Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection . Your origin stays private, while web application firewall ( WAF ), caching , bot management , and Workers work just as they do for public origins. In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers. What is generally available today
During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group. Point a proxied A or AAAA record at a private IP, and Cloudflare’s application services work as they do for public origins:
WAF and managed rules
Bot management
Rate limiting
Caching
Transform and rewrite rules
Workers
Some limitations remain. Argo Smart Routing and Aegis aren’t supported, and origin health checks require Load Balancing . See the developer documentation for the full list of current limitations. Your origin keeps its private IP, with no inbound firewall exception required. With Cloudflare WAN or Cloudflare Mesh , there’s no connector software to run on the origin either. How it works
Create a proxied A or AAAA record pointing to your origin. For supported private IP ranges, Use private network routing is enabled automatically. If your origin uses a public IP that’s reachable only through your private network, you can enable the setting manually. The rest of the request flow stays the same: TLS termination, WAF, rules, and caching continue to run on Cloudflare’s network. The setting turns on automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses (100. 64. 0. 0/10), and RFC 4193 unique local IPv6 addresses (fc00::/7). It can’t be turned off for these ranges; attempts to disable it through the API return an error. What the API looks like
For customers automating deployments through the API, private routing is simply an additional attribute on a standard DNS record. POST /zones/{zone_id}/dns_records
{
"type": "A",
"name": "app. example. com",
"content": "10. 0. 0…