{"slug": "cloudflare-introduces-private-origins-for-application-services", "title": "Cloudflare Introduces Private Origins for Application Services", "summary": "Cloudflare has made Application Services for Private Origins generally available, letting public traffic reach applications on private networks without exposing their IP addresses or opening inbound firewall ports, following a closed beta announced in June. Cloudflare product development manager Enrique Somoza said the capability addresses customers whose \"internal APIs, AI agent backends, MCP servers, and operational tools weren't built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet.\" Using Private Origins requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing (not required with Cloudflare Tunnel), plus return routes for Cloudflare's IPv4 100.64.0.0/12 and IPv6 2606:4700:cf1:5000::/64 source ranges; private-to-private connectivity is not yet supported, with a closed beta targeted for early 2027.", "body_md": "Cloudflare recently made [Application Services for Private Origins generally available](https://blog.cloudflare.com/private-origins-public-to-private/), allowing public traffic to reach applications hosted on private networks without exposing their IP addresses or opening inbound firewall ports. Private-to-private connectivity is not yet supported.\n\n[Announced in closed beta in June](https://blog.cloudflare.com/private-origins-dns-routing/), the service is now generally available with a simplified configuration: private IP addresses are automatically detected in proxied DNS records, and private routing can be configured through the DNS API. [Enrique Somoza](https://www.linkedin.com/in/enriquesomoza/), product development manager at Cloudflare, writes:\n\nWe launched this capability (...) to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet.\n\nExisting Cloudflare connectivity can be used to apply WAF, bot management, rate limiting, caching, and Workers to private origins, just as with public-facing applications. The service also supports private TCP/UDP origins through Spectrum and private connectivity for Workers. Somoza adds:\n\nThose requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers.\n\nUsing [Private Origins](https://developers.cloudflare.com/dns/private-origins/) requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing (not required when using Cloudflare Tunnel). Cloudflare WAN and Mesh connections also require return routes for Cloudflare's IPv4 (100.64.0.0/12) and IPv6 (2606:4700:cf1:5000::/64) source ranges, as well as a proxied DNS record pointing to the private IP with private network routing enabled. Existing WAF, caching, and bot management policies apply automatically. [Simon Painter](https://www.linkedin.com/in/sipainter/), cloud network consultant, [notes](https://www.simonpainter.com/field-notes/private-origins-and-an-australian-bgp-wobble/):\n\nNo extra connector software. WAF, bot management, rate limiting, caching and Workers all sit in front of stuff that was never meant to be on the open internet. The interesting bit isn't the marketing wrapper — it's the DNS implication. For years the rule was: \"if it answers a public DNS name, it's reachable from the public internet.\" That stops being true here.\n\nCloudflare is not the only cloud provider offering ways to connect public-facing services to private application backends. AWS, for example, offers [CloudFront VPC Origins](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-cloudfront-virtual-private-cloud-vpc-origins-shield-your-web-applications-from-public-internet/), while Microsoft provides similar capabilities through [Azure Front Door Premium](https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview) and Private Link. Giacomo Masseroni [writes](https://x.com/Cloudflare/status/2116179364614189067):\n\nFinally. been punching holes in security groups just to let the edge in.\n\nWith general availability, Cloudflare has updated the Private Origins [developer documentation](https://developers.cloudflare.com/dns/private-origins/?cf_page=private-origins-public-to-private%2F). The announcement does not clarify whether the feature carries an additional charge or is included in existing Enterprise contracts.\n\nCloudflare plans to extend the service to support private-to-private traffic, allowing users, services, and AI agents on one private network to access applications on another. A closed beta is targeted for early 2027.", "url": "https://wpnews.pro/news/cloudflare-introduces-private-origins-for-application-services", "canonical_source": "https://www.infoq.com/news/2026/11/cloudflare-private-origins/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global", "published_at": "2026-11-15 06:18:00+00:00", "updated_at": "2026-11-15 06:49:35.372854+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-infrastructure"], "entities": ["Cloudflare", "Enrique Somoza", "Simon Painter", "AWS", "CloudFront VPC Origins", "Azure Front Door Premium", "Giacomo Masseroni", "Cloudflare Tunnel"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cloudflare-introduces-private-origins-for-application-services", "markdown": "https://wpnews.pro/news/cloudflare-introduces-private-origins-for-application-services.md", "text": "https://wpnews.pro/news/cloudflare-introduces-private-origins-for-application-services.txt", "jsonld": "https://wpnews.pro/news/cloudflare-introduces-private-origins-for-application-services.jsonld"}}