{"slug": "cloudflare-services-for-private-origins-is-now-generally-available", "title": "Cloudflare services for private origins is now generally available", "summary": "Cloudflare made its services for private origins generally available, letting customers point a proxied A or AAAA DNS record at a private IP so Cloudflare reaches the origin over an existing Cloudflare One connection. The capability, launched in closed beta in June, applies WAF and managed rules, bot management, rate limiting, caching, transform and rewrite rules, and Workers to private origins without a public IP or inbound firewall exception; Argo Smart Routing and Aegis are not supported, and origin health checks require Load Balancing. Private network routing turns on automatically for RFC 1918 IPv4, RFC 6598 CGNAT (100.64.0.0/10) and RFC 4193 IPv6 (fc00::/7) ranges and cannot be disabled for them, with the API exposing a private_routing flag on standard DNS records.", "body_md": "# Cloudflare services for private origins is now generally available\n\nToday, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing [__Cloudflare One connection__](https://developers.cloudflare.com/cloudflare-one/networks/connectivity-options/). Your origin stays private, while web application firewall ([__WAF__](https://www.cloudflare.com/products/waf/)), [__caching__](https://developers.cloudflare.com/cache/), [__bot management__](https://developers.cloudflare.com/bots/get-started/bot-management/), and [__Workers__](https://developers.cloudflare.com/workers/) work just as they do for public origins.\n\nIn June, [__we launched this capability in closed beta__](https://blog.cloudflare.com/private-origins-dns-routing/) to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running `cloudflared` alongside the origin.\n\nThose requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers.\n\n### What is generally available today\n\nDuring the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group.\n\nPoint a proxied A or AAAA record at a private IP, and Cloudflare’s application services work as they do for public origins:\n\n- WAF and managed rules\n- Bot management\n- Rate limiting\n- Caching\n- Transform and rewrite rules\n- Workers\n\nSome limitations remain. Argo Smart Routing and Aegis aren’t supported, and origin health checks require [__Load Balancing__](https://developers.cloudflare.com/load-balancing/). See the [__developer documentation__](https://developers.cloudflare.com/dns/private-origins/) for the full list of current limitations.\n\nYour origin keeps its private IP, with no inbound firewall exception required. With [__Cloudflare WAN__](https://developers.cloudflare.com/cloudflare-wan/) or [__Cloudflare Mesh__](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/), there’s no connector software to run on the origin either.\n\n### How it works\n\nCreate a proxied A or AAAA record pointing to your origin. For supported private IP ranges, Use **private network routing** is enabled automatically. If your origin uses a public IP that’s reachable only through your private network, you can enable the setting manually.\n\nThe rest of the request flow stays the same: TLS termination, WAF, rules, and caching continue to run on Cloudflare’s network.\n\nThe setting turns on automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses (100.64.0.0/10), and RFC 4193 unique local IPv6 addresses (fc00::/7). It can’t be turned off for these ranges; attempts to disable it through the API return an error.\n\n### What the API looks like\n\nFor customers automating deployments through the API, private routing is simply an additional attribute on a standard DNS record.\n\n```\nPOST /zones/{zone_id}/dns_records\n{\n \"type\": \"A\",\n \"name\": \"app.example.com\",\n \"content\": \"10.0.0.50\",\n \"ttl\": 300,\n \"proxied\": true,\n \"private_routing\": true\n}\n```\n\nBehind the scenes, Cloudflare's proxy platform determines where to send traffic for `app.example.com` by querying Cloudflare's Origin API. The response includes metadata indicating that the destination should be reached through a private network path:\n\n```\n{\n \"zone_name\": \"example.com\",\n \"ipv4_addresses\": [\"10.0.0.50\"],\n \"private_routing\": true\n}\n```\n\nThe `private_routing` flag is the key signal. When our proxy sees it, instead of attempting to connect directly to the private IP address over the public Internet, it hands the request to our private networking layer, which then routes the connection across the customer's existing private network connectivity, whether that's [__IPsec__](https://www.cloudflare.com/learning/network-layer/what-is-ipsec/), [__GRE__](https://www.cloudflare.com/learning/network-layer/what-is-gre-tunneling/), [__Cloudflare Tunnel__](https://developers.cloudflare.com/tunnel/), [__CNI__](https://developers.cloudflare.com/network-interconnect/), or Cloudflare Mesh.\n\nThe [__beta post__](https://blog.cloudflare.com/private-origins-dns-routing/) covers the routing layer in more detail.\n\n### Get started\n\nBefore you begin, you’ll need:\n\n1. The Private Origins entitlement on your account. Ask your account team to turn it on.\n2. [__Cloudflare One connectivity__](https://developers.cloudflare.com/cloudflare-one/networks/connectivity-options/) using IPsec, GRE, CNI, Cloudflare Tunnel, or[__Cloudflare Mesh__](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/) .\n3. Unified Routing enabled on your account. New and existing accounts can upgrade through their account team.\n4. If you connect over Cloudflare WAN or Cloudflare Mesh, you need Unified Routing enabled on your account and a return route for Cloudflare’s source ranges (100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6). New and existing accounts can upgrade to Unified Routing through their account team.\n\nThen, create a proxied A or AAAA record for the private IP and confirm that **Use private network routing** is enabled. Your existing WAF, cache, and bot management configuration applies to that hostname without further changes.\n\nOne note from the beta: if requests time out and nothing arrives at the origin, check the return route first. A missing route for Cloudflare’s source range was the most common setup failure we saw.\n\nOnce enabled, follow our [__developer documentation__](https://developers.cloudflare.com/dns/private-origins/), which walks through the full setup.\n\n### What comes next\n\nToday’s release covers public traffic reaching private origins. Next, we’re working on private-to-private traffic: users, services, and AI agents on private networks reaching applications on other private networks through Cloudflare’s application services.\n\nEngineering work is underway, and we’re targeting a closed beta in early 2027. If you’d like to participate, talk to your account team.\n\nThe goal is to give private applications the same protections and controls as public applications. An employee opening `wiki.company.internal`, for example, could benefit from WAF, rate limiting, and bot management. Service-to-service traffic between clouds and data centers could use those controls too, even when neither side touches the public Internet.\n\nFor now, today’s release brings the WAF, caching, bot management, and Workers you use for public applications to private origins over connectivity you already operate.\n\nQuestions or feedback? Join the conversation in our [__community forums__](https://community.cloudflare.com/) or reach out to your account team.", "url": "https://wpnews.pro/news/cloudflare-services-for-private-origins-is-now-generally-available", "canonical_source": "https://blog.cloudflare.com/private-origins-public-to-private/", "published_at": "2026-10-30 14:23:43+00:00", "updated_at": "2026-10-30 14:48:10.160165+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "developer-tools"], "entities": ["Cloudflare", "Cloudflare One", "Cloudflare Workers", "Cloudflare WAN", "Cloudflare Mesh", "Argo Smart Routing", "Aegis", "Load Balancing"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cloudflare-services-for-private-origins-is-now-generally-available", "markdown": "https://wpnews.pro/news/cloudflare-services-for-private-origins-is-now-generally-available.md", "text": "https://wpnews.pro/news/cloudflare-services-for-private-origins-is-now-generally-available.txt", "jsonld": "https://wpnews.pro/news/cloudflare-services-for-private-origins-is-now-generally-available.jsonld"}}