● Covered by 1 source · 1 reportMedium impact1 neutral
Cloudflare Services for Private Origins Now Generally Available
Key points
- Cloudflare services for private origins are now generally available.
- Proxied DNS records can point to private IPs via Cloudflare One connections.
- WAF, caching, bot management, and Workers now protect private origins.
- Eliminates need for public IPs or `cloudflared` for private services.
General Availability Announcement
Cloudflare has announced the general availability of its services for private origins. This feature allows users to direct a proxied DNS record to a private IP address, enabling Cloudflare to reach the origin through an existing Cloudflare One connection. This means that private origins can now utilize Cloudflare's web application firewall (WAF), caching, bot management, and Workers, similar to how these services operate for public origins.
Addressing a Customer Need
The capability was initially launched in a closed beta to address a common customer challenge: internal APIs, AI agent backends, and operational tools that were not designed for direct internet exposure but still needed to accept requests from external partners, customers, or agents. Previously, integrating Cloudflare with these services often required exposing a public IP, opening a firewall port, or deploying `cloudflared` alongside the origin. These requirements frequently left private applications without the same level of protection and control as public-facing applications.
Expanded Access and Functionality
With general availability, access is now open beyond the initial beta group. Users can point a proxied A or AAAA record to a private IP, and Cloudflare's application services, including WAF, bot management, rate limiting, caching, transform/rewrite rules, and Workers, will function. The origin's private IP remains private, and no inbound firewall exceptions are required. For Cloudflare WAN users, no connector software is needed on the origin, while Cloudflare Mesh requires a connector within the private network to serve multiple origins.
Implementation Details and Limitations
To use the service, a proxied A or AAAA record is created pointing to the origin. For supported private IP ranges (RFC 1918, RFC 6598, RFC 4193), private network routing is automatically enabled. If a public IP is used but only reachable via a private network, the setting can be manually enabled. The request flow maintains TLS termination, WAF, rules, and caching on Cloudflare's network. Current limitations include lack of support for Argo Smart Routing and Dedicated CDN Egress IPs, and origin health checks require Load Balancing.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2023-503877.5 HIGHReporting from
Cloudflare has made its services for private origins generally available, allowing users to proxy DNS records to private IPs and access Cloudflare's application services. This enables WAF, caching, bot management, and Workers to function for internal APIs and tools without exposing them to the public internet, addressing a previous gap in security and control for private applications.