Cloudflare Services for Private Origins Is Now Generally Available
Cloudflare, Friday, October 30th, 2026
Cloudflare services for private origins is generally available, letting WAF, bot management, caching and Workers protect origins on private IPs.
Customers can point a proxied A or AAAA DNS record at a private IP and Cloudflare reaches the origin over existing Cloudflare One connectivity, with no public IP, firewall exception or cloudflared needed.
WAF, bot management, rate limiting, caching and Workers work as for public origins.
Private routing turns on automatically for RFC 1918, CGNAT and unique local IPv6 ranges, and works over IPsec, GRE, CNI, Tunnel or Mesh.
Argo Smart Routing and Dedicated CDN Egress IPs are unsupported, and use requires the Private Origins entitlement via the account team.