Cloudflare has made its services for private origins generally available, allowing customers to direct public traffic to private IP addresses without exposing the origin to the public Internet. The traffic reaches the origin through an existing Cloudflare One connection, while Cloudflare application services continue to operate as they do for public origins.
The offering is designed for internal APIs, AI agent backends, MCP servers and operational tools that were not built for direct Internet exposure but still need to receive requests from partners, customers or agents. Previously, placing Cloudflare in front of these services could require a public IP, an open firewall port or cloudflared running alongside the origin.
Customers can point a proxied A or AAAA record to a private IP and use Web Application Firewall protections, managed rules, bot management, rate limiting, caching, transformation and rewrite rules, and Workers. Cloudflare says the origin retains its private IP and does not require an inbound firewall exception.
Private routing is enabled automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses in the 100.64.0.0/10 range and RFC 4193 unique local IPv6 addresses in fc00::/7. The feature can also be enabled manually when a public IP is reachable only through a private network.
Connectivity can be provided through IPsec, GRE, CNI, Cloudflare Tunnel or Cloudflare Mesh. With Cloudflare WAN, no connector software is required on the origin, while Cloudflare Mesh uses a connector inside the private network that can serve multiple origins.
Some limitations remain. Argo Smart Routing and Dedicated CDN Egress IPs are not supported, and origin health checks require Load Balancing. Customers also need the Private Origins entitlement, Cloudflare One connectivity and, in most cases, Unified Routing. Deployments using Cloudflare WAN or Cloudflare Mesh must configure return routes for Cloudflare’s source ranges.
Cloudflare says the most common setup issue identified during the closed beta was a missing return route, which can cause requests to time out without reaching the origin. The company’s developer documentation provides the complete configuration process.
The current release supports public traffic reaching private origins. Cloudflare is also working on private-to-private traffic, allowing users, services and AI agents on private networks to reach applications on other private networks through its application services. A closed beta for that capability is targeted for early 2027.
Sources: Cloudflare Blog.