This guide walks you through proxying public hostnames to origins on a private network. The private network is reachable through a Cloudflare Tunnel running cloudflared. The CDN, WAF, Cache, and other proxied features apply to this traffic the same way they apply to traffic destined for public origins.
Confirm the following before you start:
- Private Origins available on your account: contact your account team to enable it.
- A healthy
cloudflaredtunnel: the connector must run on a host that can reach the origin. Refer to Get started with Cloudflare Tunnel. - A private network route covering the origin IP: add a route (CIDR) for the origin's network to the tunnel, in your default virtual network. Refer to Connect a private network CIDR.
Private network routing over Cloudflare Tunnel does not require Unified Routing or return routes for Cloudflare source IP ranges. Your origin sees the host running cloudflared as the source of incoming traffic.
Create an A or AAAA record that points to the private IP address of your origin, with proxy status enabled and Use private network routing turned on. This tells Cloudflare to send traffic for the hostname through your tunnel instead of over the public Internet.
For the dashboard and API steps, refer to Private network routing.
After the DNS record is in place, validate the path from the Cloudflare network through your tunnel to the origin.
In the Cloudflare dashboard, confirm that the tunnel carrying the route to your origin shows as healthy. If the tunnel is down, refer to Tunnel troubleshooting.
From a machine outside your private network, send an HTTPS request to the proxied hostname:
curl -v https://<YOUR_DOMAIN>/A successful response confirms that Cloudflare accepted the request, applied your proxied features, and reached the origin through the tunnel.
On the origin VM, verify that requests are arriving from the host running cloudflared. To watch for incoming traffic from that host on port 443, replace <CLOUDFLARED_HOST_IP> with its IP address:
sudo tcpdump -n -i any 'src host <CLOUDFLARED_HOST_IP> and dst port 443'Adjust the port to match the listener on your origin.
| Symptom | Cause and fix |
|---|---|
| Traffic never reaches the tunnel | The route to the origin is in a non-default virtual network. Move it to the default virtual network. |
| Origin rejects connections | The origin firewall does not allow the host running cloudflared. Allow it. |
| Traffic tries to route over the public Internet | The Use private network routing toggle is not turned on for the DNS record. Edit the record and turn the toggle on. |
- Review the Private network routing reference for dashboard and API details.
- If traffic is not reaching your origin, refer to Troubleshooting.