Repository navigation
DNS: Private Origins GA prerequisites, limitations, and setup guides - #34628
Open
esomoza-cf wants to merge 17 commits into
Open
esomoza-cf wants to merge 17 commits into
esomoza-cf wants to merge 17 commits into
Conversation
esomoza-cf
requested review from
a team,
SebastiaanYN,
Woutifier,
chreo,
dklbreitling,
hannes-cf,
matildeopbravo,
svenr-cf,
vendemiat and
xofyarg
as code owners
October 27, 2026 00:03
Contributor
AI Review✅ Reviewed Commands
|
Contributor
Review coverage🟡 1 ownership area needs approval. Suggested reviewers: @chreo @hannes-cf
CODEOWNERS mappings for displayed areas (1)
|
Contributor
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://private-origins-ga.previews.developers.cloudflare.com (commit 0740977)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
ngayerie
reviewed
Oct 27, 2026
| ## Limitations | ||
|
|
||
| - Argo Smart Routing is not supported for private origins. | ||
| - Aegis is not supported for private origins. |
Collaborator
There was a problem hiding this comment.
Dedicated CDN Egress IPs?
https://developers.cloudflare.com/smart-shield/configuration/dedicated-egress-ips/
Collaborator
Author
There was a problem hiding this comment.
Good catch. Dedicated Egress IPs are not part of the private origins path today. Origin-bound traffic rides the private overlay (WAN, Tunnel, or Mesh), and the source IPs your origin sees are the Cloudflare source IP ranges documented above: 100.64.0.0/12 for IPv4 (default, configurable) and 2606:4700:cf1:5000::/64 for IPv6. Added a limitations line making that explicit in ee33e38, and I'll raise dedicated egress support for private origins with eng as a roadmap question.
hannes-cf
reviewed
Oct 30, 2026
| Connect Cloudflare's application services to your private network through secure tunnels. The CDN, WAF, Cache, and other proxied features apply to this traffic the same way they apply to traffic destined for public origins. | ||
|
|
||
| Getting started takes three steps. Follow the [setup guide](/dns/private-origins/set-up-via-cloudflare-wan/) to configure a tunnel, create a DNS record with [private network routing](/dns/private-origins/private-network-routing/), and verify end-to-end connectivity. | ||
| To get started, check the [prerequisites](#prerequisites), follow the setup guide for your connectivity type, then create a DNS record with [private network routing](/dns/private-origins/private-network-routing/). |
Collaborator
There was a problem hiding this comment.
Suggested change
| To get started, check the [prerequisites](#prerequisites), follow the setup guide for your connectivity type, then create a DNS record with [private network routing](/dns/private-origins/private-network-routing/). | |
| To get started, check the [prerequisites](#prerequisites), follow the setup guide for your connectivity type, then create a DNS record with [private network routing](/dns/private-origins/private-network-routing/) enabled. |
Collaborator
Author
There was a problem hiding this comment.
Applied in 0740977, and I think yours reads better, the added "enabled." is what makes the line complete. Thanks for sticking with it!
hannes-cf
reviewed
Oct 30, 2026
|
|
||
| ## Prerequisites | ||
|
|
||
| - **Private Origins entitlement** on your account. Contact your account team to enable it. |
Collaborator
There was a problem hiding this comment.
Suggested change
| - **Private Origins entitlement** on your account. Contact your account team to enable it. | |
| - **Private Origins** is available for your account. Contact your account team to enable it. |
We shouldn't mention entitlement in the dev docs.
hannes-cf
reviewed
Oct 30, 2026
| - **Cloudflare One connectivity** to the network where your origin lives: Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh. | ||
| - **A route to the origin in your default virtual network.** Private network routing does not support selecting another virtual network. | ||
| - **For Cloudflare WAN and Cloudflare Mesh only:** | ||
| - [Unified Routing](/cloudflare-wan/reference/traffic-steering/#unified-routing) on your account. Contact your account team to enable it. This applies to new and existing accounts. |
Collaborator
There was a problem hiding this comment.
Suggested change
| - [Unified Routing](/cloudflare-wan/reference/traffic-steering/#unified-routing) on your account. Contact your account team to enable it. This applies to new and existing accounts. | |
| - [Unified Routing](/cloudflare-wan/reference/traffic-steering/#unified-routing) is available for your account. Contact your account team to enable it. This applies to new and existing accounts. |
Just to be consistent with the private origins bullet point above.
hannes-cf
reviewed
Oct 30, 2026
| - Zero Trust network session logs are not available for this traffic. | ||
| - [Spectrum](/spectrum/) private origins are in beta. Proxy Protocol is not delivered over private networks yet. | ||
|
|
||
| :::caution[Known issue: Tiered Cache] |
Collaborator
There was a problem hiding this comment.
