Hi! Welcome to a series of blogs focused on leveraging Cloudflare for building Disaster Recovery architectures on Oracle Cloud. We will go through Infrastructure as a Service (IaaS), Platform as a Service(PaaS) and Software as a Service(SaaS) services and try to find the best solution for a DR architecture using Cloudflare services.

Oracle Cloud and Cloudflare

OCI and Cloudflare combine high-performance cloud infrastructure with global edge security and delivery, helping customers build faster, safer applications while also reducing complexity. OCI customers can now buy and manage Cloudflare bundles in the OCI Marketplace using Oracle Universal Credits.
While there are many Cloudflare services that can be used with Oracle Cloud, some examples would be DNS Zone transfers or URL rewriting, the purpose of this blog is to talk about Disaster Recovery and Cloudflare has the perfect service for that in the form of Load Balancers.

Some benefits of using Cloudflare Load Balancing:

  • Higher availability: automatically shifts traffic away from unhealthy or unreachable origins.
  • Active/passive failover: supports primary/backup origin designs across regions, data centers, or clouds.
  • Health checks: monitors origins from Cloudflare’s global network using configurable paths, status codes, timeouts, and response matching.
  • Lower latency: can steer users toward the fastest or closest healthy origin.
  • Multi-region support: useful for active/active or regional failover architectures.
  • Multi-cloud flexibility: can balance across OCI, AWS, Azure, GCP, on-prem, or mixed environments.
  • Traffic steering policies: supports standard failover, geo steering, dynamic latency steering, proximity steering, weighted traffic, and least-outstanding-request style routing.
  • Safer deployments: weighted pools can help with canary, blue/green, or gradual migration scenarios.
  • Session affinity: can keep users pinned to the same origin when the application needs sticky sessions.
  • Centralized edge control: routing decisions happen at Cloudflare, reducing the need for custom DNS failover scripts or hardware load balancers.
  • Origin resilience: helps reduce load on individual origins and avoids sending users to failed backends.

The high-level steps to build the architecture are simple:

  1. Build your service in the OCI primary region and expose it with Public IPs. If the service you are using is PaaS or SaaS, most of the infrastructure is provided by the service itself.
  2. Build a replica of your service in a second OCI region. The way to create the replica can vary (a lot) depending on the services used:
  • For PaaS and SaaS, the service itself would provide a DR solution, and you will need to work around that.
  • For IaaS, you will need to rebuild the service yourself, in a different region, and find a way to sync, replicate or use backup/restore strategies across the regions. One great OCI service that can help here is the OCI Full Stack Disaster Recovery service. For the replica, a good plan would be to have the Public IPs already reserved or allocated to a running Load Balancer because it helps a lot with the Cloudflare side configuration.

3. Configure a Cloudflare load balancer for active-passive traffic with Monitors and target the two deployments. Add any other Cloudflare feature (like URL rewriting) to customize the access. The steps are simple:

a) define Pools which are the Public IPs from OCI exposing the service.

  • You will need two different pools, one for each region (primary and standby).
  • Each Pool can have a single Endpoint as a target, in the form of OCI Load Balancers or multiple Endpoints if you want to target the Application Compute Instances directly.

b) define Monitors for health checking the status of the Pools. Typically you would use HTTP based health checks and you need to be mindful of the TLS/SSL Certificates of the Origin and Host headers.

c) create the Cloudflare Load Balancer with said Pools and Monitors.

On top of the great list of features the Load Balancer has (written above), the fact that the traffic passes through Cloudflare gives some additional benefits:

  • You take advantage of the Content Delivery Network which adds content caching so your users will experience faster applications.
  • Cloudflare has good URL editing and HTTP header manipulation so you can basically create Vanity URLs for just about any service, regardless of the type (IaaS, PaaS or SaaS).
  • Improve your security by adding WAF, Bot Management, etc.
  • Cloudflare has the ability to generate Origin Certificates which will help with most IaaS and PaaS deployments.

A diagram would look like this:

You can also increase the security of your deployments by restricting the incoming traffic to only Cloudflare IPs. Cloudflare publishes those ranges here. You can apply the whitelist on various places, depending on the type of exposed service. For example, for IaaS you would use a Network Security Group.

Conclusion
This blog was intended to provide you with high-level steps on creating a robust Disaster Recovery Architecture by leveraging services from both Cloudflare and Oracle Cloud. In the next blogs from the series we will drill down on configuration relevant to specific Oracle Cloud services, mostly around PaaS and SaaS.

Blog series:

OCI Disaster Recovery with Cloudflare Load Balancers – APEX on ADB-S