Private network routing

Private network routing allows you to proxy HTTP/HTTPS traffic from public hostnames to origins in your private network. When you enable this setting on a DNS record, Cloudflare reaches the origin over your private network connectivity instead of the public Internet.

For end-to-end setup, refer to the guide for your connectivity type: Cloudflare WAN, Cloudflare Tunnel, or Cloudflare Mesh.

Before you enable private network routing, consider the following:

• Private Origins needs to be available on your account and you need a working connection to your private network through Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh. The route to the origin must be in your default virtual network.
• If you connect over Cloudflare WAN or Cloudflare Mesh, your account must be on Unified Routing. Contact your account team to enable it. This applies to new and existing accounts. Cloudflare Tunnel does not need Unified Routing.
• Private network routing is available for A (IPv4) and AAAA (IPv6) records only. Records must be proxied.
• If you have multiple A or AAAA records on the same name, and at least one of them has private network routing enabled, all records on that name will use private network routing. This is consistent with the proxy status behavior in these cases.

The following private address ranges are automatically detected:

When you use an IP address from one of these ranges, the Use private network routing toggle turns on automatically. You can also turn it on manually for public IP addresses that are only reachable through your tunnel.

When Cloudflare reaches an origin over Cloudflare WAN or Cloudflare Mesh, traffic comes from the Cloudflare source IP ranges:

Add return routes in your private network that send these ranges back to Cloudflare, and allow them in your origin's firewall. Refer to Configure Cloudflare source IPs.

Behind Cloudflare Tunnel, your origin sees the host running cloudflared as the source instead.

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"type": "A",
		"name": "app.example.com",
		"content": "10.0.0.50",
		"proxied": true,
		"private_routing": true
	}'

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"private_routing": true
	}'

If you use the API to create or edit DNS records with private network routing, consider the following:

Also, if you manually set private_routing: false on a proxied A/AAAA record with private IP, the API will return an error.