Cloudflare now protects private company systems without exposing them

Cloudflare has made a feature generally available that lets a business shield a private server without making it public. The server, called an origin, is where an app actually runs. Until now, putting Cloudflare in front of it usually meant exposing it. Now the protections work while the origin keeps its private address.

What changed

Before, a company had three options: expose a public IP address, open a firewall port, or run a small program called cloudflared next to the server. Many teams skipped all three. Their private tools then went without the protections public sites get.

Now a company points a proxied DNS record at a private IP address. DNS is the system that matches a web address to a server. Cloudflare then reaches the origin over a private connection the company already runs. These features work as they do for public servers:

• Web application firewall (WAF), which filters harmful requests
• Bot management and rate limiting
• Caching and traffic acceleration
• Rewrites and Workers, Cloudflare's tool for running custom code

Who it affects

The target is internal APIs, AI agent backends, MCP servers and operational tools. These were not built to face the Internet, yet partners, customers or AI agents often need to reach them. The feature is open to every customer with Cloudflare One connectivity. It began as a closed beta in June.

How it works in practice

No inbound firewall exception is needed. With Cloudflare WAN or Cloudflare Mesh, there is no connector software to run on the origin either. Cloudflare can use several kinds of private links, including IPsec, GRE, Cloudflare Tunnel, CNI and Mesh.

For standard private address ranges, the private routing setting turns on automatically and cannot be turned off. If an origin has a public IP that is reachable only through a private network, the setting can be enabled by hand.

Limits to know

Some features are not supported yet. Argo Smart Routing and Aegis do not work with private origins. Origin health checks require Load Balancing. Cloudflare points to its developer documentation for the full list.

One tip from the beta: if requests time out and nothing reaches the origin, check the return route first. A missing route for Cloudflare's source range was the most common setup failure.

What happens next

Cloudflare is now working on private-to-private traffic. That would cover users, services and AI agents on one private network reaching apps on another. An employee opening an internal wiki could get the same firewall and bot protections. Engineering is underway, with a closed beta targeted for early 2027. Interested customers should talk to their account team.