Cloudflare can proxy public requests to a private origin address

Cloudflare services for private origins is generally available: a proxied DNS record can point to a private address reached over an existing Cloudflare One connection. WAF rules, caching, bot management and Workers still run at Cloudflare’s edge, while the origin needs no public inbound opening. This release handles public requests reaching private servers; private-to-private application traffic remains planned work.

Cloudflare · Oct 30, 2026

Why it matters

Teams can apply edge controls to internal backends without making the origin itself directly reachable from the public Internet.

More context

The October 30 release requires an account entitlement and supported private connectivity; most connection types also need Unified Routing. Request enablement through the account team, then test DNS and return routing with a noncritical origin. Missing return routes were a common beta setup failure.

Keep in mind

General availability does not mean automatic access or verified pricing. Argo Smart Routing and Dedicated CDN Egress IPs are unsupported, and origin health checks require Load Balancing.

Original read