Cloudflare private-origin application services are generally available
Original title: Cloudflare services for private origins is now generally available
A proxied DNS record aimed at a private IP is reached over existing Cloudflare One links, with WAF and Workers unchanged.
Cloudflare made application services for private origins generally available after a closed beta. Customers point a proxied A or AAAA record at a private IP, and Cloudflare reaches the origin over existing Cloudflare One connectivity without a public IP or inbound firewall exception. WAF, bot management, rate limiting, caching, rewrites, and Workers apply as they do for public origins. Argo Smart Routing and Aegis are not supported. Private-to-private traffic is planned for a closed beta in early 2027.
- Private routing turns on automatically for RFC 1918, 100.64.0.0/10, and fc00::/7 addresses.
- It cannot be disabled for those ranges; the API returns an error.
- Setup needs the Private Origins entitlement, Cloudflare One connectivity, and Unified Routing.
- A missing return route for Cloudflare source ranges was the most common beta failure.
- Origin health checks require Load Balancing.
- Vendors
- Cloudflare
From the original article
4 min read at blog.cloudflare.com
Public traffic to private origins, with WAF, bot management, caching, and Workers, is now available to every customer with Cloudflare One connectivity.
By Enrique Somoza · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.