The reliable way to hide an origin IP is to make a reverse proxy or CDN the only public front door, then enforce that design at the network layer. Proxy every web A and AAAA record, allow inbound traffic only from the proxy, and reject all other connections. If the address was public before you enabled proxying, replace it; DNS history and forgotten hostnames can preserve the old address.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
For stronger isolation than DNS indirection, use an outbound-only tunnel or place the origin in a private subnet that has no public route. These designs prevent a discovered address from becoming a direct path to the server.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What hiding an origin IP actually means
A visitor normally resolves your hostname to an IP address and connects directly to the web server. Hiding the origin changes that path: public DNS returns the reverse proxy or CDN address, the proxy terminates the visitor connection, and it makes a separate request to your origin.
That arrangement conceals the address from ordinary DNS lookups, but it is not an access control by itself. Anyone who learns an old address, an alternate hostname, a DNS-only record, or an exposed service can still try to connect directly unless the origin firewall rejects traffic that did not come through the proxy.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Think of the work as two separate controls:
- Discovery control: keep the origin address out of current DNS answers, application responses, and other public records.
- Ingress control: make the origin accept requests only from the chosen proxy, tunnel, or private network path.
Both are required. A CDN can hide an address from a new lookup while leaving a known address reachable, and a firewall cannot prevent disclosure if another record or service publishes the address.
Choose an architecture before changing DNS
| Approach | Does the origin have a public route? | How ingress is controlled | Operational complexity | Non-HTTP services | Plan or tier qualification |
|---|---|---|---|---|---|
| Cloudflare proxied DNS/CDN | Usually yes | Allow Cloudflare address ranges at the firewall; deny other inbound traffic | Low to medium | Primarily web traffic; other services need separate designs | Cloudflare features and availability vary by plan; no universal tier is established here |
| Cloudflare Tunnel | No publicly routable origin path is required | An outbound-only cloudflared connection carries traffic to the service |
Medium; you operate the connector daemon | Best for services supported by the tunnel configuration; ordinary arbitrary TCP exposure is not implied | Feature and availability terms vary; verify the current Cloudflare offering |
| CloudFront VPC origins | No, when the origin remains in a private subnet | CloudFront is the public entry point; the private network controls origin reachability | High; requires AWS networking and distribution configuration | Designed around HTTP/HTTPS origins such as an ALB, NLB, or EC2 instance | AWS account, networking, and CloudFront charges apply; no single required enterprise tier is stated here |
| CloudFront with a public origin and restrictions | Yes | Secret custom header plus security-group or request-condition checks; direct requests should receive HTTP 403 | Medium | Web delivery through CloudFront; other ports require separate controls | Requires CloudFront and compatible origin security controls |
If an origin must never be reachable from the Internet, choose a tunnel or a private-subnet origin. A proxied public origin is simpler, but its security depends on a correctly maintained allowlist and on eliminating every alternate path.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Method 1: Put web traffic behind Cloudflare proxying
Cloudflare describes proxied DNS records as a way to hide origin addresses and provide DDoS protection. The orange-cloud state means Cloudflare answers the public web lookup; a gray-cloud or DNS-only record exposes the address instead.
1. Inventory every web name and address
List the apex domain, www, API names, staging names that share the production server, IPv4 A records, and IPv6 AAAA records. Include names used by mobile apps, webhooks, image hosts, health checks, and administrative panels. A single forgotten hostname can defeat the design.
2. Proxy each applicable web record
In the Cloudflare dashboard, open the domain’s DNS records and enable proxying for each web A and AAAA record that should pass through Cloudflare. Do not assume that proxying the apex also proxies an API or subdomain; each record is independent.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
3. Enforce the proxy at the origin firewall
Allow inbound web ports only from Cloudflare’s published IP ranges, and deny all other Internet sources. Apply the rule to both IPv4 and IPv6. If your host firewall, cloud security group, and upstream network filter all exist, implement the restriction at every layer that can accept traffic. The proxy is then the only permitted ingress path rather than merely the preferred path.
4. Replace an address that was previously public
Proxying does not erase old DNS history. If the origin address was ever published, rotate it after the proxy is working and update the server, firewall, and DNS configuration. Retire the old address instead of leaving it attached to a live instance. Otherwise, a person who recorded the old value can continue bypassing Cloudflare.
5. Audit records that cannot be proxied
Review DNS-only records, including SPF, TXT, mail records, verification records, and service-specific hostnames. These may reveal the same address or identify a network that hosts the web server. Cloudflare notes that mail systems and other DNS-only records are common disclosure paths. Where possible, do not place mail on the protected web origin; use a separate mail service or host.
6. Verify both normal and direct paths
Resolve each public web name and confirm that it returns proxy addresses rather than the origin. Then test the origin address from outside your network. A direct request should be rejected by the firewall, while a normal request through the hostname should reach the application. Check logs for attempts that arrive from non-Cloudflare networks; any successful one indicates an allowlist, IPv6, or alternate-endpoint error.
