In short cloudflare is both a DNS server and a reverse proxy. When you add a DNS record in there and mark it as proxy cloudflare will publish the DNS record but will instead give its own IP as the destination.

When a visitor enters your URL instead of getting your IP they will be given Cloudflare's IP. The visitor will then send their web request to Cloudflare. Cloudflare will then send that request to your actual IP.

That's the basic version. However, Cloudflare's position as a proxy gives it the ability to inspect and act on traffic as a WAF, blocking traffic that meetings the IDS/IPS rules.