Skip to content

Cloudflare Services for Private Origins

Last updated View as MarkdownAgent setup

Proxy HTTP/HTTPS traffic from public hostnames to origins in your private network.

Connect Cloudflare's application services to origins in your private network. Traffic reaches the origin over your existing Cloudflare One connectivity: Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh. The CDN, WAF, Cache, and other proxied features apply to this traffic the same way they apply to traffic destined for public origins.

To get started, check the prerequisites, follow the setup guide for your connectivity type, then create a DNS record with private network routing enabled.

Prerequisites

  • Private Origins is available for your account. Contact your account team to enable it.
  • Cloudflare One connectivity to the network where your origin lives: Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh.
  • A route to the origin in your default virtual network. Private network routing does not support selecting another virtual network.
  • For Cloudflare WAN and Cloudflare Mesh only:
    • Unified Routing is available for your account. Contact your account team to enable it. This applies to new and existing accounts.
    • Return routes in your private network for the Cloudflare source IP ranges: 100.64.0.0/12 for IPv4 (default, configurable) and 2606:4700:cf1:5000::/64 for IPv6.

Cloudflare Tunnel does not need Unified Routing or return routes. Your origin sees the host running cloudflared as the source.

Limitations

  • Argo Smart Routing is not supported for private origins.
  • Dedicated CDN Egress IPs are not supported for private origins. The source IPs your origin sees are the Cloudflare source IP ranges.
  • Origin health checks require Load Balancing. Configurations without Load Balancing do not get origin health visibility.
  • Traffic uses your default virtual network. Selecting another virtual network is not supported.
  • Zero Trust network session logs are not available for this traffic.
  • Spectrum private origins are in beta. Proxy Protocol is not delivered over private networks yet.

Private network connectivity also works beyond HTTP. Spectrum (beta) can sit in front of TCP and UDP services on private IPs, and Workers VPC bindings let Workers reach private origins directly.

Resources

Cloudflare WAN

Connect your private network to Cloudflare with IPsec, GRE, or CNI.

Cloudflare Tunnel

Connect individual hosts and networks to Cloudflare with cloudflared.

Cloudflare Mesh

Connect devices and sites to Cloudflare with the Mesh client.

Spectrum

Proxy TCP and UDP traffic to services on private IPs.

Workers VPC

Let Workers reach private origins directly through bindings.

Was this helpful?