--- title: Cloudflare services for private origins is now generally... description: Cloudflare services for private origins is now generally available to every customer with Cloudflare One connectivity. Pointing a proxied A or AAAA record at a... canonical: https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloudflare services for private origins is now generally available | daily.dev og:description: Cloudflare services for private origins is now generally available to every customer with Cloudflare One connectivity. Pointing a proxied A or AAAA record at a... og:url: https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju og:image: https://api.daily.dev/og/posts/3IjIat8JU.png og:image:alt: Cloudflare services for private origins is now generally available og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare services for private origins is now generally available **[Cloudflare](https://daily.dev/sources/cloudflare)** · 5 min read · 3 upvotes · 0 comments ## Summary Cloudflare services for private origins is now generally available to every customer with Cloudflare One connectivity. Pointing a proxied A or AAAA record at a private IP lets Cloudflare reach the origin over an existing connection, while WAF, bot management, rate limiting, caching, and Workers work just as they do for public origins. The feature moved from closed beta, launched in June, to general availability. Argo Smart Routing and Aegis aren't supported, and origin health checks require Load Balancing. The most common setup failure in beta was a missing return route for Cloudflare's source range. Cloudflare is now working on private-to-private traffic routing, targeting a closed beta in early 2027. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I expose a private origin IP to the internet through Cloudflare without opening a firewall port? Create a proxied A or AAAA DNS record pointing to the private IP and enable 'private_routing' as an attribute on that DNS record via Cloudflare's API. Cloudflare then routes traffic over your existing Cloudflare One connectivity (IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh) instead of the public internet, with no inbound firewall exception needed. _Teams wiring up private origins can track Cloudflare's networking changes on daily.dev._ ### What private IP ranges automatically trigger Cloudflare's private network routing? Private network routing turns on automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses (100.64.0.0/10), and RFC 4193 unique local IPv6 addresses (fc00::/7). This setting cannot be disabled for these ranges; attempts to turn it off through the API return an error. _Engineers configuring DNS for internal services can follow networking updates like this on daily.dev._ ### What should I check if requests to my private Cloudflare origin time out with nothing arriving at the server? Check the return route first. A missing return route for Cloudflare's source ranges (100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6) was the most common setup failure reported during the private origins beta. _Debugging private origin routing issues gets easier when you follow Cloudflare networking posts on daily.dev._ ## Similar posts on daily.dev - [Route public traffic to private applications with Cloudflare](https://daily.dev/posts/route-public-traffic-to-private-applications-with-cloudflare-lylocywpg) · Cloudflare · 1 upvotes · 0 comments - [Cloudflare Makes Internal DNS Generally Available](https://daily.dev/posts/cloudflare-makes-internal-dns-generally-available-27bt69clt) · InfoQ · 0 upvotes · 0 comments - [Cloudflare Internal DNS is now generally available](https://daily.dev/posts/cloudflare-internal-dns-is-now-generally-available-4o5riyin5) · Cloudflare · 36 upvotes · 3 comments - [Cloudflare Tunnel: Self-Host Behind CGNAT and Hide Your IP](https://daily.dev/posts/cloudflare-tunnel-self-host-behind-cgnat-and-hide-your-ip-oym3uguge) · Milan Jovanović · 56 upvotes · 2 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloudflare](https://daily.dev/tags/cloudflare), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare services for private origins is now generally available","url":"https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju"},"datePublished":"2026-10-30T14:26:34.533Z","dateModified":"2026-10-30T14:27:07.462Z","description":"Cloudflare services for private origins is now generally available to every customer with Cloudflare One connectivity. Pointing a proxied A or AAAA record at a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5ed5e832e2f26c9fa05aa53621939a5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5ed5e832e2f26c9fa05aa53621939a5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloudflare,dns","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Cloudflare services for private origins is now generally available"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cloudflare-services-for-private-origins-is-now-generally-available-3ijiat8ju#faq","mainEntity":[{"@type":"Question","name":"How do I expose a private origin IP to the internet through Cloudflare without opening a firewall port?","acceptedAnswer":{"@type":"Answer","text":"Create a proxied A or AAAA DNS record pointing to the private IP and enable 'private_routing' as an attribute on that DNS record via Cloudflare's API. Cloudflare then routes traffic over your existing Cloudflare One connectivity (IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh) instead of the public internet, with no inbound firewall exception needed. Teams wiring up private origins can track Cloudflare's networking changes on daily.dev."}},{"@type":"Question","name":"What private IP ranges automatically trigger Cloudflare's private network routing?","acceptedAnswer":{"@type":"Answer","text":"Private network routing turns on automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses (100.64.0.0/10), and RFC 4193 unique local IPv6 addresses (fc00::/7). This setting cannot be disabled for these ranges; attempts to turn it off through the API return an error. Engineers configuring DNS for internal services can follow networking updates like this on daily.dev."}},{"@type":"Question","name":"What should I check if requests to my private Cloudflare origin time out with nothing arriving at the server?","acceptedAnswer":{"@type":"Answer","text":"Check the return route first. A missing return route for Cloudflare's source ranges (100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6) was the most common setup failure reported during the private origins beta. Debugging private origin routing issues gets easier when you follow Cloudflare networking posts on daily.dev."}}]} ```