Cloudflare Tunnel explained

Cloudflare Tunnel gives a home app a public web address without opening a port. Here is how it works, what Cloudflare sees, and its limits.

What it is

Cloudflare Tunnel connects an app on your home server to Cloudflare's network, so people can open it at an address like photos.example.com. Your router keeps every port closed. Tunnel is available on all Cloudflare plans, including the free one.

It is one of the three front doors described in Choose your front door. It works best when you want to share an app with people who will not install anything.

How it works

You run a small program named cloudflared on a machine at home, often in a Docker container next to your apps. cloudflared makes an outbound connection through your firewall to Cloudflare. Your router permits this, just like it permits your browser to load a website. (Behind a strict outbound firewall, allow port 7844 over TCP and UDP to the Cloudflare addresses listed there.) Because the connection starts inside your home, your router needs no port forwards and your server needs no public IP address.

When a visitor opens photos.example.com:

Their browser connects to Cloudflare, because your DNS record for that name points to your tunnel.
Cloudflare sends the request down the open tunnel to cloudflared.
cloudflared passes it to the app on your home network, for example http://192.168.1.20:2283.
The answer returns along the same path.

When you create a tunnel, Cloudflare provides a token for cloudflared. Treat it like a password: never commit it to Git or show it in a screenshot.

In Cloudflare's dashboard, each public name you add is a published application: a hostname mapped to a local service address. One tunnel can serve many apps under different names.

Why you should not open ports explains why a closed router matters. Remember: a tunnel hides your home IP address, but it leaves the app visible. Anyone with the address reaches the app's login page. Update the app regularly and use strong passwords, or add Cloudflare Access (below).

What you need

A free Cloudflare account. Tunnel itself is available on all plans. The Zero Trust setup, which Access requires (see below), asks for payment details, but the Free plan is not charged.
A domain on Cloudflare. Cloudflare must run DNS for your domain before you can publish an app. If you bought the domain elsewhere, change its nameservers to Cloudflare's at your registrar. The domain stays registered there. If DNSSEC is on, turn it off at that company first, and turn it on again in Cloudflare once Cloudflare marks the domain Active. Confirm that Cloudflare imported every record, especially mail records. A spare domain for your home lab is the safest choice.
A machine at home that runs continuously, to host cloudflared.

You do not need a public IP address. Tunnel works well when your internet provider shares one IP address among many customers (CGNAT) and prevents port forwarding.

What Cloudflare can see

Most guides skip this part.

When a visitor connects to photos.example.com, the encrypted HTTPS connection ends at Cloudflare. Cloudflare's documentation is direct: TLS terminates at Cloudflare's global network, and Cloudflare opens a separate connection to your machine. Cloudflare decrypts the request, processes it, and forwards it through the tunnel.

Cloudflare can see everything passing through in clear text: pages, photos, uploaded files, and usernames and passwords entered on the app's login page. Cloudflare needs this access to cache content, stop attacks, and enforce rules. Decide if that fits your use case. For recipes, most people will not mind. For medical records or private family photos, evaluate the risks before putting them behind the tunnel.

If you object to a third party reading that traffic, use a private network instead, or run your own tunnel server (see the last section).

Limits on video and large files

Cloudflare built its network to serve web pages, and its terms reflect that. The Service-Specific Terms for Application Services, last updated September 28, 2026, state in the section "Content Delivery Network (Free, Pro, or Business)":

Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users' access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files.

The Cloudflare Tunnel FAQ confirms that this rule applies to apps published through a tunnel on Free, Pro, and Business plans. It does not apply to private network routes, which publish nothing to the public internet.

Streaming movies from a home media server to friends through a public tunnel address is the kind of use these terms cover. The terms also name pictures and audio, so a large photo library or music server on a public tunnel risks the same penalty. The terms do not mandate an immediate ban. They state Cloudflare may limit or disable access, with reasonable efforts to notify you first. To stream video, use a private network instead.

Uploads also have size caps. On Free and Pro plans, Cloudflare rejects requests larger than 100 MB with error 413. If you upload large videos to a photo app or file-sync app through the tunnel, single uploads past that size fail unless the app chunks files into smaller parts.

Cloudflare Access adds Cloudflare's login screen in front of a published app. Visitors must authenticate before traffic reaches your home. You configure Access policies to define authorized users, such as a list of email addresses. A standard household setup allows specific email addresses for family members, who log in with a one-time code sent by email.

Access belongs to Cloudflare's Zero Trust suite. Its free plan costs $0 and has a 50 user limit, which fits family and friends. Setting up Zero Trust requires payment details even on the free plan, but Cloudflare does not charge you.

Keep two points in mind:

An Access policy that accepts any valid email login allows anyone with any email address to enter. Cloudflare's documentation warns about this case. Explicitly specify the people or addresses you trust.
Many self-hosted apps provide dedicated phone apps that connect directly to the server. A phone app often fails behind a browser-based login screen. Test mobile apps before relying on Access.

When to pick something else

Pangolin on your own server. Pangolin operates like Cloudflare Tunnel, but you host the server component, typically on a small rented VPS. A local connector dials out to your VPS, keeping your router ports closed, and Pangolin supplies its own authentication layer. TLS terminates on your VPS instead of a third party, and no CDN terms apply to what you serve. You must pay for the VPS, patch the system, and open TCP 80 and 443 and UDP 51820 on it. The Community Edition is open source under the AGPL-3.

A private network. If only you and your family use the app, avoid public addresses entirely. Tailscale, NetBird, or WireGuard with wg-easy let your devices connect securely. This setup removes public login screens, file size caps, and video streaming restrictions. What is Tailscale? explains the mechanics.

Both. Many people secure most apps on a private network, using a tunnel only for the single app they share publicly.

Checked October 2026.