Skip to content

Commit 52fb867

Browse files
RebeccaTamachiroRebeccaTamachiro
committed
Automated first pass
1 parent 8bc2715 commit 52fb867

3 files changed

Lines changed: 151 additions & 15 deletions

File tree

‎src/content/docs/dns/manage-dns-records/how-to/create-dns-records.mdx‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,15 @@ sidebar:
88
order: 2
99
---
1010

11-
import { GlossaryTooltip, Render, TabItem, Tabs, Details, DashButton, DirectoryListing } from "~/components";
11+
import {
12+
GlossaryTooltip,
13+
Render,
14+
TabItem,
15+
Tabs,
16+
Details,
17+
DashButton,
18+
DirectoryListing,
19+
} from "~/components";
1220

1321
Consider the sections below for step-by-step instructions on managing DNS records at Cloudflare.
1422

@@ -37,6 +45,7 @@ To create a DNS record in the dashboard:
3745
4. Complete the required fields, which vary per record. Particularly important fields (for some records) include:
3846
- **Proxy status**: For `A`, `AAAA`, and `CNAME` records, decide whether hostname traffic is <GlossaryTooltip term="proxy status" link="/dns/proxy-status/">proxied through Cloudflare</GlossaryTooltip>.
3947
- **TTL**: Short for [_Time to Live_](/dns/manage-dns-records/reference/ttl/), this field controls how long each record is valid and — as a result — how long it takes for record updates to reach your end users.
48+
- **Private network routing**: For `A` and `AAAA` records, route traffic to private origins through your tunnels. Refer to [Private network routing](/dns/manage-dns-records/how-to/private-network-routing/).
4049
- **Comment** and **Tag**: [Record attributes](/dns/manage-dns-records/reference/record-attributes/) meant for your reference.
4150
5. Select **Save**.
4251

@@ -114,4 +123,4 @@ This allows you to route requests using products such as [Redirect Rules](/rules
114123

115124
## Further guidance
116125

117-
<DirectoryListing folder="/dns/manage-dns-records/how-to/"/>
126+
<DirectoryListing folder="/dns/manage-dns-records/how-to/" />

‎src/content/docs/dns/manage-dns-records/how-to/private-network-routing.mdx‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
pcx_content_type: how-to
3+
description: Route DNS record traffic to private origins through tunnels.
4+
products:
5+
- dns
6+
title: Private network routing
7+
sidebar:
8+
order: 8
9+
badge: Beta
10+
tags:
11+
- Private networks
12+
---
13+
14+
import { Tabs, TabItem, DashButton, Plan } from "~/components";
15+
16+
<Plan type="enterprise" />
17+
18+
Private network routing lets you proxy HTTP/HTTPS traffic from public hostnames to origins in your private network. When you enable this setting on a DNS record, Cloudflare routes traffic through your configured tunnel instead of over the public internet.
19+
20+
:::note
21+
This feature is in closed beta. Contact your account team to request access and the **Private Origins Allowed** entitlement.
22+
:::
23+
24+
## Prerequisites
25+
26+
Before you enable private network routing, you need:
27+
28+
- An active tunnel connection to Cloudflare through one of the supported on-ramp methods ([Cloudflare WAN](/cloudflare-wan/), [WARP Connector](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/), [IPsec](/cloudflare-wan/configuration/manually/how-to/configure-tunnel-endpoints/), [GRE](/cloudflare-wan/configuration/manually/how-to/configure-tunnel-endpoints/), or [CNI](/network-interconnect/)).
29+
- The **Private Origins Allowed** entitlement enabled on your account.
30+
31+
## Supported records and IP ranges
32+
33+
Private network routing is available for `A` (IPv4) and `AAAA` (IPv6) records only. Records must be [proxied](/dns/proxy-status/).
34+
35+
The following private address ranges are automatically detected:
36+
37+
| Range | Description |
38+
| ---------------- | ------------------ |
39+
| `10.0.0.0/8` | Private (RFC 1918) |
40+
| `172.16.0.0/12` | Private (RFC 1918) |
41+
| `192.168.0.0/16` | Private (RFC 1918) |
42+
43+
When you use an IP address from one of these ranges, the **Use private network routing** toggle turns on automatically. You can also turn it on manually for public IP addresses that are only reachable through your tunnel.
44+
45+
## Enable private network routing
46+
47+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
48+
49+
1. Go to **DNS** > **Records**.
50+
51+
<DashButton url="/?to=/:account/:zone/dns/records" />
52+
53+
2. Select **Add record** or select **Edit** on an existing `A` or `AAAA` record.
54+
3. Enter the origin IP address.
55+
4. Verify that **Proxy status** is enabled (orange cloud).
56+
5. Turn on **Use private network routing**.
57+
6. Select **Save**.
58+
59+
:::note
60+
For private IP addresses (for example, `10.0.0.50`), the toggle turns on automatically. For public IP addresses used with private infrastructure, turn on the toggle manually.
61+
:::
62+
63+
</TabItem>
64+
65+
<TabItem label="API">
66+
67+
To create a record with private routing enabled, use a [POST request](/api/resources/dns/subresources/records/methods/create/) and set `private_routing` to `true`:
68+
69+
```bash
70+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
71+
--header "Authorization: Bearer <API_TOKEN>" \
72+
--header "Content-Type: application/json" \
73+
--data '{
74+
"type": "A",
75+
"name": "app.example.com",
76+
"content": "10.0.0.50",
77+
"proxied": true,
78+
"private_routing": true
79+
}'
80+
```
81+
82+
To enable private routing on an existing record, use a [PATCH request](/api/resources/dns/subresources/records/methods/edit/):
83+
84+
```bash
85+
curl --request PATCH \
86+
"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}" \
87+
--header "Authorization: Bearer <API_TOKEN>" \
88+
--header "Content-Type: application/json" \
89+
--data '{
90+
"private_routing": true
91+
}'
92+
```
93+
94+
</TabItem> </Tabs>
95+
96+
## API field behavior
97+
98+
| Scenario | `private_routing` value |
99+
| ---------------------------------------- | ----------------------- |
100+
| New `A`/`AAAA` record with private IP | Auto-set to `true` |
101+
| New `A`/`AAAA` record with public IP | Defaults to `false` |
102+
| Private IP with `private_routing: false` | Returns error |
103+
| Non-`A`/`AAAA` record types | Field not supported |
104+
| Account without entitlement | Field not visible |
105+
106+
## Limitations
107+
108+
- **Record types**: Only `A` and `AAAA` records support private network routing.
109+
- **Proxy status**: Records must be proxied. DNS-only records cannot use private routing.
110+
- **Virtual networks**: Traffic routes through your default [virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/). Selecting a specific virtual network is not supported.
111+
112+
## Troubleshooting
113+
114+
### Traffic not reaching origin
115+
116+
If traffic is not reaching your private origin:
117+
118+
1. Verify your tunnel is active and healthy in the Cloudflare dashboard.
119+
2. Confirm the origin IP is routable within your private network.
120+
3. Check that `private_routing` is set to `true` on the DNS record.
121+
4. Verify the record has proxy status enabled.
122+
123+
### Error 1002: DNS points to prohibited IP
124+
125+
This error occurs when you proxy a private IP address without the **Private Origins Allowed** entitlement. Contact your account team to enable this entitlement.

