Cloudflare makes services for private origins generally available
Cloudflare announced general availability of Cloudflare services for private origins, allowing a proxied DNS A/AAAA record to point at a private IP so traffic reaches the origin over an existing Cloudflare One connection. The feature removes the need for a public IP, inbound firewall exceptions, or running cloudflared on the origin, while retaining WAF, caching, bot management, rate limiting, and Workers. It is positioned for internal APIs, AI agent backends, and MCP servers that must accept Internet requests without being Internet-facing. This is product news with no associated threat activity.
Detalhes técnicos
A private_routing attribute on the DNS record signals Cloudflare's proxy to hand the request to its private networking layer instead of dialing the private IP over the Internet, routing over IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh. The setting is enabled automatically and cannot be disabled for RFC 1918, RFC 6598 CGNAT (100.64.0.0/10), and RFC 4193 (fc00::/7) ranges. Prerequisites include the Private Origins entitlement, Cloudflare One connectivity, and Unified Routing, plus a return route for Cloudflare source ranges 100.64.0.0/12 and 2606:4700:cf1:5000::/64. Argo Smart Routing and Aegis are unsupported; origin health checks require Load Balancing. Private-to-private traffic is targeted for closed beta in early 2027.
Linha do tempo
-
Cloudflare makes services for private origins generally available
ler a análise desta fonte ocultar
Cloudflare announced general availability of Cloudflare services for private origins, allowing a proxied DNS A/AAAA record to point at a private IP so traffic reaches the origin over an existing Cloudflare One connection. The feature removes the need for a public IP, inbound firewall exceptions, or running cloudflared on the origin, while retaining WAF, caching, bot management, rate limiting, and Workers. It is positioned for internal APIs, AI agent backends, and MCP servers that must accept Internet requests without being Internet-facing. This is product news with no associated threat activity.
Technical Details
A
private_routingattribute on the DNS record signals Cloudflare's proxy to hand the request to its private networking layer instead of dialing the private IP over the Internet, routing over IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh. The setting is enabled automatically and cannot be disabled for RFC 1918, RFC 6598 CGNAT (100.64.0.0/10), and RFC 4193 (fc00::/7) ranges. Prerequisites include the Private Origins entitlement, Cloudflare One connectivity, and Unified Routing, plus a return route for Cloudflare source ranges 100.64.0.0/12 and 2606:4700:cf1:5000::/64. Argo Smart Routing and Aegis are unsupported; origin health checks require Load Balancing. Private-to-private traffic is targeted for closed beta in early 2027.