Cloud Parts

Cloudflare Tunnel

A small daemon, cloudflared, dials out from your network to Cloudflare, so servers can be published or reached privately with no public IP and no open inbound ports.

What it is
Remote access
Type
Commercial product
Made by
Cloudflare, Inc.
License
Proprietary service (cloudflared is Apache 2.0)
Facts checked
12 October 2026
Website Source code

What it is

You run cloudflared next to your services. It opens four long-lived, outbound connections to at least two Cloudflare data centers, on port 7844 over QUIC or HTTP/2, and keeps them open. Requests then travel back down those connections, so the firewall can block all inbound traffic. A tunnel is a record in your account with a UUID; each running cloudflared is a connector, and you can run up to 25 replicas of one tunnel on different hosts for redundancy, with traffic going to the nearest one.

Routes decide what uses the tunnel. A published application maps a public hostname such as app.example.com to a local service like http://localhost:8080 through a CNAME to <UUID>.cfargotunnel.com, and gets Cloudflare’s cache, WAF and DDoS protection on the way. A private network route sends traffic from enrolled devices to private IPs or hostnames behind the tunnel, as a VPN replacement, and Workers can reach private services through it too. Besides HTTP, it carries TCP, SSH, RDP and SMB, though for those users also run cloudflared on their side. Who may connect is decided separately, usually by Cloudflare Access. Tunnel is available on all plans at no charge.

Why teams pick it

  • No public IP, open port or firewall exception: the origin only makes outbound connections, so it can’t be reached around Cloudflare
  • Free on all plans, and quick to start: cloudflared tunnel --url http://localhost:8080 gives a temporary trycloudflare.com address with no account
  • Up to 25 replicas per tunnel for redundancy, and tunnels can be endpoints in Cloudflare Load Balancing pools for health-checked failover
  • One connector serves public hostnames, private network routes and Workers VPC at once

Watch out for

  • Ties your ingress to Cloudflare: if a tunnel stops, its DNS records stay and visitors get a 1016 error
  • Replicas of one tunnel act as a single endpoint to a load balancer; for steering or session affinity across hosts you need separate tunnels
  • Non-HTTP services (TCP, SSH, RDP) need client-side software, and quick tunnels are capped at 200 in-flight requests with no uptime guarantee
  • Accounts are limited to 1,000 tunnels and 1,000 routes, and Free, Pro and Business terms restrict serving video and other large files through proxied hostnames

Alternatives

What all remote access have in common →
Cloudflare AccessCommercialThe identity-aware proxy in Cloudflare One: every request to a protected app must carry a signed token that says who the user is and that a policy allowed them in.HashiCorp BoundaryCommercialAn identity-aware proxy: users sign in once and get one proxied session to one private host or database, with credentials fetched per session.

How it fits with other technologies

config.yml for a locally managed tunnel: two hostnames and a catch-all · yaml

tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
ingress:
  - hostname: gitlab.widgetcorp.tech
    service: http://localhost:80
  - hostname: gitlab-ssh.widgetcorp.tech
    service: ssh://localhost:22
  - service: http_status:404   # the last rule must match everything

# cloudflared tunnel route dns <UUID or NAME> gitlab.widgetcorp.tech
# cloudflared tunnel run <NAME>

See it in a real stack

No architecture uses Cloudflare Tunnel yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2017–2023

Cloudflare has always worked as a reverse proxy: a site changes its nameservers, and requests reach Cloudflare before the origin. But if an attacker finds the origin’s IP address, they can go around Cloudflare. The usual fix was a GRE tunnel, which Cloudflare called expensive and slow: it needed network teams on both sides, was mostly sold to large companies, and its encapsulation forced a smaller MTU or packet fragmentation.

During its beta the product was called Warp. On April 5, 2018, Dani Grant announced it as Argo Tunnel: a daemon, cloudflared, that dials out to Cloudflare, so “for the rest of the internet, it’s unroutable, as if the server is not even there.” It was bundled with the paid Argo Smart Routing, because visitor traffic had to reach the data centers closest to the origin. The same year, the launch of Cloudflare Access suggested pairing the two so an internal app needs no public IP at all.

On April 15, 2021, Cloudflare made the outbound-only connection free for every organization and renamed the product Cloudflare Tunnel. Named Tunnels gave each tunnel a permanent UUID so restarts reconnect instead of creating a new tunnel, and moving to Cloudflare’s Unimog edge load balancer raised the average life of a tunnel connection from minutes to days.

Why it’s built this way

Outbound-only connections from a daemon
Most firewalls already allow outbound traffic, so cloudflared needs no inbound rule, and the origin can then refuse everything that does not come through the tunnel.
Bundle it with Argo at first
Tunnel traffic had to reach the Cloudflare data centers nearest the origin, which is what Argo Smart Routing did, so Cloudflare included Tunnel with Argo at no extra cost.
Make it free in 2021
Cloudflare wanted Zero Trust security “accessible to everyone, regardless of size, scale, or resources”, and Tunnel was the piece that connects resources to it.

Timeline

  1. 2017

    The cloudflared repository is created on GitHub

  2. 2018

    Launched on April 5 as Argo Tunnel, after a beta under the name Warp

  3. 2021

    Free for everyone and renamed Cloudflare Tunnel on April 15; Named Tunnels get permanent UUIDs

  4. 2023

    Load Balancing can reach private IPs through tunnels

Sources9 · facts checked 12 October 2026

Improve this page on GitHub