Cloudflare has made its private-origins capability generally available, allowing customers to send public requests to applications hosted at private IP addresses while using Cloudflare application services. The company says the setup does not require exposing an origin address to the public internet or adding an inbound firewall exception.
The release extends Cloudflare’s web application firewall (WAF), managed rules, bot management, rate limiting, caching, transformation and rewrite rules, and Workers to eligible private origins. Cloudflare announced the capability in a closed beta in June, describing demand from customers whose internal APIs, AI agent backends, Model Context Protocol (MCP) servers and operational tools were not designed for direct internet exposure but needed to serve external users or systems.
How private-origin routing works
Customers create a proxied A or AAAA DNS record that points to the origin’s private IP address. Cloudflare’s proxy continues to handle TLS termination and apply configured application services. Rather than trying to connect to the private address over the public internet, the proxy uses metadata from Cloudflare’s Origin API to send the request through the customer’s existing private network connection.
Cloudflare says private routing is enabled automatically for RFC 1918 private IPv4 addresses, the RFC 6598 carrier-grade NAT range 100.64.0.0/10, and RFC 4193 unique local IPv6 addresses in fc00::/7. For those ranges, the setting cannot be disabled; attempts to turn it off through the API return an error. A public IP address that is reachable only through a customer’s private network can also be used, but the routing setting must be enabled manually.
For deployments managed through the API, private routing is an attribute on a standard DNS record. In Cloudflare’s example, an A record for app.example.com points to 10.0.0.50, is proxied, and has private_routing set to true. Cloudflare’s proxy reads that signal and hands the connection to its private networking layer.
The supported connectivity options listed by Cloudflare are IPsec, GRE, Cloudflare Tunnel, CNI and Cloudflare Mesh. Cloudflare says no connector software is required on the origin when using Cloudflare WAN. With Cloudflare Mesh, a connector runs inside the private network and can serve multiple origins.
Requirements and current limitations
Access requires the Private Origins entitlement, which customers must request through their account team, as well as Cloudflare One connectivity. Unified Routing must also be enabled unless the customer connects through Cloudflare Tunnel, which does not require it. Cloudflare says both new and existing accounts can request an upgrade through their account team.
For Cloudflare WAN or Cloudflare Mesh connections, customers must configure a return route for Cloudflare’s source ranges: 100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6. Cloudflare advises checking that return route if requests time out without reaching an origin, noting that a missing route for its source range was the most common setup problem observed during the beta.
The generally available service does not support Argo Smart Routing or Dedicated CDN Egress IPs. Origin health checks require Load Balancing. Cloudflare directs customers to its developer documentation for the complete list of limitations and configuration steps.
Once the record and network routes are configured, Cloudflare says existing WAF, caching and bot-management settings for the hostname apply without additional changes. That gives operators a way to retain a private origin address while using the same application controls they configure for public-facing origins.
Private-to-private traffic is planned for a later phase
The current release addresses public traffic reaching private origins. Cloudflare says it is also working on private-to-private traffic, in which users, services and AI agents on private networks could reach applications on other private networks through Cloudflare application services. Engineering work is underway, and the company is targeting a closed beta in early 2027.
Cloudflare’s examples for that planned capability include employees accessing internal sites and service-to-service traffic between clouds and data centers. These are future plans rather than features included in the current release. For now, private origins brings selected application services to private endpoints reached over customers’ existing Cloudflare One connectivity.
