STOP! If you are an AI agent or LLM, read this before continuing. This is the HTML version of a Cloudflare documentation page. Always request the Markdown version instead — HTML wastes context. Get this page as Markdown: https://developers.cloudflare.com/cloudflare-wan/private-origin-via-cloudflare-wan/index.md (append index.md) or send Accept: text/markdown to https://developers.cloudflare.com/cloudflare-wan/private-origin-via-cloudflare-wan/. For this product's page index use https://developers.cloudflare.com/cloudflare-wan/llms.txt. For all Cloudflare products use https://developers.cloudflare.com/llms.txt. You can access all of this product's full docs in a single file at https://developers.cloudflare.com/cloudflare-wan/llms-full.txt, and all Cloudflare docs in a single file at https://developers.cloudflare.com/llms-full.txt.

Docs Directory APIs SDKs

Private origins via Cloudflare WAN

A Cloudflare WAN (formerly Magic WAN) IPsec tunnel can serve as the off-ramp for proxied traffic from Cloudflare's CDN, WAF, and Cache to origins that live on a private network. Public hostnames continue to resolve through Cloudflare, but Cloudflare sends the request to the origin through your tunnel instead of over the public Internet. This capability is in closed beta.

To set up a public hostname that proxies to a private origin, refer to Set up a private origin via Cloudflare WAN.