloudflare One Client sends only traffic for the included routes to Cloudflare. You must explicitly add the reserved IP ranges that your deployment depends on. For example, if you use [hostname routing or egress policy host selectors](#gateway-initial-resolved-ips), add `172.64.128.0/20` (or your custom IPv4 range) and `2606:4700:0cf1:4000::/64` to your Split Tunnels include list.
+In **Include IPs and domains** mode, the Cloudflare One Client sends only traffic for the included routes to Cloudflare. You must explicitly add the reserved IP ranges that your deployment depends on, except the default [Gateway initial resolved IP range](#gateway-initial-resolved-ips) (`172.64.128.0/20`) and the entire `2606:4700:0cf1::/48` IPv6 range (which also covers [device IPs](#device-ips) and [Cloudflare source IPs](#cloudflare-source-ips) on IPv6) — the Cloudflare One Client automatically includes these. Refer to [Automatically managed ranges](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) for details. If you use [hostname routing or egress policy host selectors](#gateway-initial-resolved-ips) with a custom IPv4 initial resolved IP range, add that custom range to your Split Tunnels include list.

src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels.mdx

@@ -67,6 +67,17 @@ In [Traffic only mode](/cloudflare-one/team-and-resources/devices/cloudflare-one
 - `104.19.194.29`
 - `104.19.195.29`
 
+## Automatically managed ranges
+
+The Cloudflare One Client automatically includes the following ranges in Include mode, and automatically removes them from any exclusions configured in Exclude mode. This happens at runtime on the device: the ranges are not stored in your device profile, do not appear in the Split Tunnels list in the dashboard, and do not need to be added manually.
+
+- **IPv4**: `172.64.128.0/20` — the default [Gateway initial resolved IP range](/cloudflare-one/networks/routes/reserved-ips/#gateway-initial-resolved-ips)
+- **IPv6**: `2606:4700:0cf1::/48` — covers [device IPs](/cloudflare-one/networks/routes/reserved-ips/#device-ips), [Cloudflare source IPs](/cloudflare-one/networks/routes/reserved-ips/#cloudflare-source-ips), and [Gateway initial resolved IPs](/cloudflare-one/networks/routes/reserved-ips/#gateway-initial-resolved-ips)
+
+You do not need to add these ranges to your Split Tunnels configuration. If you are troubleshooting a feature that depends on one of these ranges (for example, [hostname routing](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) or [Cloudflare Mesh](/cloudflare-one/networks/connectors/cloudflare-mesh/)), you can still add the range explicitly as a diagnostic step, but this should not be required for normal operation.
+
+If your account uses a [custom initial resolved IP range](/cloudflare-one/networks/routes/configure-initial-resolved-ips/) instead of the default `172.64.128.0/20`, add that custom range to your Split Tunnels configuration.
+
 ## Domain-based Split Tunnels
 
 Domain-based split tunneling has a few ramifications you should be aware of before deploying in your organization:.