Cloudflare Enables Public Traffic Security for Private Origins

Summary

On October 30, 2026, Cloudflare announced the general availability of its services for private origins. This feature enables customers to securely serve public traffic to internal, private IP addresses while maintaining the origin’s privacy and leveraging Cloudflare’s security and performance tools such as WAF, bot management, caching, and Workers. This capability was previously available only in closed beta and now expands to all eligible Cloudflare customers with Cloudflare One connectivity.

What Happened?

Cloudflare has extended its proxy and application services to support private origin IP addresses. Customers can configure their DNS records to point Cloudflare to private IPs (e.g., RFC 1918 IPv4 ranges) and rely on Cloudflare’s private network routing instead of public Internet routes. This setup allows external requests from partners or customers to securely reach internal applications without exposing private IPs publicly or opening inbound firewall ports.

Key features supported include:

• Web Application Firewall (WAF) and managed rules
• Bot management
• Rate limiting
• Caching
• Transform and rewrite rules
• Cloudflare Workers

This solution relies on existing Cloudflare One connectivity methods such as IPsec, GRE tunnels, Cloudflare Tunnel, CNI plugins, or Cloudflare Mesh. Importantly, it requires no additional connector software on the origin for certain setups, preserving a seamless security perimeter.

Who Should Care?

This release is particularly relevant for organizations with internal APIs, operational tools, AI and ML backends, and other private services that need to accept public or third-party internet traffic but must remain protected behind private IP addressing schemes. Such teams can now apply Cloudflare’s security measures without exposing their infrastructure directly to the Internet or resorting to complex firewall rules and local software proxies.

What Developers and Operators Should Verify and Do Next

To adopt this feature effectively, customers should:

1. Get the Private Origins entitlement enabled on their Cloudflare accounts by contacting their account team.
2. Ensure existing Cloudflare One connectivity is set up properly using one of the supported methods (IPsec, GRE, Tunnel, Mesh, etc.).
3. Confirm Unified Routing is enabled on their account unless connecting through Cloudflare Tunnel.
4. Configure appropriate return routes for Cloudflare source IP ranges to prevent request timeouts.
5. Create proxied A/AAAA DNS records pointing to the private IP addresses and verify the “Use private network routing” setting is enabled—this is automatic for standard private IP ranges.
6. Review any limitations such as the lack of support for Argo Smart Routing and Dedicated CDN Egress IPs, and the requirement of Load Balancing for origin health checks.

Developers should also update automated deployments via Cloudflare’s API by including the private_routing attribute on DNS records.

Cloudflare provides comprehensive documentation and recommends checking return routes if requests to private origins time out.

Looking Ahead

Cloudflare plans to extend this approach to private-to-private traffic, enabling secure application services interactions within private networks. This upcoming capability aims to bring consistent protections—including WAF and rate limiting—to services communicating entirely within private network boundaries.

Cloudflare is targeting a closed beta for private-to-private networking in early 2027 and invites interested customers to contact their account teams.

Note: Some technical details, such as full limitations and configuration steps, should be confirmed by reviewing the official Cloudflare documentation or through direct support channels.

Checklist for Immediate Actions

• Contact Cloudflare account team to enable Private Origins entitlement.
• Verify Cloudflare One connectivity using supported network methods.
• Ensure Unified Routing is enabled or confirm if using Cloudflare Tunnel.
• Set up DNS proxied records with private IPs and confirm private routing activation.
• Configure network return routes for Cloudflare source IPs to avoid traffic dropouts.
• Update automation with private_routing attribute if using Cloudflare API.
• Review Cloudflare documentation for limitations and best practices.

Related Code Crushers coverage

• GitHub’s @GitHub Integration in Slack and Teams Now Generally Available with New Features