How does the private origins service work?

Cloudflare services for private origins now allows any customer with a Cloudflare One connection to protect their internal applications without exposing their public IP addresses. Unlike traditional setups, where exposing an internal service required either a public IP, firewall adjustments, or installing an agent like cloudflared, this solution uses an existing Cloudflare One connection to route traffic.

Concretely, a proxied DNS record (A or AAAA) can point to a private IP, and Cloudflare reaches the origin via the secure Cloudflare One network. Standard protections such as the WAF (Web Application Firewall), bot management, caching, and Workers apply automatically, just like for public origins. However, some advanced features like Argo Smart Routing or Aegis are not supported for private origins, according to Cloudflare.

Before this solution, exposing internal services like APIs or AI backends required either a public IP, firewall adjustments, or installing a dedicated agent.

What technical constraints and configurations are required?

Several technical prerequisites frame this solution. First, private network routing is automatically enabled for private address ranges defined by RFC 1918 (private IPv4), RFC 6598 (CGNAT, such as 100.64.0.0/10), and RFC 4193 (ULA IPv6, fc00::/7), and cannot be disabled via the API for these ranges, as indicated by Cloudflare. For private origins, health checks require the activation of the Load Balancing service.

A critical point revealed during the beta phase was the frequent absence of a return route for Cloudflare’s source IP ranges (100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6). Companies must explicitly configure this route to avoid traffic disruptions. Additionally, Cloudflare WAN and Cloudflare Mesh do not require connector software on the origin for private routing, but Mesh requires a connector in the private network to serve multiple origins.

Finally, Unified Routing is mandatory unless traffic passes through Cloudflare Tunnel. This latter option, already integrated into Cloudflare One, avoids complex configurations by encapsulating traffic in a secure tunnel.

What this means for businesses and administrations in West Africa

For Beninese or West African businesses, this innovation could simplify securing critical internal applications without relying on costly or complex infrastructure. For example, banks or public administrations managing sensitive internal systems (such as payment platforms or operational databases) could benefit from enhanced protection against attacks without exposing their internal IPs. This would reduce risks associated with opening firewall ports or using third-party solutions like cloudflared.

Local startups developing AI-based solutions or internal APIs could also leverage this solution to secure their backends while optimizing performance through Cloudflare’s caching and bot management. However, the lack of support for features like Argo Smart Routing could limit its adoption for use cases requiring advanced routing optimization.

In the longer term, the announced development of private-to-private routing (scheduled for closed beta in the first quarter of 2027) could open opportunities for African businesses looking to securely interconnect their data centers or remote offices without relying on external solutions. This could particularly interest regional groups or consortia of administrations sharing critical infrastructure.

What limitations and future developments to watch

Despite its advantages, this solution has limitations. Advanced features like Argo Smart Routing or Aegis (a DDoS attack protection service) are not compatible with private origins, which could be a barrier for some businesses. Additionally, the requirement to configure a return route for Cloudflare’s IP ranges demands heightened vigilance during deployment.

Cloudflare is, however, working on a major extension: private-to-private routing, announced for a closed testing phase early in 2027. This development would enable secure communication between internal applications without internet transit, a key advantage for regulated environments or distributed infrastructures. Interested businesses will need to monitor the progress of this beta to assess its fit for their needs.

Finally, access to the service remains conditional on an active connection to Cloudflare One, which may represent an initial investment for organizations not yet using this platform. However, the widespread adoption of this feature could encourage local players to adopt a unified approach to network security.