Cloudflare services for private origins is now generally available
- ID
- 41175
- Status
- summarized
- Published
- 30 Oct 2026, 10:23 PM
- Fetched
- 30 Oct 2026, 10:35 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/private-origins-public-to-private/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 6.0
- Created
- 30 Oct 2026, 10:36 PM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
Cloudflare's services for private origins are now generally available, letting a proxied A or AAAA DNS record point at a private IP and reach the origin over an existing Cloudflare One connection. WAF, bot management, rate limiting, caching, rewrite rules, and Workers then work as they do for public origins, with no inbound firewall exception or connector software required on the origin. Private routing auto-enables for RFC 1918 IPv4, 100.64.0.0/10 CGNAT, and fc00::/7 IPv6 ranges and cannot be disabled for those ranges; Argo Smart Routing and Aegis are unsupported, and origin health checks require Load Balancing.
Why it matters
If you run internal APIs, AI agent backends, or MCP servers behind Cloudflare and want WAF, bot management, caching, or Workers without exposing a public IP or running cloudflared, you can now use a proxied DNS record to a private IP. Check the limitations first: Argo Smart Routing and Aegis are unsupported, health checks need Load Balancing, and private routing is forced on for RFC 1918, CGNAT, and ULA ranges.
Discussion angle
Which internal services would you now put behind Cloudflare private origins, and what still forces you to keep a public IP or run cloudflared?