Cloudflare Launches General Availability for Private Origins Connectivity
Secure internal services with enterprise-grade protection without exposing public IP addresses.
1General Availability Announcement
Cloudflare has officially moved its private origins service from closed beta to general availability. This release allows users to point proxied DNS records directly at private IP addresses. By leveraging existing Cloudflare One connections, organizations can now secure internal APIs and operational tools without exposing them to the public internet.
2Bridging Security Gaps
Previously, internal services like AI agent backends and MCP servers lacked the robust protection layers applied to public-facing assets. Customers often struggled with firewall port management or complex connector software. This new capability ensures that private applications receive the same WAF, bot management, and caching benefits as public-facing web applications.
3Technical Implementation Details
The system automatically enables private network routing for RFC 1918, RFC 6598, and RFC 4193 address ranges. Users simply create a proxied A or AAAA record pointing to their private IP. The platform handles the request flow through the existing private networking layer, eliminating the need for inbound firewall exceptions.
4API and Automation Workflow
Developers can automate these deployments by setting the private_routing attribute to true within their DNS record API calls. When the proxy detects this flag, it bypasses the public internet and routes traffic through established connections like IPsec, GRE, or Cloudflare Tunnel. This streamlines infrastructure management for complex, multi-cloud environments.
5Prerequisites for Deployment
To utilize this feature, accounts must have the Private Origins entitlement and Unified Routing enabled. Connectivity must be established via Cloudflare One, including options like Cloudflare Mesh or CNI. Administrators must ensure return routes for Cloudflare source ranges are correctly configured to prevent common timeout issues during the initial setup phase.
6Current Service Limitations
While the service supports core features like Workers, caching, and transform rules, some advanced capabilities remain unsupported. Argo Smart Routing and Aegis are currently excluded from this release. Additionally, origin health checks require the Load Balancing product to function correctly. Users should consult the official developer documentation for specific configuration constraints.
7Future Roadmap Developments
Cloudflare is actively developing private-to-private traffic capabilities for future releases. The engineering team is targeting a closed beta for early 2027 to enable secure communication between private networks. This expansion aims to provide consistent security controls for service-to-service traffic that never touches the public internet, enhancing internal network security postures.
8Strategic Security Impact
This release marks a significant shift in how internal infrastructure is protected. By unifying the security stack for both public and private origins, organizations reduce operational complexity. The ability to apply WAF and rate limiting to internal traffic provides a critical layer of defense against lateral movement and unauthorized access attempts.