Cloudflare makes services for private origins generally available

Cloudflare services for private origins is now generally available. Customers can point a proxied DNS record at a private IP so Cloudflare reaches the origin over an existing Cloudflare One connection. The origin stays private while WAF, caching, bot management, and Workers work as they do for public origins.

What is available now

During closed beta, eligible customers requested access through their account team. Today access opens beyond that beta group. Point a proxied A or AAAA record at a private IP, and Cloudflare application services work as they do for public origins: WAF and managed rules, bot management, rate limiting, caching, transform and rewrite rules, and Workers. Some limitations remain: Argo Smart Routing and Dedicated CDN Egress IPs are not supported, and origin health checks require Load Balancing. The origin keeps its private IP with no inbound firewall exception required. With Cloudflare WAN, no connector software on the origin is required. With Cloudflare Mesh, a connector runs within the private network and can serve multiple origins.

How it works

Create a proxied A or AAAA record pointing to the origin. For supported private IP ranges, private network routing is enabled automatically. If the origin uses a public IP reachable only through the private network, enable the setting manually. TLS termination, WAF, rules, and caching continue to run on Cloudflare's network. The setting turns on automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses in 100.64.0.0/10, and RFC 4193 unique local IPv6 addresses in fc00::/7. It cannot be turned off for these ranges, and API attempts to disable it return an error. For API automation, private routing is an additional attribute on a standard DNS record. Cloudflare's proxy platform queries its Origin API, and the private_routing flag tells the proxy to hand the request to the private networking layer instead of connecting directly over the public Internet. That layer routes the connection across existing private network connectivity, including IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh.

Getting started and what comes next

Customers need the Private Origins entitlement, which an account team can turn on, plus Cloudflare One connectivity using IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh. Unified Routing must be enabled unless connecting over Cloudflare Tunnel. New and existing accounts can upgrade through their account team. If connecting over Cloudflare WAN or Cloudflare Mesh, configure a return route for Cloudflare source ranges: 100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6. Then create a proxied A or AAAA record for the private IP and confirm Use private network routing is enabled. Existing WAF, cache, and bot management configuration applies without further changes. If requests time out and nothing arrives at the origin, check the return route first; a missing route for Cloudflare's source range was the most common setup failure in beta. Today's release covers public traffic reaching private origins. Next, Cloudflare is working on private-to-private traffic, with a closed beta targeted for early 2027. Interested customers should talk to their account team. The goal is to give private applications the same protections as public applications, including WAF, rate limiting, and bot management for traffic such as service-to-service requests between clouds and data centers.

Sources: Cloudflare