Cloudflare Tunnel
FreemiumConnect your infrastructure without opening a single port.
Published 27 September 2026 · Last updated 6 October 2026
Scores
Popularity3/5
A standard recommendation in self-hosting and homelab communities for exposing services without port forwarding, though it competes with several other tunnel tools rather than being the default name people reach for first.
Learning Curve3/5
Getting a tunnel running requires a Cloudflare account, a domain on Cloudflare DNS, and configuring ingress rules for each hostname — more setup than a single-binary tunnel tool, though well documented and a common homelab pattern once learned.
Flexibility4/5
Ingress rules can route many hostnames to different local services from one tunnel, Zero Trust Access adds per-hostname authentication, and the same daemon handles HTTP alongside TCP/UDP via WARP.
Performance4/5
Traffic rides Cloudflare's global Anycast network end to end, giving it the same routing and edge performance as the rest of Cloudflare's CDN.
Portability2/5
Tightly coupled to a Cloudflare account and DNS zone — migrating off Cloudflare means replacing the entire exposure mechanism, not just swapping a config value.
About Cloudflare Tunnel
Cloudflare Tunnel (run via the cloudflared daemon) lets a server reach the public internet without ever accepting an inbound connection. Instead of opening a port and pointing DNS at a public IP, cloudflared runs on the origin machine and holds an outbound, encrypted connection to Cloudflare's edge. Requests to a configured hostname travel through Cloudflare's network and back down the tunnel to the origin, so the firewall never has to allow inbound traffic.
It comes in two modes under one product. A named tunnel is the production mode: a stable hostname on a domain managed in Cloudflare DNS, ingress rules that route several hostnames to different local services from one tunnel, and Cloudflare's CDN, DDoS protection, and Zero Trust Access policies in front. A Quick Tunnel is the no-account mode: one command, cloudflared tunnel --url http://localhost:8000, returns a random trycloudflare.com address with no sign-up, domain, or configuration file. Cloudflare documents Quick Tunnels for testing only: the hostname changes on every run, there is no uptime guarantee, each tunnel handles up to 200 in-flight requests, and Server-Sent Events are not supported.
Named tunnels are a common choice for self-hosters and homelab operators running services behind NAT, a residential connection, or a restrictive firewall. A tunnel can forward to a local reverse proxy such as NGINX, Caddy, or Traefik, or straight to a service, and it carries HTTP, SSH, and remote desktop traffic. The daemon is open source and runs from the command line, as a Docker container, or as a system service.
Key Features
- Outbound-only encrypted tunnel: no open inbound ports or port forwarding required
- Named tunnels with stable hostnames on your own Cloudflare-managed domain
- Quick Tunnels: one command, a random trycloudflare.com address, no account or domain
- Free of charge, with up to 1,000 tunnels per account and ingress rules that route several hostnames from one tunnel
- Zero Trust Access policies gate specific hostnames behind authentication
- Inherits Cloudflare's CDN, DDoS protection, and Anycast network
- Carries HTTP, SSH, and remote desktop traffic
- Runs as a lightweight daemon (cloudflared) via CLI, Docker, or system service
Pros
- Completely free with no bandwidth cap, unlike most tunnel competitors' metered plans
- Quick Tunnels give a public test URL in one command with no account or domain
- DDoS protection and global Anycast routing included at no extra cost
- Zero Trust Access policies add authentication in front of self-hosted services
- Named tunnels are stable enough for always-on production self-hosted deployments, not just dev previews
- No router configuration, static IP, or manual TLS certificate management needed
Cons
- A named tunnel needs a Cloudflare account and a domain on Cloudflare DNS; only Quick Tunnels work without them
- Quick Tunnels are for testing only: a new hostname each run, no uptime guarantee, 200 in-flight requests, no Server-Sent Events
- Setup of a named tunnel (DNS, tunnel config, ingress rules) is more involved than a single-command tunnel tool
- Tunnel and Access configuration lives in the Cloudflare dashboard, adding a dependency outside the local stack
- Ties the exposure layer to Cloudflare's network rather than a portable, vendor-neutral tunnel
Cloudflare Tunnel Pricing
Freemium- · Up to 1,000 tunnels per account, no bandwidth cap
- · Quick Tunnels with no account or domain, for testing
- · Zero Trust Access policies included free for up to 50 users
- · Per-user pricing for teams beyond 50 users needing advanced Access/Gateway policies, dedicated support, or SLAs
- · The tunnel itself remains free — this tier adds team-scale Zero Trust management on top
Tech Stacks with Cloudflare Tunnel
WordPress Self-Hosted
InfrastructureThe CMS behind the open web on your own server: WordPress with its own database (MariaDB by default; MySQL equally supported) and Docker, with any plugin and any theme, and no managed-WP vendor in sight.
OpenClaw Self-Hosted
InfrastructureRun OpenClaw, the open-source personal AI agent, in Docker on your own server or home hardware. It answers in the messaging apps you already use, thinks with a model such as Claude or OpenAI, and stays closed to the internet, with its dashboard reached over an SSH tunnel.
Hermes Agent Self-Hosted
InfrastructureRun Hermes Agent, Nous Research's open-source agent that writes its own skills as it works, in Docker on your own server or home hardware. It answers in your messaging apps, runs on a low-cost model such as DeepSeek or a frontier one such as Claude, and keeps its dashboard private behind an SSH tunnel.
Tools Related to Cloudflare Tunnel
Works well with Cloudflare Tunnel(5)
Cloudflare Tunnel rides on the same DNS, network, and (optionally) Zero Trust Access layer as the core Cloudflare product — a tunnel's custom hostname is configured through the same Cloudflare-managed domain.
A common self-hosted pattern: cloudflared forwards incoming tunnel traffic to a local Caddy instance for routing and automatic HTTPS between backend services — the tunnel replaces the open port, not the reverse proxy behind it.
A common self-hosted pattern, especially in Docker-based homelab setups: cloudflared forwards incoming tunnel traffic to Traefik, which handles container-aware routing to the actual services — the tunnel replaces the open port, not the reverse proxy behind it.
A common self-hosted pattern: cloudflared forwards incoming tunnel traffic to a local NGINX instance, which then routes between the actual backend services — the tunnel replaces the open port, not the reverse proxy behind it.
Cloudflare Tunnel exposes a public-facing service from the same server while Tailscale keeps the admin/dev surface private — complementary roles rather than a straight swap.
Alternatives to Cloudflare Tunnel(1)
Both expose a local or self-hosted service without opening inbound ports. Cloudflare Tunnel is free with no bandwidth cap but needs a domain on Cloudflare; ngrok gives an instant public URL with no domain, but its free plan is capped and persistent custom domains are paid.
