Cloudflare services for private origins is now generally available

Cloudflare has made its "services for private origins" feature generally available, letting customers point a proxied DNS record at a private IP address so that Cloudflare reaches the origin server over an existing Cloudflare One connection. The origin stays private while Cloudflare's web application firewall, caching, bot management, and Workers still apply, just as they do for public-facing origins.

The feature moves out of a closed beta that began in June 2026. Before this, protecting an internal service, such as an internal API, AI agent backend, or MCP server, with Cloudflare meant exposing a public IP, opening a firewall port, or running the cloudflared connector alongside it.

The setting turns on automatically for standard private IP ranges and routes traffic through the customer's existing private connectivity, such as IPsec, GRE, Cloudflare Tunnel, or Cloudflare Mesh. Some limitations remain, including no support for Argo Smart Routing or Dedicated CDN Egress IPs, and origin health checks require Load Balancing. Cloudflare says it is next working on private-to-private traffic, letting users and AI agents on one private network reach applications on another, targeting a closed beta in early 2027.

Why it matters

It lets companies protect internal tools and AI backends with the same firewall and bot-management controls as public sites, without exposing them to the internet.

Source: Cloudflare