What is a Private Origin Tunnel?
Normally a CDN needs a publicly reachable origin server, which means exposing an IP address and opening port 443 to the internet. A Private Origin Tunnel removes that requirement.
You install a small connector on the machine that serves your site. It dials out to CDNShark and holds an encrypted WireGuard tunnel open. Our edges deliver your traffic through that tunnel.
What this means for you
- No public IP needed. Your origin can sit behind NAT, on an office LAN, or inside a private VPC.
- No inbound firewall rules. Nothing connects to your server, so there is no port to open and no listening service to attack.
- Your origin address is never published. Visitors and scanners only ever see CDNShark.
What it is not
This is not a VPN and it does not give anyone access to your network. The connector only reaches the single service you tell it to, and it cannot route traffic to anything else on your LAN.