Cloudflare services for private origins is now generally available

Cloudflare has made its private origins service generally available, allowing customers to direct proxied DNS A or AAAA records to private IP addresses while applying Cloudflare services such as WAF, bot management, rate limiting, caching, rewrite rules, and Workers. Traffic reaches these origins through existing Cloudflare One connectivity, including IPsec, GRE, Cloudflare Tunnel, CNI, Cloudflare WAN, or Cloudflare Mesh, eliminating the need to expose public IPs, open inbound firewall ports, or in some configurations run connector software at the origin. Private network routing is automatically enabled for specified RFC 1918, CGNAT, and unique local IPv6 ranges, and API deployments can configure it through a private_routing DNS-record attribute. Customers need the Private Origins entitlement, Unified Routing, and appropriate return routes for Cloudflare source ranges, with missing return routes identified as a common cause of failed requests. Argo Smart Routing and Aegis are not currently supported, while origin health checks require Load Balancing. Cloudflare is also developing private-to-private application traffic support, with a closed beta targeted for early 2027.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.