Cloudflare Tunnel
FreemiumConnect your infrastructure without opening a single port.
Published 27 September 2026
Scores
Popularity3/5
A standard recommendation in self-hosting and homelab communities for exposing services without port forwarding, though it competes with several other tunnel tools rather than being the default name people reach for first.
Learning Curve3/5
Getting a tunnel running requires a Cloudflare account, a domain on Cloudflare DNS, and configuring ingress rules for each hostname — more setup than a single-binary tunnel tool, though well documented and a common homelab pattern once learned.
Flexibility4/5
Ingress rules can route many hostnames to different local services from one tunnel, Zero Trust Access adds per-hostname authentication, and the same daemon handles HTTP alongside TCP/UDP via WARP.
Performance4/5
Traffic rides Cloudflare's global Anycast network end to end, giving it the same routing and edge performance as the rest of Cloudflare's CDN.
Portability2/5
Tightly coupled to a Cloudflare account and DNS zone — migrating off Cloudflare means replacing the entire exposure mechanism, not just swapping a config value.
About Cloudflare Tunnel
Cloudflare Tunnel (run via the cloudflared daemon) lets a server reach the public internet without ever accepting an inbound connection. Instead of opening a port and pointing DNS at a public IP, cloudflared runs on the origin machine and establishes an outbound, encrypted connection to Cloudflare's edge. Requests to a configured hostname travel through Cloudflare's network and back down the tunnel to the origin, so the firewall never has to allow inbound traffic at all.
This makes it a common choice for self-hosters and homelab operators exposing services running behind NAT, a residential connection, or a restrictive firewall, without static IPs, port forwarding, or manually managed TLS certificates. A single cloudflared process can route multiple hostnames to different local services via ingress rules, and the tunnel inherits Cloudflare's CDN, DDoS protection, and Zero Trust access controls, so specific hostnames can be locked down with authentication policies rather than left open to anyone with the URL.
Cloudflare Tunnel typically sits in front of, not instead of, a local reverse proxy: cloudflared forwards incoming requests to whatever is already routing traffic between local services, most commonly NGINX, Caddy, or Traefik. It requires a domain managed on Cloudflare DNS and a Cloudflare account, and is most often run via a lightweight Docker container or system service alongside the rest of a self-hosted stack.
Key Features
- Outbound-only encrypted tunnel — no open inbound ports or port forwarding required
- Unlimited tunnels and hostnames on the free plan
- Ingress rules route multiple hostnames to different local services from one tunnel
- Zero Trust Access policies gate specific hostnames behind authentication
- Inherits Cloudflare's CDN, DDoS protection, and Anycast network
- Runs as a lightweight daemon (cloudflared) via CLI, Docker, or system service
Pros
- Completely free with no bandwidth cap, unlike most tunnel competitors' metered plans
- DDoS protection and global Anycast routing included at no extra cost
- Zero Trust Access policies add authentication in front of self-hosted services
- Stable enough for always-on production self-hosted deployments, not just dev previews
- No router configuration, static IP, or manual TLS certificate management needed
Cons
- Requires an existing Cloudflare account and a domain on Cloudflare DNS for custom hostnames
- Setup (DNS, tunnel config, ingress rules) is more involved than a single-command tunnel tool
- Less convenient than alternatives for quick, ephemeral public URLs with no domain
- Tunnel and Access configuration lives in the Cloudflare dashboard, adding a dependency outside the local stack
- Ties the exposure layer to Cloudflare's network rather than a portable, vendor-neutral tunnel
Cloudflare Tunnel Pricing
Freemium- · Unlimited tunnels and hostnames, no bandwidth cap
- · Zero Trust Access policies included free for up to 50 users
- · Per-user pricing for teams beyond 50 users needing advanced Access/Gateway policies, dedicated support, or SLAs
- · The tunnel itself remains free — this tier adds team-scale Zero Trust management on top
Tech Stacks with Cloudflare Tunnel
n8n Self-Hosted
InfrastructureSelf-host n8n on your own VPS, cloud instance, or hardware for complete data ownership and no per-execution pricing. Docker keeps the deployment reproducible on any host; PostgreSQL, SQLite, or managed Neon can store workflows and execution history, and a reverse proxy you configure or a self-hosted PaaS handles routing and TLS.
Ghost Self-Hosted
InfrastructureRun Ghost on your own server instead of paying Ghost(Pro) as your audience grows. Ghost publishes, manages members and paid subscriptions, and sends newsletters, with MySQL storing content and members and Docker keeping installs and upgrades to a few commands.
Plausible Self-Hosted
InfrastructureRun Plausible Community Edition on your own server for cookie-free analytics with no pageview caps. ClickHouse stores the events and answers dashboard queries fast at high volume, PostgreSQL holds accounts and site settings, and the official Docker Compose file brings up all three containers together.
Tools Related to Cloudflare Tunnel
Works well with Cloudflare Tunnel(5)
Cloudflare Tunnel rides on the same DNS, network, and (optionally) Zero Trust Access layer as the core Cloudflare product — a tunnel's custom hostname is configured through the same Cloudflare-managed domain.
A common self-hosted pattern: cloudflared forwards incoming tunnel traffic to a local Caddy instance for routing and automatic HTTPS between backend services — the tunnel replaces the open port, not the reverse proxy behind it.
A common self-hosted pattern, especially in Docker-based homelab setups: cloudflared forwards incoming tunnel traffic to Traefik, which handles container-aware routing to the actual services — the tunnel replaces the open port, not the reverse proxy behind it.
A common self-hosted pattern: cloudflared forwards incoming tunnel traffic to a local NGINX instance, which then routes between the actual backend services — the tunnel replaces the open port, not the reverse proxy behind it.
Cloudflare Tunnel exposes a public-facing service from the same server while Tailscale keeps the admin/dev surface private — complementary roles rather than a straight swap.
Alternatives to Cloudflare Tunnel(1)
Both expose a local or self-hosted service without opening inbound ports. Cloudflare Tunnel is free with no bandwidth cap but needs a domain on Cloudflare; ngrok gives an instant public URL with no domain, but its free plan is capped and persistent custom domains are paid.
Learning Resources
No resources yet — check back soon.
