Cloudflare Tunnel (cloudflared)
Publish a home service on your domain without opening a single router port
cloudflared is the small connector behind Cloudflare Tunnel. It makes an outbound connection from your server to Cloudflare, which then routes traffic for your subdomain back through it, so nothing on your router has to be opened.
Best for when
- you want a public subdomain for a home service without port forwarding
- your connection sits behind carrier grade NAT
- you want HTTPS on your own domain without managing certificates
Watch out for
- your domain must use Cloudflare DNS, and Cloudflare sees the traffic in clear text
- it publishes the app, it does not protect it, so the app's own login is still the front door
- Cloudflare's terms limit some uses, such as serving large amounts of video through the tunnel
Why an outbound tunnel beats port forwarding
Port forwarding puts your home IP and an open port on the internet, where scanners find it within hours. A tunnel reverses the direction: cloudflared dials out to Cloudflare, and visitors reach your service through Cloudflare's network. Your IP stays hidden and you get HTTPS on your own domain without managing certificates.
It also works behind carrier grade NAT and on Wi-Fi where you do not control the router. A common setup runs cloudflared as a container in Docker Compose and publishes apps such as Postiz and OpenReply on subdomains, while those apps listen on 127.0.0.1 only.
The trade you are making
The connector is open source and tiny. The service behind it is not: your domain must use Cloudflare DNS, and all traffic, including the decrypted HTTPS traffic, passes through Cloudflare. For a personal app that is usually acceptable, but it is a real dependency on one company.
A tunnel is not a firewall for the app behind it. Whatever you publish is still public, with its own login screen as the main defence. Add Cloudflare Access in front of anything that is only for you, and keep admin panels on a private network instead.
