JA EN
shiichan

Route public traffic to private origins! Cloudflare's Application Services for Private Origins is here!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#infrastructure#security

Hey everyone, it's Shii-chan! Today I've got an exciting networking update for you. You can now send outside traffic to apps that live on your private network, without exposing a single public IP. It looks low-key, but it is seriously handy!

Cloudflare Blog blog.cloudflare.com

What was announced?

On the Cloudflare Blog, a new feature called Application Services for Private Origins was announced. It started rolling out as a closed beta for eligible Enterprise customers on June 10, 2026, with General Availability (GA) targeted for Q4 2026.

In one line: you can route requests for a public hostname straight to a private IP origin. And you can reuse your existing IPsec, GRE, CNI, or Cloudflare Mesh paths, with no public IPs and no extra connector software required!

The story so far

Until now, getting public traffic to a private app took real effort:

  • Assign a public IP to the origin and expose it to the internet
  • Add exception rules to your firewall
  • Run connector software like cloudflared on the origin
  • Stand up parallel infrastructure such as load balancers and reverse proxies
  • Stack up multiple TLS termination layers

And even companies already using Cloudflare WAN or Mesh for site-to-site networking could not reuse that same infrastructure to deliver public-to-private apps. Such a waste, right?

What changes

The best part is that Cloudflare's security and performance features — WAF rules, bot management, rate limiting, caching, rewrites, and Workers — can now sit in front of your private origins. They all work even without exposing a public IP!

WAF rules, bot management, rate limiting, caching, rewrites, and Workers can now sit in front of private origins without requiring public IP exposure

In other words, Cloudflare's routing layer can now treat a private IP as a valid origin for a public hostname. The more you are already connected to Cloudflare's network, the more you benefit with little extra work.

Dive Deep

The mechanism is neat. When you enable use_private_routing on a proxied A or AAAA record, Cloudflare's proxy queries the Origin API and gets back metadata saying to use the private path for this record. Then it connects over your existing private connectivity instead of the public internet.

A DNS record setup looks like this:

POST /zones/{zone_id}/dns_records
{
  "type": "A",
  "name": "app.example.com",
  "content": "10.0.0.50",
  "proxied": true,
  "use_private_routing": true
}

And for private IP ranges, use_private_routing turns on automatically:

  • RFC 1918 private IPv4 (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
  • RFC 6598 CGNAT ranges (100.64.x.x-100.127.x.x)
  • RFC 4193 unique local IPv6 (FC00::/7)

For public IPs that are only reachable through a private network, you can turn it on manually.

The supported paths are IPsec tunnels, GRE tunnels, CNI (Cloudflare Network Interconnect), Cloudflare Tunnel, Cloudflare Mesh, and Virtual Networks. As prerequisites, you need Cloudflare One connectivity, and a return route in your private network for Cloudflare's source IP range 100.64.0.0/12.

It is not just DNS, either:

  • Spectrum (L4): TCP/UDP services can sit behind Spectrum on private IPs with no load balancer in between. You specify a virtual network ID, and Cloudflare validates the private origin IP before saving. It currently supports Cloudflare Tunnel, with more connectivity options planned.
  • Workers VPC: with bindings, the Workers runtime routes through the same private path as your DNS records. Workers, browsers, mobile apps, and AI agents can all reach private origins the same way.

Down the road, Cloudflare plans to extend this to private-to-private traffic, where users and services on a private network can securely reach other private apps. The direction is a model where the same Cloudflare infrastructure protects traffic whether the user or the origin is public or private.

Wrap-up

  • Cloudflare launched Application Services for Private Origins in closed beta, with GA targeted for Q4 2026
  • Route public hostnames to private IP origins with no public IPs and no connector software
  • Reuse existing IPsec, GRE, CNI, Cloudflare Tunnel, and Cloudflare Mesh paths
  • Put WAF, bot management, rate limiting, caching, and Workers in front of private origins
  • Enable it with use_private_routing on a DNS record; it auto-enables for private IP ranges
  • Coverage is expanding to Spectrum (L4) and Workers VPC

If you already connect your network with Cloudflare One and want WAF and bot protection on your internal apps too, this one is for you, infrastructure and networking folks!

Related posts