Private network routing

Private network routing allows you to proxy HTTP/HTTPS traffic from public hostnames to origins in your private network. When you enable this setting on a DNS record, Cloudflare routes traffic through your configured tunnel instead of over the public Internet.

For an end-to-end setup walkthrough using Cloudflare WAN (formerly Magic WAN) IPsec, refer to Set up a private origin via Cloudflare WAN.

Before you enable private network routing, consider the following:

• You need an active tunnel connection to Cloudflare through one of the supported on-ramp methods. Refer to Cloudflare WAN for further guidance.
• Private network routing is available for A (IPv4) and AAAA (IPv6) records only. Records must be proxied.
• If you have multiple A or AAAA records on the same name, and at least one of them has private network routing enabled, all records on that name will use private network routing. This is consistent with the proxy status behavior in these cases.

The following private address ranges are automatically detected:

When you use an IP address from one of these ranges, the Use private network routing toggle turns on automatically. You can also turn it on manually for public IP addresses that are only reachable through your tunnel.

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"type": "A",
		"name": "app.example.com",
		"content": "10.0.0.50",
		"proxied": true,
		"private_routing": true
	}'

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"private_routing": true
	}'

If you use the API to create or edit DNS records with private network routing, consider the following:

Also, if you manually set private_routing: false on a proxied A/AAAA record with private IP, the API will return an error.