# Cloudflare Tunnel [[Cloudflare]] Tunnel is a reverse-proxy daemon (`cloudflared`) that establishes outbound-only persistent connections from any host to Cloudflare's edge, then routes incoming HTTPS, SSH, RDP, or arbitrary TCP traffic to local services through that tunnel. The origin server never opens an inbound port, never exposes a public IP, and never needs a static DNS record. It is the modern alternative to ngrok, port forwarding, or VPNs for "I want this service reachable from the Internet, but I don't want a public IP." ## Why It Matters Self-hosting anything (homelab services, internal dashboards, dev preview environments) used to mean dealing with NAT, dynamic DNS, firewall rules, and the risk of exposing your home network. Tunnel sidesteps all of it: install `cloudflared`, authenticate, point it at `localhost:3000`, get a public HTTPS URL on your domain — with Cloudflare's DDoS protection, [[Cloudflare WAF]], and optional [[Cloudflare Access and Zero Trust]] policy gating in front. ## Common Use Cases - **Self-hosted services** behind a residential connection (Plex, Home Assistant, dev boxes) - **Internal dashboards** exposed to a team via Zero Trust policy - **SSH/RDP** to internal hosts without VPN, via Cloudflare's identity-aware proxy - **Replacing ngrok** for dev preview URLs that don't rotate - **Hybrid deployments** — bridging an on-prem service into a Cloudflare-fronted app ## Architecture Shape - `cloudflared` opens 4 long-lived outbound connections to two Cloudflare data centers, over QUIC by default (HTTP/2 as fallback when UDP is blocked); QUIC connections use post-quantum encryption - Incoming requests are routed through any of those connections - Origin can be `localhost:port`, a Unix socket, or any reachable URL on the host - Tunnels are identified by a UUID and attached to one or more public hostnames - Quick Tunnels give you a temporary `trycloudflare.com` URL with no account at all; since October 2, 2026, `--allowed-mail` restricts them to specific email addresses (one-time PIN) ## What changed in 2026 - **First-class dashboard and docs** (February): Tunnel moved into the main dashboard under Networking > Tunnels, with its own docs for public apps; the private-network side stays in Cloudflare One - **Wrangler support** (March): `wrangler tunnel create/run/quick-start` manages tunnels and downloads `cloudflared` for you; since May, `wrangler dev` and Vite can share a local dev server through a tunnel - **Workers VPC**: Workers (and [[Cloudflare Hyperdrive]]) reach private databases and APIs through your tunnel - **WARP Connector became [[Cloudflare Mesh]]** (April): the private, any-to-any networking piece is now its own product - **Platform cleanup**: Cloudflare will stop shipping `cloudflared` builds for 32-bit Windows and Intel Macs in 2027 ## References - Tunnel home: https://www.cloudflare.com/products/tunnel/ - Documentation (public apps): https://developers.cloudflare.com/tunnel/ - Documentation (private networks, Cloudflare One): https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/ - Run parameters (protocol, post-quantum): https://developers.cloudflare.com/tunnel/reference/run-parameters/ - Changelog, Tunnel in the main dashboard (2026-02-20): https://developers.cloudflare.com/changelog/post/2026-02-20-tunnel-core-dashboard/ - Changelog, manage tunnels with Wrangler (2026-03-19): https://developers.cloudflare.com/changelog/post/2026-03-19-wrangler-tunnel-commands/ - Changelog, share local dev servers through a tunnel (2026-05-18): https://developers.cloudflare.com/changelog/post/2026-05-18-local-dev-tunnels/ - Changelog, Cloudflare Mesh (2026-04-14): https://developers.cloudflare.com/changelog/post/2026-04-14-cloudflare-mesh/ - Changelog, cloudflared architecture deprecation (2026-09-18): https://developers.cloudflare.com/changelog/post/2026-09-18-cloudflared-architecture-deprecation/ - Changelog, protected Quick Tunnels (2026-10-02): https://developers.cloudflare.com/changelog/post/2026-10-02-protected-quick-tunnels/ - `cloudflared` GitHub: https://github.com/cloudflare/cloudflared ## Related - [[Cloudflare]] - [[Cloudflare Access and Zero Trust]] - [[Cloudflare Mesh]] - [[Cloudflare WAF]] - [[Cloudflare Hyperdrive]] - [[Wrangler]] - [[WireGuard]] - [[Tailscale]]