Cloudflare has made its private-origin service generally available, letting customers route web traffic to private IP addresses while keeping origins off the public internet. The change brings protections such as its web application firewall, bot management, rate limiting, caching and Workers to private origins over existing Cloudflare network connections.
Cloudflare Watch analysis
What happened
Cloudflare says customers can point a proxied A or AAAA DNS record at a private IP and use its application services without adding an inbound firewall exception. The service was previously in closed beta; access is now open beyond that beta group.
Setup requires a Private Origins entitlement, Unified Routing and Cloudflare One connectivity, such as IPsec, GRE, Cloudflare Tunnel, CNI or Cloudflare Mesh. Cloudflare says supported private address ranges enable private routing automatically. Argo Smart Routing and Aegis are not supported, and origin health checks require Load Balancing.
Why it matters
Internal APIs, AI agent backends and other services built for private networks may still need to accept requests from partners, customers or agents. This release lets teams put Cloudflare’s existing application protections in front of those services without making the origin publicly reachable or running connector software on it when using Cloudflare WAN or Mesh.
That is a useful piece of infrastructure for AI systems as well as ordinary private applications: agent backends can receive external requests while remaining on a private network. It is not a new AI product, but it addresses a practical networking problem for teams building and operating AI services.
Our read
This is a meaningful infrastructure release, not a grand new theory of AI. Its appeal is pleasantly practical: teams can apply familiar protections to private origins while keeping their existing network connections. Check the entitlement and routing requirements before planning a rollout; the private IP stays private, but the setup is not magic.
What to watch
- Whether Cloudflare adds support for the currently unavailable Argo Smart Routing and Aegis.
- Whether teams report that setup works smoothly across different Cloudflare One connection types.
- Cloudflare says private-to-private access through its application services is in development, with a closed beta targeted for early 2027. Activity teaser: Cloudflare has opened its private-origin service to general availability, bringing WAF, bot management, rate limiting, caching and Workers to origins that remain on private IP addresses. Teams need Cloudflare One connectivity, Unified Routing and a Private Origins entitlement, so this is useful infrastructure rather than a one-click shortcut. The release also covers AI agent backends that need to accept outside requests without exposing their origins. What should matter more when choosing this kind of setup: keeping origins private, or making deployment and routing simpler?
Discussion spark: For services such as AI agent backends, should teams prioritise keeping origins private even if setup requires extra network configuration, or favour simpler deployment?
Sources and evidence
- Cloudflare services for private origins is now generally available (30 October 2026, 14:23 UTC)
not affiliated with or endorsed by Cloudflare