Cloudflare Private Origins is generally available—no public origin IP needed

Cloudflare’s October 30 launch lets web operators accept Internet requests without giving their origin server a public IP or opening an inbound firewall port. Cloudflare reaches the backend over an existing Cloudflare One connection.

Public requests, a private backend

Operators create a proxied A or AAAA DNS record pointing to the origin’s private IP. Cloudflare routes requests over the private connection, while its web application firewall (WAF) and managed rules, bot management, rate limiting, caching, transform and rewrite rules, and Workers remain available for that hostname.

With Cloudflare WAN, no connector software is required on the origin itself. Cloudflare Mesh uses a connector inside the private network that can serve multiple origins.

Account access and the route back

An account team must enable the Private Origins entitlement. Operators also need Cloudflare One connectivity through IPsec, GRE, CNI, Cloudflare Tunnel or Cloudflare Mesh. Unified Routing must be enabled unless the connection uses Cloudflare Tunnel.

The DNS record’s Use private network routing setting turns on automatically for supported private IP ranges. WAN and Mesh deployments also need a return route for Cloudflare’s source ranges. Cloudflare says a missing return route was the most common setup failure during the closed beta.

Private-to-private connections are still in development

Some application features remain unavailable: Argo Smart Routing and Dedicated CDN Egress IPs are not supported, and origin health checks require Load Balancing.

This release covers public traffic reaching private origins. Cloudflare is separately developing private-to-private traffic support and is targeting a closed beta in early 2027. Teams interested in that beta can contact their account team.