Cloudflare Tunnel: local server access without a public IP

Cloudflare Tunnel lets you publish a local server on the internet without a public IP and without open inbound ports. The connection is initiated from inside the network — the server isn't directly reachable.

How Cloudflare Tunnel works

The cloudflared daemon on your server creates an outbound encrypted connection to Cloudflare
Cloudflare accepts traffic on its edge for your domain
Traffic is forwarded through the tunnel to your server
No open ports 80/443 on the server

Installing cloudflared

# Ubuntu/Debian
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -o cloudflared.deb
sudo dpkg -i cloudflared.deb

# Log in
cloudflared tunnel login

Creating the tunnel

# Create a tunnel
cloudflared tunnel create my-server

# Create the config ~/.cloudflared/config.yml
tunnel: your-tunnel-id
credentials-file: /root/.cloudflared/your-tunnel-id.json

ingress:
  - hostname: mysite.example.com
    service: http://localhost:80
  - hostname: api.example.com
    service: http://localhost:3000
  - service: http_status:404

Binding the domain and launching

# Create a DNS record
cloudflared tunnel route dns my-server mysite.example.com

# Run the tunnel
cloudflared tunnel run my-server

# Add to startup
sudo cloudflared service install
sudo systemctl enable cloudflared

✅ Cloudflare Tunnel is free and works on Cloudflare's free plan. It's great for a Raspberry Pi, a home server, or a dev environment.

Use cases

Publishing a dev server for a client demo
Hosting a site on a home internet connection without a public IP
Server protection: no open ports means no direct attacks
Self-hosted services (Gitea, NextCloud, Home Assistant) with HTTPS

⚠️ Cloudflare Tunnel isn't suitable for high-load production sites with heavy traffic — use a full-fledged VPS with a direct connection to a CDN.

What is Cloudflare Tunnel

Cloudflare Tunnel creates an encrypted outbound tunnel from your server to Cloudflare. There's no need to open ports 80/443 — everything goes through the tunnel.

💡 Cloudflare Tunnel is free for personal use. It's ideal for home servers and Raspberry Pi devices without a public IP.

Configuration file

# ~/.cloudflared/config.yml
tunnel: TUNNEL_ID
credentials-file: /root/.cloudflared/TUNNEL_ID.json

ingress:
  - hostname: myapp.yourdomain.com
    service: http://localhost:3000
  - hostname: api.yourdomain.com
    service: http://localhost:8080
  - service: http_status:404

Running as a service

cloudflared service install
systemctl enable --now cloudflared

⚠️ Cloudflare Tunnel proxies traffic through Cloudflare — all data passes through their network. Don't use it for sensitive data without reviewing the terms.

Common Cloudflare Tunnel Errors

Error	Cause	Fix
failed to connect to the edge: context deadline exceeded	Outbound traffic from the server is blocked by a firewall — cloudflared can't reach the Cloudflare edge	Allow outbound connections on ports 443 and 7844 (QUIC) in the firewall
Unauthorized: Failed to get tunnel	The credentials-file points to the wrong tunnel ID, or the tunnel token was revoked in the dashboard	Recreate the tunnel: `cloudflared tunnel create my-server` and update config.yml
Error 502 Bad Gateway when visiting the site	The service listed in ingress (e.g. http://localhost:80) isn't running or listens on a different port	Confirm the local service actually responds: `curl http://localhost:80`
no ingress rules were defined	config.yml is missing the required default catch-all rule	Add as the last line in ingress: `- service: http_status:404`

Comparing Cloudflare Tunnel and a Direct Connection

Criterion	Cloudflare Tunnel	Direct connection with an open port
Public IP	Not required	Required
Open inbound ports	None	80/443 open to the whole internet
Latency	Slightly higher — an extra hop through the Cloudflare edge	Minimal, a direct path to the server
DDoS protection	Included automatically	Must be configured separately

When Cloudflare Tunnel Is Not a Good Fit

High-load production with large sustained traffic — the extra hop through the edge shows up in latency and cost
Clients need mTLS with their own certificate straight to the server — the tunnel terminates TLS on Cloudflare's side
The application uses protocols outside HTTP/TCP with non-standard routing — ingress support isn't uniform across every traffic type
Independence from a third-party provider's uptime is critical — the tunnel adds Cloudflare as a single point of failure between client and server

For protecting an admin panel specifically under a Zero Trust model, rather than just hiding the IP, see "Cloudflare Access: securing an admin panel with Zero Trust". The general layout of Cloudflare's network is covered in "Cloudflare: What It Is and Why the Free Plan Is Useful".

Verifying the Result

Confirm the tunnel is up and traffic actually flows through it:

# Tunnel status and connected edge connections
cloudflared tunnel info my-server

# The tunnel runs as a systemd service without failures
systemctl status cloudflared

# The domain responds through the tunnel, not directly
curl -sI https://mysite.example.com | head -5

# Daemon logs in real time while troubleshooting
journalctl -u cloudflared -f

If it later helps to compare the tunnel with a regular VPN setup, see WireGuard VPN on a VPS: Quick Setup and Configuration.

Frequently asked questions

What happens to the site if the cloudflared process on the server stops?

If the cloudflared service stops, the outbound connection to the Cloudflare edge disappears, and the site or service published through the tunnel becomes unreachable from the outside, since no alternative route to the server exists. That's why the daemon runs as a system service with autostart, so it comes back up after a reboot or crash instead of staying down.

Do I need a paid Cloudflare plan to use Tunnel?

No, Cloudflare Tunnel works entirely on Cloudflare's free plan with no extra cost. Cloudflare's paid features cover other parts of the network — advanced protection, analytics, or Zero Trust policies — while the tunnel itself and the cloudflared daemon stay free no matter which account tier is chosen.

Can one tunnel publish several different services on different subdomains?

Yes, a single tunnel can serve several services at once — the configuration file simply lists several ingress rules, each with its own hostname and local service address. The only requirement is a mandatory default catch-all rule at the end of the list, otherwise the configuration won't load.

Do I need to open a port on my home router for Tunnel to work?

No, that's the entire point of Tunnel — the connection is always initiated from inside the network by the server itself, so no inbound ports on the router are opened at all. Home internet without a public IP and without access to NAT settings keeps working exactly the same as with any regular provider.