Cloudflare opens private origins to all: WAF and caching without a public IP
Serguey Asael Shinder2 min readInternal APIs, agent backends and MCP servers often need to accept requests from the Internet without being built to sit on it. Until now, putting Cloudflare in front of such a service meant giving it a public IP, opening a firewall port or running cloudflared next to it. On 30 October Cloudflare made "private origins" generally available after a closed beta that began in June.
The setup is a normal proxied A or AAAA record whose content is a private address. Cloudflare's proxy sees a private_routing flag in the origin metadata and, instead of trying to reach that address over the public Internet, hands the request to its private networking layer, which carries it over whatever link the customer already has: IPsec, GRE, Cloudflare Tunnel, CNI or Cloudflare Mesh. TLS termination, WAF and managed rules, bot management, rate limiting, caching, transform rules and Workers all run as they would for a public origin.
The flag switches on automatically, and cannot be switched off, for RFC 1918 IPv4 ranges, the RFC 6598 CGNAT block 100.64.0.0/10 and IPv6 unique local addresses (fc00::/7). For a public IP that is only reachable through the private network it can be set by hand, including as "private_routing": true in the DNS records API.
There are conditions. The account needs a Private Origins entitlement from its account team, Cloudflare One connectivity, and Unified Routing unless the link is a Tunnel. Over WAN or Mesh, the customer must add a return route for Cloudflare's source ranges, 100.64.0.0/12 and 2606:4700:cf1:5000::/64; Cloudflare says a missing return route was the most common failure in the beta. Argo Smart Routing and dedicated CDN egress IPs are not supported, and origin health checks require Load Balancing.
What it means
The change removes the last public listener from setups where it existed only so the CDN could connect. The cost moves to the network side: the return route and the entitlement are now the things to check when requests time out. Cloudflare's next step, private clients reaching private applications through the same controls, is a stated target for early 2027, not a product.