Global setting to hide origin IP from everywhere - is it possible?

[Stephen]

Let’s Encrypt may not enroll correctly at all if the server isn’t directly accessible. If Cloudflare’s orange cloud is turned on for example this can screw up the challenge.

Which service is it?