Cloudflare launches private origins DNS routing beta

Cloudflare has begun testing a new feature designed to simplify how enterprises expose private applications to the public internet. The service, called Application Services for Private Origins, allows organizations to route traffic from public hostnames directly to private IP addresses without requiring public-facing IPs or additional connector software on their infrastructure.

The beta is currently available to select customers and supports existing secure paths such as IPsec, GRE, CNI, or Cloudflare Mesh. This approach aims to reduce complexity for enterprises managing hybrid or multi-cloud environments, where private applications often require workarounds to be accessible externally.

How it works

The service leverages Cloudflare’s global DNS and networking infrastructure to resolve public hostnames to private IP origins. By integrating with existing secure tunnels or direct connections, enterprises can maintain private addressing schemes while still allowing external users or services to reach internal applications. Cloudflare states this eliminates the need for NAT gateways, bastion hosts, or other traditional methods of exposing private resources.

Enterprises must already have a secure path established with Cloudflare, such as a site-to-site VPN, GRE tunnel, or Cloudflare Mesh connection. The beta does not introduce new connectivity requirements but instead builds on these existing links to enable DNS-based routing to private IPs. This could reduce operational overhead for teams managing both public and private application endpoints.

Potential use cases

The feature targets enterprises running internal applications—such as development environments, internal tools, or legacy systems—that need to be accessible to remote employees, partners, or customers without being exposed to the public internet. For example, a company could use this to provide secure access to an internal dashboard or API without assigning a public IP or deploying additional proxy software.

Another potential use case involves multi-cloud or hybrid cloud setups, where applications span private data centers and public cloud environments. By routing traffic through Cloudflare’s network, enterprises could maintain consistent DNS resolution while keeping internal addressing private. This could also simplify compliance requirements for industries handling sensitive data, as private IPs remain isolated from public exposure.

Limitations and next steps

As a closed beta, the feature is not yet available to all Cloudflare customers. The company has not disclosed a timeline for general availability or pricing details. Enterprises interested in testing the service must apply through Cloudflare’s beta program.

The beta’s current scope is limited to DNS routing over existing secure paths. It does not include additional security features such as DDoS protection or WAF rules, which would still need to be configured separately. Cloudflare has not indicated whether these capabilities will be integrated in future releases.