Suggested change
| :::caution[Known issue: Tiered Cache] | |
| :::caution |
To my knowledge the convention for our dev docs is not to use titles in caution / warning / info boxes.
hannes-cf
reviewed
Oct 30, 2026
| Before you enable private network routing, consider the following: | ||
|
|
||
| - You need an active tunnel connection to Cloudflare through one of the supported on-ramp methods. Refer to [Cloudflare WAN](/cloudflare-wan/on-ramps/) for further guidance. | ||
| - You need the Private Origins entitlement and a working connection to your private network through Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh. The route to the origin must be in your default virtual network. |
Collaborator
There was a problem hiding this comment.
Suggested change
| - You need the Private Origins entitlement and a working connection to your private network through Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh. The route to the origin must be in your default virtual network. | |
| - Private Origins needs to be available on your account and you need a working connection to your private network through Cloudflare WAN (IPsec, GRE, or CNI), Cloudflare Tunnel, or Cloudflare Mesh. The route to the origin must be in your default virtual network. |
As mentioned before, we shouldn't mention entitlements.
hannes-cf
reviewed
Oct 30, 2026
| | `fc00::/7` | Private ([RFC 4193](https://www.rfc-editor.org/rfc/rfc4193.html)) | | ||
| | `100.64.0.0/10` | CGNAT ([RFC 6598](https://www.rfc-editor.org/rfc/rfc6598.html)) | | ||
|
|
||
| :::caution[CGNAT origins and the Cloudflare source range] |
Collaborator
There was a problem hiding this comment.
Suggested change
| :::caution[CGNAT origins and the Cloudflare source range] | |
| :::caution |
same comment as before
hannes-cf
reviewed
Oct 30, 2026
| - **Active Cloudflare WAN subscription**: This capability requires a Cloudflare WAN subscription on your account. | ||
| - **Access to private origins enabled on your account**: This is a separate entitlement from standard authoritative DNS access. Contact your Cloudflare account team to request access. | ||
| - **Active Cloudflare WAN subscription**: this guide requires a Cloudflare WAN subscription on your account. | ||
| - **Private Origins entitlement**: required on your account. It is separate from standard authoritative DNS access. Contact your account team to enable it. |
Collaborator
There was a problem hiding this comment.
same comment as before, we shouldn't mention entitlements
hannes-cf
reviewed
Oct 30, 2026
|
|
||
| Confirm the following before you start: | ||
|
|
||
| - **Private Origins entitlement**: required on your account. It is separate from standard authoritative DNS access. Contact your account team to enable it. |
Collaborator
There was a problem hiding this comment.
same comment as before, we shouldn't mention entitlements
hannes-cf
reviewed
Oct 30, 2026
|
|
||
| Confirm the following before you start: | ||
|
|
||
| - **Private Origins entitlement**: required on your account. It is separate from standard authoritative DNS access. Contact your account team to enable it. |
Collaborator
There was a problem hiding this comment.
same comment as before, we shouldn't mention entitlements
hannes-cf
reviewed
Oct 30, 2026
Comment on lines
32
to
34
| :::note[Closed beta] | ||
| This feature is in closed beta. Contact your account team to request access. | ||
| ::: |
Collaborator
There was a problem hiding this comment.
Suggested change
| :::note[Closed beta] | |
| This feature is in closed beta. Contact your account team to request access. | |
| ::: |
Shouldn't we remove this now it's GA?
If not, let's change the box to:
:::note
Collaborator
Author
|
Thanks for the review @hannes-cf — all comments addressed in b22e448:
One for your call: troubleshooting.mdx still says "your account does not have the Private Origins entitlement" (line 24) because it describes an actual error message customers see. Left as-is for accuracy, but happy to align it if you'd rather drop the word there too. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part A of the Private Origins GA docs update (branch
private-origins-ga). Part B (beta label removal, title rename to "Cloudflare Services for Private Origins", changelog entry) will follow on publish day fromprivate-origins-ga-labels.One commit per step:
100.64.0.0/12(configurable) and2606:4700:cf1:5000::/64(not configurable).tunnel,cloudflare-mesh,spectrum,workers-vpc,cloudflare-wan).## IP rangesto## Automatically detected ranges, fixed the one#ip-rangesanchor in the repo, added the CGNAT overlap caution (100.64.0.0/12sits inside detected100.64.0.0/10).1360, IPv6 return route), IPv6 tcpdump example, three new pitfall rows.set-up-via-cloudflare-tunnel.mdx(no Unified Routing or return routes needed;cloudflaredhost is the source).set-up-via-cloudflare-mesh.mdx.Deviation from the original spec
The Enterprise
<Plan>component was removed from the overview at Enrique's request. The Private Origins entitlement requirement itself is unchanged throughout.Needs SME confirmation
Checks
pnpm run check(astro + worker): cleanpnpm run build: 9,541 pages, exit 0/dns/private-origins/pages (only the repo-wide pre-existingindex.md/ hash noise that the anchor-link-audit workflow already tracks)cc @esomoza-cf — @marcio Florindo, loop-in requested (couldn't resolve your handle; please self-assign).