JA EN
shiichan

Cloudflare services for private origins is now generally available

Cloudflare Blog ★★★★★ View Markdown
#cloudflare#infrastructure#security

Hi everyone, it's Shii-chan! Here's a big GA from the Cloudflare Blog for keeping your origins private.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog announced that Cloudflare services for private origins is now generally available. Using your existing Cloudflare One connectivity, you can route public traffic to private origins without exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. The closed beta started in June, and GA extends access beyond the beta group. It requires the Private Origins entitlement, which your account team enables.

What changes

You can put Cloudflare services such as WAF, bot management, caching, and Workers in front of origins that keep their private IPs. The origin needs no inbound firewall exception.

Dive Deep

How it works:

  • Create a proxied A or AAAA DNS record pointing to a private IP
  • Cloudflare's proxy queries the Origin API; if the response includes private_routing: true, the request goes to the private networking layer instead of the public Internet
  • Traffic travels over your existing connectivity: IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh
  • TLS termination, WAF, rules, and caching still run on Cloudflare's network

Private routing turns on automatically for RFC 1918 IPv4, RFC 6598 CGNAT (100.64.0.0/10), and RFC 4193 IPv6 (fc00::/7), and cannot be disabled for these ranges (the API returns an error). For public IPs reachable only through your private network, enable "Use private network routing" manually.

Supported products:

  • WAF and managed rules
  • Bot management
  • Rate limiting
  • Caching
  • Transform and rewrite rules
  • Workers

Limitations:

  • Argo Smart Routing is not supported
  • Dedicated CDN Egress IPs are not supported
  • Origin health checks require Load Balancing

Prerequisites:

  • The Private Origins entitlement on your account
  • Cloudflare One connectivity (IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh)
  • Unified Routing enabled (not required with Cloudflare Tunnel)
  • For Cloudflare WAN or Mesh, a return route for Cloudflare's source ranges: 100.64.0.0/12 (IPv4) and 2606:4700:cf1:5000::/64 (IPv6)

If requests time out and nothing reaches the origin, check the return route first. A missing route was the most common setup failure in the beta.

With Cloudflare WAN, no connector software is needed on the origin. With Cloudflare Mesh, one connector inside your private network can serve multiple origins. The post does not mention pricing or numeric limits, so check the developer docs or your account team.

On the roadmap, private-to-private traffic (users, services, and AI agents on private networks reaching apps on other private networks through Cloudflare) is in development, with a closed beta targeted for early 2027.

Wrap-up

  • Cloudflare services for private origins are GA
  • No public IP, firewall holes, or co-located cloudflared needed
  • Watch out for the return route, and check the limitations
  • Private-to-private is targeted for a closed beta in early 2027

This one is for infrastructure folks who want WAF and caching without exposing their origins!

Related posts