Cloudflare Private Origins and Cloudflare Tunnel: Hide Your Origin Server Completely

Cloudflare just entered closed beta for Application Services for Private Origins — a feature that lets you route traffic through Cloudflare even when your origin server has no public IP at all. This post explains what “private origins” means, how it compares to the classic Cloudflare Tunnel setup, and what practical steps you can take today (with or without beta access) to harden the connection between Cloudflare and your origin.

The Problem: Cloudflare Cannot Protect What It Cannot Reach

Standard Cloudflare proxying works like this: your origin server has a public IP, DNS points to Cloudflare, and Cloudflare forwards filtered traffic to that IP. The assumption is that your origin is reachable over the public internet — Cloudflare just stands in front of it.

This creates two weaknesses. First, your origin IP is reachable from anywhere, so an attacker who discovers it can bypass Cloudflare entirely. Second, the connection from Cloudflare to your origin travels over the public internet, which means it is exposed to scanning, interception, and abuse from within Cloudflare's own shared infrastructure.

Private origins solve both problems by removing the public IP requirement. Instead of Cloudflare reaching out to your server, your server connects out to Cloudflare through an encrypted tunnel. The origin never needs to listen on a public port at all.

What Cloudflare Is Announcing (Closed Beta)

According to Cloudflare's developer documentation, Application Services for Private Origins extends Cloudflare's existing Tunnel technology to cover all Cloudflare application services — WAF, Bot Management, Cache, Workers — not just basic proxying. In the closed beta, you can put a site fully behind Cloudflare without assigning it a public IP, and every Cloudflare service still applies normally. The waitlist is open via Cloudflare's dashboard under the Zero Trust section.

This is significant for small SaaS products and personal projects that currently use a VPS with a public IP because it means you can run your origin on a private network (including Cloudflare's own WARP-connected network) and still get the full Cloudflare security stack in front of it.

How Cloudflare Tunnel Works Today

Even without the beta, you can set up a private origin using Cloudflare Tunnel (formerly Argo Tunnel). The cloudflared daemon runs on your server, opens persistent outbound connections to Cloudflare's edge, and registers a named tunnel. Cloudflare routes traffic for your hostname through that tunnel — no inbound firewall rule needed.

# Install cloudflared on your VPS (Debian/Ubuntu)
curl -L https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list
sudo apt update && sudo apt install cloudflared

# Authenticate and create a tunnel
cloudflared tunnel login
cloudflared tunnel create my-origin

# Create a config file at ~/.cloudflared/config.yml
# Then run as a service
sudo cloudflared service install

Once the tunnel is running, you can close ports 80 and 443 on your firewall entirely. Cloudflare reaches your origin through the tunnel; nobody else can.

Private Origins vs. Classic Cloudflare Proxy: Comparison

Setting Up Cloudflare Tunnel: Step-by-Step

Here is the complete setup for a VPS running Nginx. Adjust the local address if you use Apache, Caddy, or a Node.js process on a different port.

1. Install cloudflared on your VPS using the commands above.
2. Authenticate: run cloudflared tunnel login. This opens a browser window to authorise your Cloudflare account and writes a certificate to~/.cloudflared/cert.pem.
3. Create the tunnel: cloudflared tunnel create my-origin. This creates a tunnel with a UUID and writes credentials to ~/.cloudflared/<UUID>.json.
4. Write the config file at ~/.cloudflared/config.yml:

   tunnel: <your-tunnel-uuid>
   credentials-file: /root/.cloudflared/<uuid>.json
   
   ingress:
     - hostname: yourdomain.com
       service: http://localhost:80
     - hostname: www.yourdomain.com
       service: http://localhost:80
     - service: http_status:404

5. Add a DNS record via cloudflared: cloudflared tunnel route dns my-origin yourdomain.com. This creates aCNAME pointing to the tunnel's Cloudflare address — no A record with your IP.
6. Install as a service: sudo cloudflared service install, then sudo systemctl start cloudflared.
7. Close inbound ports 80/443 on your firewall: sudo ufw delete allow 80/tcp && sudo ufw delete allow 443/tcp.

What About Shared Hosting?

Cloudflare Tunnel requires running the cloudflared daemon as a persistent process, which is not possible on shared hosting (no root, no daemon control). If you are on cPanel shared hosting, your best options remain:

• Classic Cloudflare proxy (orange cloud) with SSL Full (Strict)
• Firewall allowlist for Cloudflare IPs — ask your host to apply it at the server level
• .htaccess block for requests not carrying the CF-Connecting-IP header (partial mitigation)

For shared hosting, the private origins beta is not yet applicable. It is aimed at VPS, bare metal, and private cloud workloads.

Practical Checklist

1. If you have VPS root access: set up Cloudflare Tunnel and close public ports 80/443
2. Remove all A/AAAA records pointing to your origin IP — replace with CNAME to the tunnel
3. Keep SSH access restricted to your admin IP only (port 22 should never be open to all)
4. Verify no direct IP access: curl -k https://YOUR_IP/ should time out or refuse
5. Sign up for the private origins beta via Cloudflare Zero Trust dashboard if you want WAF + Workers over a private origin
6. Shared hosting users: enable SSL Full (Strict) and request Cloudflare IP allowlisting from your host

Conclusion

Cloudflare's move toward private origins formalises what developers have been doing with Cloudflare Tunnel for years: running origins that are completely invisible to the public internet. If you have a VPS, setting up cloudflared today takes under 30 minutes and immediately closes the most common bypass vector — a discoverable origin IP. If you are on shared hosting, combining orange-cloud proxying, SSL Full (Strict), and a host-level Cloudflare allowlist gets you most of the same protection without needing daemon access.