Cloudflare General Availability for Private Origin Services Enhances Internal Application Security
Cloudflare's new general availability offering allows customers to secure internal applications with WAF, caching, and bot management, routing traffic through private IP addresses.
Cloudflare has announced the general availability of its services for private origins, a significant enhancement designed to extend the security and performance benefits of its platform to internal applications. This new offering allows customers to point proxied DNS records at private IP addresses, enabling traffic to be routed through existing Cloudflare One connections without exposing the origin servers to the public internet. This means that internal APIs, AI agent backends, operational tools, and other sensitive applications can now benefit from Cloudflare's Web Application Firewall (WAF), caching, bot management, and Workers capabilities, mirroring the protections afforded to public-facing services.
The feature addresses a long-standing challenge for organizations: securing internal applications that, while not designed for public exposure, still need to accept requests from partners, customers, or automated agents over the internet. Previously, integrating Cloudflare with such services often required exposing a public IP, opening firewall ports, or running additional connector software, which could introduce security risks or operational overhead. With Cloudflare services for private origins, these complexities are largely eliminated, providing a more streamlined and secure approach.
Key functionalities now available for private origins include Cloudflare's robust WAF with managed rules, bot management for detecting and mitigating automated threats, rate limiting to prevent abuse, caching for improved performance, and the ability to apply custom logic and transformations using Workers. While some limitations exist, such as the absence of Argo Smart Routing and the requirement for Load Balancing for origin health checks, the core security and performance features are now accessible for private endpoints.
Under the hood, the system works by automatically enabling private network routing for supported private IP ranges, including RFC 1918, RFC 6598, and RFC 4193 addresses, when a proxied A or AAAA record is configured to point to a private IP. This setting is automatically enabled and cannot be disabled for these specific ranges, ensuring that private origins are consistently routed through Cloudflare's secure network. For origins using public IPs that are only reachable via a private network, the private routing setting can be manually enabled.
The integration is designed to be seamless for users familiar with Cloudflare's platform. Administrators can create a proxied DNS record pointing to their origin's private IP and confirm that 'Use private network routing' is enabled. Cloudflare's proxy platform then intelligently determines the appropriate path for traffic, handing requests to its private networking layer when the private_routing: true flag is detected in the Origin API response. This layer routes the connection across the customer's existing private network connectivity, whether established via IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh.
To get started, customers need the Private Origins entitlement on their account, which can be requested through their account team. Additionally, Cloudflare One connectivity and Unified Routing must be enabled. For connections using Cloudflare WAN or Cloudflare Mesh, a return route for Cloudflare’s source IP ranges is also necessary. Once these prerequisites are met, configuring private origins is as simple as setting up a DNS record, with existing WAF, cache, and bot management configurations automatically applying.
Looking ahead, Cloudflare is already working on extending these capabilities to support private-to-private traffic. The company plans a closed beta in early 2027 for features that will allow users, services, and AI agents on private networks to reach applications on other private networks through Cloudflare's application services. This future development aims to provide the same level of security and control for inter-private network communications as is now available for public-to-private traffic.
This general availability release marks a significant step in Cloudflare's mission to provide comprehensive security and performance for all types of applications, whether they are exposed to the public internet or remain within private networks. By extending its robust suite of security tools to internal services, Cloudflare empowers organizations to better protect their critical infrastructure and sensitive data.