Method 2: Use Cloudflare Tunnel for an outbound-only path
Cloudflare Tunnel reverses the exposure model. A cloudflared daemon running near the application opens outbound connections to Cloudflare. Visitors connect to Cloudflare, and Cloudflare sends the request through that established tunnel. The origin does not need a publicly routable inbound address.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Deployment sequence
- Install the connector. Install the
cloudflareddaemon on the host or in the same private network as the service, using the current package and operating-system instructions from Cloudflare. - Create a tunnel identity. Associate the connector with your Cloudflare account and create a named tunnel. Protect its credentials like any other production secret.
- Map hostnames to local services. Configure the tunnel so each public hostname points to the intended internal application address and port. Keep separate mappings for production, administration, and testing rather than exposing an entire private network.
- Remove unnecessary inbound exposure. Once requests work through the tunnel, close public ports on the origin. Because the connector initiates outbound sessions, the server can reject unsolicited Internet connections to HTTP and HTTPS.
- Operate the daemon as production infrastructure. Monitor its process, logs, resource use, and reconnect behavior. Plan how you will restart or replace it; if the connector stops, the public hostname will fail even though the application itself is healthy.
- Test failure behavior. Stop the connector in a controlled window and confirm that monitoring detects the outage. Restart it and verify that traffic resumes without reopening inbound firewall ports.
A tunnel provides stronger network isolation than a public origin protected only by DNS. It does introduce a dependency on the connector software and on the tunnel service, so ownership, patching, credential rotation, and alerting become part of your operations.
Method 3: Keep the origin private with CloudFront VPC origins
AWS describes CloudFront VPC origins as a private path from CloudFront to an origin such as an Application Load Balancer, Network Load Balancer, or EC2 instance in a private subnet. CloudFront is the public entry point; the origin does not need a public address.
Build the private path
- Place the origin in a private subnet. Put the load balancer or instance in subnets that do not provide a public route to the Internet gateway. Remove public IP assignments that are not required for administration.
- Define the origin target. Configure the CloudFront distribution to use the private ALB, NLB, or EC2 origin supported by the VPC-origin feature. Keep the application’s listener and health checks inside the VPC.
- Control security-group reachability. Permit only the traffic required for CloudFront’s origin connection and the application’s health checks. Do not add a broad Internet source range simply to make initial testing easier.
- Publish only the distribution hostname. Point your public web DNS at CloudFront and remove records that expose the load balancer or instance. Keep internal names for internal operators and automation.
- Validate from outside the VPC. Confirm that the public hostname succeeds through CloudFront while the private origin has no usable public route. Test application logs to ensure requests arrive through the intended distribution path.
This design offers the clearest separation between public delivery and private compute, but it requires more networking work than a conventional reverse proxy. It also ties origin reachability to AWS VPC, security-group, and CloudFront configuration, so changes should be reviewed as a single path.
Method 4: Restrict a public origin behind CloudFront
If moving the server into a private subnet is not yet practical, CloudFront can still be used as the public front door while the origin enforces an additional request condition.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use a secret origin header
Configure CloudFront to add a secret custom header when it requests the origin. Configure the origin security controls to accept requests only when they come from CloudFront and contain the expected header. Keep the value out of client-side code, public documentation, and ordinary application responses. Rotate it if it is exposed.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Add network and request-level rejection
A header alone is not a complete boundary if the origin remains reachable from anywhere. Restrict the security group or firewall to CloudFront traffic, and configure request conditions that return HTTP 403 when a request does not meet the expected conditions. Direct-origin requests should fail before they reach application logic.
Test bypass attempts
Send a request to the public CloudFront hostname and to the origin address separately. The first should return the application response; the second should be denied by the network or request condition. Repeat the test over IPv6 if the server has an AAAA record. Re-test after every distribution, security-group, or firewall change.
Find the leaks that bypass a proxy
Origin concealment is an inventory problem as much as a DNS setting. Review these sources before declaring the migration complete:
- Alternate hostnames: API, upload, staging, development, status, and regional names may point directly to the server.
- DNS-only records: A gray-cloud record, an unproxied IPv6 record, or a delegated subdomain can disclose the address.
- Historical addresses: Old DNS values remain useful to anyone who recorded them. Rotation is the remedy when an address was previously public.
- Mail and verification services: MX, SPF, TXT, and provider-verification records can identify a host or network. Keep mail separate from the web origin when possible.
- Direct access paths: Management panels, health-check ports, SSH, databases, and custom application ports must not share an unrestricted public interface with the protected site.
- Application disclosure: Error pages, response headers, redirects, debug output, and generated links should not reveal an internal hostname or address.
- Operational tooling: Monitoring systems, deployment scripts, and partner integrations may still use the old address. Update them before retiring it.
