sellSecurity

vpn_lock

Cloudflare Tunnel

A secure tunnel from your machine to Cloudflare — no public IP, no open ports, no exposed server.

0 portsInbound ports opened

Outbound-onlyConnection direction

Freecloudflared daemon

lightbulb

What is Cloudflare Tunnel?

Cloudflare Tunnel lets you publish a service running on your own computer or private network to the internet — safely — without giving it a public IP address or opening holes in your firewall.

You run a tiny program called cloudflared. Instead of waiting for visitors to connect in, it makes an outbound connection from your machine up to Cloudflare. Visitors reach Cloudflare, and Cloudflare passes their requests down through that tunnel to your service.

swap_vert

Think of it like…

A private valet who walks out to greet guests and escorts them in — instead of leaving your front door unlocked. Your house never has to expose an entrance to the street.

help

Why use it?

Traditionally, to make a home server or office app reachable from the internet you'd need a public IP, port forwarding, and inbound firewall rules — each one a security risk and a hassle. Tunnel removes all of that.

block

No open ports

You can block all inbound traffic at the firewall and still stay reachable.

wifi_off

No public IP needed

Works behind home routers, CGNAT, or dynamic IPs that change all the time.

shield

Hidden origin

Your server's real IP is never exposed, so attackers can't target it directly.

https

Free HTTPS

Cloudflare terminates TLS at its edge, so your public URL is encrypted automatically.

target

When should you use it?

home

Home lab / self-hosting

Publish a Raspberry Pi app, NAS, or hobby project without router config.

terminal

Local dev demos

Share a localhost site with a client or teammate via a real public URL.

lan

Internal tools

Reach an internal dashboard or database without a full VPN setup.

terminal

SSH / RDP

Securely reach machines for remote admin without exposing those ports.

rocket_launch

How to create a tunnel

There are two ways: the dashboard (remotely-managed, beginner-friendly) or the command line. Here's the classic CLI flow once cloudflared is installed.

Install cloudflared
Install the connector daemon on the machine running your service (macOS example shown).
bash
```
# macOS (Homebrew)
brew install cloudflared

# or download a binary for Linux/Windows from Cloudflare
```
Log in
This opens a browser to authorize cloudflared and pick which domain the tunnel belongs to.
bash
```
cloudflared tunnel login
```
Create the tunnel
Give it a name. Cloudflare generates a unique tunnel ID and a credentials file on your machine.
bash
```
cloudflared tunnel create my-tunnel
```
Route a hostname to it
Create the DNS record so app.example.com points at your tunnel.
bash
```
cloudflared tunnel route dns my-tunnel app.example.com
```

Map your local service

In ~/.cloudflared/config.yml, point the hostname at your local service (e.g. a site on localhost:8080).

yaml

tunnel: my-tunnel
credentials-file: /Users/you/.cloudflared/<TUNNEL-ID>.json

ingress:
  - hostname: app.example.com
    service: http://localhost:8080
  - service: http_status:404   # catch-all, required

Run it
Start the tunnel. Your local service is now live at https://app.example.com. Later, install it as a service so it runs on boot.
bash
```
cloudflared tunnel run my-tunnel

# run automatically on startup (Linux/macOS):
# sudo cloudflared service install
```

school

Key concepts

memory

cloudflared

The lightweight daemon (background program) that creates and maintains the tunnel.

fingerprint

Tunnel

A persistent object with a unique UUID linking your origin to Cloudflare.

north_east

Outbound-only

cloudflared dials out to Cloudflare; nothing ever connects inbound to you.

alt_route

Ingress rules

The config that maps each public hostname to a local service.

hub

Connector

Each running cloudflared process; you can run several for redundancy.

settings_remote

Remotely-managed

Configure the whole tunnel from the Zero Trust dashboard, no local config file.

tips_and_updates

Tips & billing

badge

Add a login wall with Access

Pair Tunnel with Cloudflare Access to require a login (Google, GitHub, email PIN) before anyone can reach your service — perfect for private internal tools.

cloudflared and Cloudflare Tunnel are free to use.
Block all inbound ports on your firewall once the tunnel works — outbound-only is the whole point.
Run cloudflared as a system service so the tunnel survives reboots.
The dashboard (remotely-managed) flow is the easiest start; the CLI gives you more control via config.yml.