Tools · SPBoucher
Menu

Cloudflare Tunnel

In-depth entry

by Cloudflare, Inc. · Service · also known as cloudflared, Argo Tunnel

Outbound-only connector (cloudflared) that publishes local web services and private networks through Cloudflare's edge without opening inbound ports

Apache-2.0 licenseFreemiumPaidEnterpriseCloudLocal
Visit official site Compare

Link verified Nov 2, 2026

Overview

Cloudflare Tunnel is the connector component of Cloudflare One, formerly sold as Argo Tunnel. A daemon called cloudflared, open source under Apache-2.0, runs next to the service to be published and opens persistent outbound connections to several Cloudflare data centers. Requests for a hostname in a Cloudflare-managed DNS zone are routed through those connections to the local origin, so the server needs no public IP address, port forwarding or certificate of its own: TLS terminates at Cloudflare's edge and the hop to the origin is carried inside the tunnel.

A named tunnel is created once, receives a UUID and credentials, and can carry many hostnames through an ingress list that maps each to a local URL; the same tunnel can also expose private IP ranges to users running the WARP client, which turns it into a Zero Trust replacement for a VPN. Cloudflare Access policies can sit in front of any published hostname to require identity-provider login. Quick tunnels provide a random trycloudflare.com URL for one-off sharing without an account. cloudflared runs as a service on Linux, macOS and Windows and as a container.

It is the usual way to publish services from a home network, a laptop or machines behind carrier-grade NAT, and is widely used alongside self-hosted dashboards and APIs. Constraints: the domain must use Cloudflare DNS, all public traffic transits Cloudflare and is decrypted there, non-HTTP protocols require WARP or cloudflared access on the client side, and the free tier is subject to Cloudflare's terms for non-HTML content and usage.

Editorial note on uncertainty. license_spdx covers the cloudflared connector; the edge service is proprietary.

Capabilities

  • Publish local HTTP services under a Cloudflare-managed hostname with no inbound ports
  • Named tunnels with ingress rules mapping many hostnames to local origins
  • Private network routing to WARP clients for VPN-style access
  • Cloudflare Access policies in front of published applications
  • Quick tunnels with a temporary public URL for ad hoc sharing
  • Runs as a system service, container or Kubernetes deployment

Typical workflows

  1. Expose a self-hosted web app from a home server or Mac mini
  2. Protect an internal dashboard behind single sign-on with Access
  3. Give remote staff access to a private subnet through WARP
  4. Share a local development server temporarily

Strengths

  • No open firewall ports, static IP or certificate management on the origin
  • Open-source connector with multi-region redundancy
  • Integrates with Cloudflare's WAF, caching and Zero Trust policies
  • Usable at no cost for typical personal deployments

Limitations

  • Requires the domain's DNS to be hosted at Cloudflare
  • TLS is terminated at Cloudflare; traffic is visible to the provider
  • Non-HTTP protocols need client-side software (WARP or cloudflared access)
  • Subject to Cloudflare terms and plan limits

Prerequisites

  • Cloudflare account with a domain on Cloudflare DNS
  • cloudflared installed on a host that can reach the service

Who it is for

  • Self-hosters and homelab operators
  • Teams replacing a VPN with Zero Trust access
  • Developers sharing local services

Alternatives & comparison

ngrok offers the same outbound model as a standalone product with its own domains and a closed-source agent; Cloudflare Tunnel is tied to a Cloudflare DNS zone but the connector is open source. Tailscale builds a private mesh first and exposes services publicly only through Funnel. A self-managed WireGuard link to a VPS running Caddy reproduces the architecture under the operator's control, keeping TLS termination out of a third party's hands at the cost of running the gateway.

  • Caddy

    Go web server and reverse proxy that obtains and renews TLS certificates automatically and is configured with a short Caddyfile or a JSON API

    Open sourceOpen source
  • ngrok

    Hosted ingress service that exposes local servers through public URLs via an agent or SDK, with Traffic Policy rules, API gateway features and reserved domains

    ProprietaryFreemium
  • Tailscale

    WireGuard-based mesh overlay network with a hosted coordination service, identity-provider login, access policies, MagicDNS and features such as Tailscale SSH, Serve and Funnel

    MixedFreemium
  • WireGuard

    Minimal, high-speed VPN protocol and implementation built on modern cryptography, included in the Linux kernel and available on macOS, iOS, Windows, Android and BSD

    Open sourceOpen source
Compare Cloudflare Tunnel with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    cloudflared LICENSE (Apache-2.0)

    https://github.com/cloudflare/cloudflared/blob/master/LICENSE

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    Cloudflare Tunnel · Cloudflare One docs

    https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel

    Supports: name, summary, capabilities, description

    checked Nov 1, 2026
  • Official site
    Cloudflare

    https://www.cloudflare.com/

    Supports: vendor

    checked Nov 1, 2026
  • Pricing page
    Cloudflare Plans

    https://www.cloudflare.com/plans

    Supports: pricing_model

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

OpenSSH

OpenBSD Project · Tunneling & remote access

Reference implementation of the SSH protocol from the OpenBSD project: remote shell, file transfer, port forwarding, key agent and certificate authority tooling

SSH-OpenSSHOpen sourceFreeLocalSelf-hostedNov 2, 2026