AI Briefing
KOSign in

Cloudflare Services for Private Origins Generally Available

·2026.10.30 23:23

Key point

Point a proxied DNS record at a private IP to apply WAF, caching, and bot management to internal services without exposing public IPs.

Details

  • Cloudflare Services for Private Origins is generally available, allowing proxied DNS records to point to private IPs while maintaining WAF, caching, bot management, and Workers.
  • The feature works over existing Cloudflare One connections (IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh), eliminating the need for public IPs, inbound firewall exceptions, or origin-side connector software.
  • Private network routing is automatically enabled for RFC 1918 IPv4, RFC 6598 CGNAT, and RFC 4193 IPv6 ranges and cannot be disabled via API for these specific address blocks.
  • Argo Smart Routing and Aegis are not supported, and origin health checks require Load Balancing; the next phase targets private-to-private traffic with a closed beta planned for early 2027.

Setup Requirements

  • Requires the Private Origins entitlement, Cloudflare One connectivity, and Unified Routing enabled on the account.
  • For Cloudflare WAN or Mesh connections, a return route for Cloudflare’s source ranges (100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6) is mandatory.
  • The most common setup failure during beta was a missing return route for Cloudflare’s source range, causing request timeouts.
networkingcloudflarewafdnscloudflare-oneprivate-origins
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

Cloudflare BlogCloudflare Launches PHP Capture the Flag Challenge to Test WAF Defenses Against php2shell VulnerabilitiesCloudflare BlogCloudflare WAF adds full transaction detection and response rulesVercel BlogVercel IP geolocation updates deliver city-level data for nearly all requests and postal codes for 90% of trafficTLDR AICloudflare Computer v0.7.0 adds durable JavaScript execution for agent recovery and approval workflowsGeekNewsTalorys: Open-Source Personal AI Agent for Cloudflare Free TierReplit BlogReplit patches infrastructure and blocks exploits for recent eMudhra, Node.js, PHP, LiteLLM, and Linux kernel vulnerabilities