Route public traffic to private applications with Cloudflare

Cloudflare announces a closed-beta feature called Application Services for Private Origins that lets customers route traffic to private IP origins (via Cloudflare Tunnel, Cloudflare WAN, Mesh, IPsec, GRE, or CNI) while applying Cloudflare's WAF, bot management, rate limiting, caching, Spectrum, and Workers without exposing origins publicly. The feature uses a `use_private_routing` flag on proxied DNS records and extends to Layer 4 (Spectrum) and Workers VPC bindings, requiring appropriate private network connectivity and return routes; GA is targeted for Q4 2026.