Cloudflare has announced the General Availability of its services aimed at Private Origins, allowing enterprises to apply advanced security and optimization tools to their internal applications and Application Programming Interfaces (APIs) without the need to expose them to the public internet or open external firewall ports.
What Has Practically Changed?
Previously, companies faced challenges in securing their internal services, such as AI agents or operational tools, as using Cloudflare services required exposing these assets to a public IP address. With the new update, users can point DNS records (type A or AAAA) directly to private IP addresses, where the Cloudflare platform routes traffic via existing Cloudflare One connections (such as IPsec, GRE, or Cloudflare Tunnel).
Once this feature is enabled, private assets benefit from the same suite of tools available for public applications, including:
- Web Application Firewall (WAF): and applying managed rules.
- Bot Management: to limit unwanted traffic.
- Rate Limiting: to protect resources from excessive consumption.
- Caching: to accelerate access to content.
- Transform and Rewrite Rules.
- Cloudflare Workers: to execute business logic at the edge.
What Does This Mean for Users?
This update allows organizations to integrate their private applications within Cloudflare's infrastructure while maintaining network privacy. No additional software is required on the origin when using Cloudflare WAN, and routing is automatically enabled for private address ranges (RFC 1918, CGNAT, and Unique Local IPv6). For developers relying on automation, this feature can be enabled via the API by adding the private_routing: true attribute to DNS records.
Limitations and Next Steps
Despite the general availability, some technical limitations still exist; the service currently does not support features such as Argo Smart Routing or Dedicated CDN Egress IPs, and Origin Health Checks require using the Load Balancing feature. Cloudflare plans to expand these capabilities in the future to include private-to-private traffic, targeting a closed beta release for this feature in early 2027.