Document every hostname and service, its intended entry point, and the firewall rule that protects it. If an item has no owner or purpose, remove it rather than leaving an untracked route online.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Firewall rules that make the design effective
Use the narrowest rule set that supports the chosen architecture:
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
- For a Cloudflare proxy, allow only Cloudflare’s current IPv4 and IPv6 ranges on the required web ports.
- For a tunnel, allow the connector’s outbound sessions and close unsolicited inbound web traffic.
- For a private CloudFront origin, keep the subnet private and allow only the distribution’s origin path and required health checks.
- For a public CloudFront origin, combine CloudFront source restrictions with the secret-header and HTTP 403 conditions.
- Keep administration on a separate private access method rather than adding an exception for a personal or office IP that may later change.
Review these rules whenever the provider publishes new address ranges, when you add IPv6, or when infrastructure moves regions. An outdated allowlist can either cause outages or force an overly broad emergency exception.
Common failure modes and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| The site works through the CDN, but the origin address still answers directly | The firewall allows general Internet traffic | Replace the broad rule with the proxy’s address ranges or the private origin policy, then retest from an unrelated network |
| Some subdomains expose the server | An API, staging, or IPv6 record was left DNS-only | Inventory all A, AAAA, and alternate hostnames; proxy applicable web records or remove them |
| Users reach an old server after migration | The old public address was never rotated or decommissioned | Move the service to a new address, retire the old instance, and update automation and integrations |
| Mail breaks after DNS cleanup | Mail records were treated like web records | Keep required mail records DNS-only and host mail separately from the protected web origin |
| CloudFront returns an origin error while direct access is blocked | The origin allowlist, private route, listener, or custom header is incorrect | Trace the CloudFront-to-origin path, verify security-group rules and listener ports, and confirm the expected header reaches the origin |
| A tunnel hostname fails while the application is healthy | The connector daemon is stopped, misconfigured, or unable to make outbound connections | Inspect connector logs and credentials, restore outbound connectivity, and add monitoring for daemon health |
| Only IPv6 clients can bypass the proxy | The AAAA record or IPv6 firewall rule was overlooked |
Proxy the IPv6 record and apply equivalent IPv6 ingress restrictions |
How to validate that the origin is really hidden
- Check public DNS. Resolve every production hostname from more than one network and confirm that the answer belongs to the proxy or CDN, not the server.
- Check direct origin access. From an external network, connect to the current and recently retired addresses. The expected result is a network rejection or an intentional HTTP 403, not an application response.
- Check every protocol. Test IPv4 and IPv6 separately, and test each exposed web port. A secure IPv4 rule does not protect an open IPv6 listener.
- Check logs. Origin logs should show requests arriving through the intended provider path. Investigate any successful request from an unrelated source.
- Check records and history. Review alternate DNS names, mail records, verification records, old infrastructure notes, and deployment configuration for the retired address.
- Check recovery. Confirm that the team can rotate an origin address, replace a tunnel connector, or update an allowlist without leaving the server broadly exposed during the change.
Security and availability trade-offs
Public origin plus allowlisting
This is the quickest migration and works well when you can maintain provider IP ranges and firewall rules. Its weakness is that the server still has a public route; a missed rule, a forgotten IPv6 listener, or a newly exposed port can create a bypass.
Free tools Windows power users keep installed
One-click scans. No signup required.
Outbound-only tunnel
The tunnel removes the inbound route and therefore reduces the value of a discovered origin address. The trade-off is operational: the connector daemon, its credentials, outbound network access, and monitoring become critical components.
Private-subnet origin
A private VPC origin gives the strongest network separation in the documented approaches. It requires careful routing, load-balancer or instance design, security-group management, and CloudFront configuration. Troubleshooting also spans more layers than a simple DNS change.
Non-HTTP workloads
Standard CDN proxying is intended for web delivery. Databases, SSH, mail, and custom TCP services should not be assumed to gain the same protection merely because the website is proxied. Give those services their own private connectivity, access controls, or provider-specific products. Cloudflare documents additional options such as IP allowlists, JWT or header validation, Magic Transit, and dedicated egress IPs, each with different security and availability characteristics; select one only when its protocol and operational model match the service.
A safe migration order
- Map every hostname, address, service, and current consumer of the origin.
- Choose proxying, a tunnel, a private CloudFront origin, or a restricted public CloudFront origin based on whether a public route is acceptable.
- Build and test the new front door while the existing path is still available.
- Apply the origin firewall or private-network controls before changing public DNS.
- Proxy the complete web record set or publish the tunnel or CloudFront distribution.
- Verify normal traffic, direct-origin rejection, IPv4 and IPv6 behavior, and application logs.
- Rotate the origin address if it was ever public, then retire the old address and update automation.
- Recheck DNS-only records, mail separation, alternate names, and monitoring after the change.
The decisive step is not changing a DNS color or adding a CDN hostname. It is making the origin incapable of serving an unsolicited direct connection. Once discovery controls and ingress controls agree, a leaked or historical address no longer provides a useful bypass.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
