Cloudflare has made Application Services for Private Origins generally available, allowing customers to route public traffic to applications hosted on private networks without exposing their IP addresses or opening inbound firewall ports. The feature, which entered closed beta in June, now includes automatic detection of private IP addresses in proxied DNS records and configuration through the DNS API.
The service is designed to address a gap where internal APIs, AI agent backends, MCP servers, and operational tools need to accept Internet requests from partners, customers, or agents but were not built to be publicly accessible. Cloudflare’s product development manager Enrique Somoza said the capability was launched to address that problem. With Private Origins, existing Cloudflare connectivity can apply Web Application Firewall (WAF), bot management, rate limiting, caching, and Workers to private origins, just as with public-facing applications.
Somoza added that those requirements often left private applications without the same protections and controls used for public applications.
Setting up the service requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing (which is not required when using Cloudflare Tunnel). For Cloudflare WAN and Mesh connections, return routes for Cloudflare’s IPv4 and IPv6 source ranges are needed, as well as a proxied DNS record pointing to the private IP with private network routing enabled. Existing WAF, caching, and bot management policies apply automatically.
Cloud network consultant Simon Painter noted that the key change is the DNS implication: "For years the rule was: 'if it answers a public DNS name, it's reachable from the public internet.' That stops being true here." He pointed out that no extra connector software is needed and that Cloudflare’s protection stack sits in front of services not intended for the open Internet.
Cloudflare is not alone in offering such capabilities. AWS provides CloudFront VPC Origins, and Microsoft provides similar capabilities through Azure Front Door Premium and Private Link. Giacomo Masseroni writes: “Finally. been punching holes in security groups just to let the edge in.”
Cloudflare has updated its Private Origins developer documentation. The company did not clarify whether the feature carries an additional charge or is included in existing Enterprise contracts. Looking ahead, Cloudflare plans to extend the service to support private-to-private traffic, allowing users, services, and AI agents on one private network to access applications on another. A closed beta for that capability is targeted for early 2027.
Analysis
Why This Matters
- Organizations can apply Cloudflare’s security and performance features to internal applications without making them publicly accessible.
- Reduces the need to open inbound firewall ports or expose private IP addresses, lowering the attack surface.
- Signals a shift in how public DNS names relate to network reachability, as noted by industry observers.
Background
Cloudflare’s Application Services provide edge security, caching, and acceleration for web applications. Private Origins extends these capabilities to applications hosted on private networks. The feature was first announced in a closed beta in June 2026 and is now generally available. Competitors such as AWS and Microsoft offer similar capabilities through CloudFront VPC Origins and Azure Front Door Premium respectively.
Key Perspectives
Enrique Somoza (Cloudflare product development manager): The feature addresses the problem of internal services that need to accept Internet requests but were not built to face the Internet.
Simon Painter (cloud network consultant): The key implication is that a public DNS name no longer guarantees public Internet reachability; Cloudflare’s protection now applies to services that were never meant to be on the open Internet.
Giacomo Masseroni (commenter): The service eliminates the need to punch holes in security groups to let Cloudflare’s edge in.
What to Watch
- Cloudflare’s plans for private-to-private traffic, with a closed beta expected in early 2027.
- Pricing details for Private Origins, which were not disclosed at launch.
- Adoption rate and comparison to similar offerings from AWS and Azure.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedCloudflare has made Application Services for Private Origins generally available.InfoQ: “Cloudflare recently made Application Services for Private Origins generally available”
- SupportedThe service lets public traffic reach applications on private networks without exposing their IP addresses or opening inbound firewall ports.InfoQ: “allowing public traffic to reach applications hosted on private networks without exposing their IP addresses or opening inbound firewall ports.”
- SupportedThe service entered closed beta in June.InfoQ: “Announced in closed beta in June”
- SupportedPrivate IP addresses are automatically detected in proxied DNS records, and private routing can be configured through the DNS API.InfoQ: “private IP addresses are automatically detected in proxied DNS records, and private routing can be configured through the DNS API.”
- SupportedCloudflare product development manager Enrique Somoza said the capability was launched to address the problem of internal services needing to accept Internet requests despite not being built to face the Internet.InfoQ: “Enrique Somoza, product development manager at Cloudflare, writes: We launched this capability (...) to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests”
- SupportedSimon Painter said, “For years the rule was: 'if it answers a public DNS name, it's reachable from the public internet.' That stops being true here.”InfoQ: “For years the rule was: "if it answers a public DNS name, it's reachable from the public internet." That stops being true here.”
- SupportedPainter noted that no extra connector software is needed and that Cloudflare protections sit in front of services not meant for the open Internet.InfoQ: “No extra connector software. WAF, bot management, rate limiting, caching and Workers all sit in front of stuff that was never meant to be on the open internet.”
- SupportedExisting Cloudflare connectivity can apply WAF, bot management, rate limiting, caching and Workers to private origins, and existing WAF, caching and bot management policies apply automatically.InfoQ: “Existing Cloudflare connectivity can be used to apply WAF, bot management, rate limiting, caching, and Workers to private origins, just as with public-facing applications.”
- SupportedSetting up the service requires a Private Origins entitlement, Cloudflare One connectivity and Unified Routing, except when using Cloudflare Tunnel.InfoQ: “Using Private Origins requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing (not required when using Cloudflare Tunnel).”
- SupportedGiacomo Masseroni wrote, “Finally. been punching holes in security groups just to let the edge in.”InfoQ: “Giacomo Masseroni writes: Finally. been punching holes in security groups just to let the edge in.”
- Partly supportedThe company did not clarify whether the feature carries an additional charge or is included in existing Enterprise contracts.InfoQ: “The announcement does not clarify whether the feature carries an additional charge or is included in existing Enterprise contracts.”
- SupportedCloudflare plans to support private-to-private traffic, with a closed beta targeted for early 2027.InfoQ: “Cloudflare plans to extend the service to support private-to-private traffic, allowing users, services, and AI agents on one private network to access applications on another. A closed beta is targeted for early 2027.”
