Cloudflare Launches Private Origins for All Customers
Cloudflare has announced that its services for private origins are now generally available to every customer with Cloudflare One connectivity.
Radwan AbdulhadiEditor and technology writer
General Availability of Private Origins
Cloudflare has officially made its services for private origins generally available to every customer with a Cloudflare One connection. By pointing a proxied DNS record at a private IP address, Cloudflare reaches the origin over an existing network connection while keeping the origin entirely private.
This general availability expands access beyond the closed beta that was initially launched in June. According to Cloudflare, the capability was designed to address challenges where internal APIs, AI agent backends, Model Context Protocol servers, and operational tools needed to accept requests from the Internet without being built to face it directly.
Enhanced Protections and Application Services
Previously, placing Cloudflare in front of private applications required exposing a public IP, opening a firewall port, or running connector software alongside the origin. These hurdles often left private applications without the standard security and optimization tools used for public applications.
With the general release, web application firewall (WAF), caching, bot management, and Workers function seamlessly just as they do for public origins. The underlying private IP remains hidden, eliminating the need for inbound firewall exceptions or separate connector software when utilizing Cloudflare WAN or Cloudflare Mesh.
Routing Mechanics and Technical Requirements
To configure the feature, administrators create a proxied A or AAAA record pointing to their origin. For supported private network ranges, private network routing is enabled automatically. The proxy platform queries the Origin API and utilizes a private_routing flag to route connections across the customer's existing private network infrastructure.
Requirements to use the service include the Private Origins entitlement on an account, Cloudflare One connectivity using protocols such as IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh, and Unified Routing enabled on the account. Certain limitations remain, such as the requirement of Load Balancing for origin health checks, while Argo Smart Routing and Aegis are currently unsupported.
Future Development and Support Documentation
Looking ahead, Cloudflare is already working on private-to-private traffic capabilities, aiming to allow users, services, and AI agents on private networks to reach applications on other private networks through Cloudflare's application services. Engineering work is underway with a closed beta targeted for early 2027.
Customers seeking comprehensive setup guides, current limitations, and detailed network routing configurations can consult the developer documentation provided by Cloudflare.
Sources
- Cloudflare BlogCloudflare services for private origins is now generally available
Continue chronologically
Related entity coverage
Related stories
Cloudflare Launches Worker Previews for Isolated Environments
Cloudflare introduces Worker Previews, providing developers and AI agents with isolated, production-like environments for testing code changes in parallel.
Cloudflare Python Workers Are Now Generally Available
Cloudflare introduces production-ready Python support for its Workers platform, allowing developers to run frameworks like FastAPI and Django seamlessly.
Cloudflare Celebrates 16th Birthday With 46 AI and Security Shipments
Cloudflare marks its 16th birthday with 46 announcements spanning open-source tools, post-quantum security upgrades, and AI agent developments.
Cloudflare Releases Streamline for Custom Video Pipelines
Cloudflare has introduced Streamline, a developer playground demonstrating how to build custom video processing pipelines using Workers and Containers.
