Cloudflare Tunnel

Cloudflare Tunnel is a secure connectivity service from Cloudflare. You install a lightweight daemon called cloudflared on your server or in your internal network, and it proactively establishes persistent outbound connections to the Cloudflare global network. All traffic to your origin passes through Cloudflare, so CDN caching, WAF, Bot Management and DDoS protection apply automatically. The official documentation describes it as "no inbound ports, no public IP" and says it is supported on all plans.

How it works

1. Install cloudflared on your server or in your network.
2. cloudflared establishes an outbound, post-quantum encrypted connection to Cloudflare. No inbound ports are needed and you don't have to change your firewall.
3. Map a public hostname to a local service, for example map app.example.com to http://localhost:8080.
4. Traffic is forwarded through the Cloudflare network to your origin, with CDN and security protections applied along the way.

Each tunnel maintains four long-lived connections to two Cloudflare data centers for built-in redundancy. You can also run multiple cloudflared replicas to improve availability further.

Key features

• Secure origin connectivity: Your origin's public IP is no longer exposed, and all traffic goes through Cloudflare's CDN, WAF and DDoS protection.
• Public ingress routing: Publish internal applications to the internet by hostname, with support for protocols such as HTTP, HTTPS, TCP, SSH and RDP.
• Workers VPC: Let Cloudflare Workers securely access private databases, APIs and services through a tunnel.
• Load balancing: Use a tunnel as an endpoint in a Cloudflare Load Balancer origin pool for high availability and traffic steering.
• Integrations: Works together with products such as Cloudflare One and Access.
• Configuration options: Create tunnels from the dashboard or the API, and configure replicas, firewall rules, tokens and runtime parameters.

Target users and use cases

• Individuals who self-host services on a home server or NAS and have no public IP or don't want to set up port forwarding.
• Website and application operators who want to hide their origin IP and reduce the attack surface.
• Development and operations teams that need to securely publish internal applications, SSH or RDP services.
• Users who already use Cloudflare's DNS, CDN and security products and want to manage their traffic entry points in one place.

Core strengths

• Uses outbound connections only, with no need to open inbound ports, greatly reducing your exposure.
• Connections use post-quantum encryption.
• Deeply integrated with Cloudflare capabilities such as CDN, WAF and DDoS protection.
• Built-in multi-connection redundancy, with support for multi-replica deployment.
• Cloudflare says you can create your first tunnel in under 5 minutes from the dashboard or the API.

Deployment and technical requirements

• You need a Cloudflare account, and the relevant hostnames must be managed through Cloudflare.
• Run the cloudflared daemon on the server or network where your origin is located. The process must be able to reach the Cloudflare network.
• Create a tunnel in the dashboard or through the API, then map a public hostname to a local service. For detailed steps, see the official "Get started" documentation.

Things to note

• This is a managed service, and your traffic passes through Cloudflare's network, so you depend on Cloudflare's services and policies.
• This document mainly covers use cases for public-facing applications. For VPN replacement, private network access and network traffic filtering, see the Tunnel documentation in Cloudflare One.
• For supported protocols and the limits of each plan, refer to the official documentation.