‎src/content/docs/dns/manage-dns-records/reference/dns-record-types.mdx‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -36,20 +36,22 @@ At least one **IP address resolution** record is required for each domain on Clo
3636

3737
These records include the following fields:
3838

39-
<Render file="records-name-field" product="dns" />
40-
- **IPv4/IPv6 address**: Your origin server address (cannot be a [Cloudflare IP](https://www.cloudflare.com/ips))
39+
<Render file="records-name-field" product="dns" />- **IPv4/IPv6 address**: Your
40+
origin server address (cannot be a [Cloudflare
41+
IP](https://www.cloudflare.com/ips))
4142

42-
:::note
43+
:::note
4344

44-
Cloudflare uses the [canonical notation](https://www.rfc-editor.org/rfc/rfc5952.html#section-4.2) to store DNS records. This means that an AAAA record with content `fe80::0:0:1` is stored and returned as `fe80::1`, for example.
45+
Cloudflare uses the [canonical notation](https://www.rfc-editor.org/rfc/rfc5952.html#section-4.2) to store DNS records. This means that an AAAA record with content `fe80::0:0:1` is stored and returned as `fe80::1`, for example.
4546

46-
Alternative notations of IPv4 addresses (`1.1` for `1.0.0.1`, for example) are not supported for A records.
47-
:::
47+
Alternative notations of IPv4 addresses (`1.1` for `1.0.0.1`, for example) are not supported for A records.
48+
:::
4849

4950
- **TTL**: Time to live, which controls how long DNS resolvers should cache a response before revalidating it.
5051
- If the **Proxy Status** is **Proxied**, this value defaults to **Auto**, which is 300 seconds.
5152
- If the **Proxy Status** is **DNS Only**, you can customize the value.
5253
- **Proxy status**: For more details, refer to [Proxied DNS records](/dns/proxy-status/).
54+
- **Private network routing**: Route traffic to private origins through your tunnels. For more details, refer to [Private network routing](/dns/manage-dns-records/how-to/private-network-routing/).
5355

5456
#### Example API call
5557

@@ -108,13 +110,13 @@ When creating A or AAAA records [using the API](/dns/manage-dns-records/how-to/c
108110

109111
These records include the following fields:
110112

111-
112-
<Render file="records-name-field" product="dns" />
113-
- **Target**: The hostname where traffic should be directed (`example.com`).
114-
- **TTL**: Time to live, which controls how long DNS resolvers should cache a response before revalidating it.
115-
- If the **Proxy Status** is **Proxied**, this value defaults to **Auto**, which is 300 seconds.
116-
- If the **Proxy Status** is **DNS Only**, you can customize the value.
117-
- **Proxy status**: For more details, refer to [Proxied DNS records](/dns/proxy-status/).
113+
<Render file="records-name-field" product="dns" />- **Target**: The hostname
114+
where traffic should be directed (`example.com`). - **TTL**: Time to live, which
115+
controls how long DNS resolvers should cache a response before revalidating it.
116+
- If the **Proxy Status** is **Proxied**, this value defaults to **Auto**, which
117+
is 300 seconds. - If the **Proxy Status** is **DNS Only**, you can customize the
118+
value. - **Proxy status**: For more details, refer to [Proxied DNS
119+
records](/dns/proxy-status/).
118120

119121
#### Proxied CNAME records
120122

0 commit comments

Comments
 (0)