cloudflared — Cloudflare Tunnel Client for Exposing Services Without Opening Ports

What it is

cloudflared is the client daemon for Cloudflare Tunnel. It creates encrypted outbound connections from your local machine to Cloudflare's network, allowing you to expose a local web app, SSH server, RDP, or any TCP service to the internet without opening inbound firewall ports, configuring NAT, or managing a VPN. Cloudflare handles DNS, TLS certificates, and DDoS protection automatically.

Developers who need to share local development servers, expose self-hosted services, or set up secure remote access to machines behind NAT benefit most. cloudflared replaces tools like ngrok for permanent tunnel setups with Cloudflare's global network.

How it saves time or tokens

Traditional approaches to exposing local services require port forwarding, dynamic DNS, TLS certificate management, and firewall configuration. cloudflared handles all of this with a single command. The tunnel is outbound-only, so no inbound ports need to be opened -- this simplifies network security significantly. Cloudflare's free tier includes unlimited tunnels, DDoS protection, and automatic TLS.

How to use

1. Install cloudflared:

# macOS
brew install cloudflared

# Linux
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o cloudflared
chmod +x cloudflared

1. Authenticate with your Cloudflare account:

cloudflared tunnel login

1. Create and run a tunnel:

cloudflared tunnel create my-app
cloudflared tunnel route dns my-app myapp.example.com
cloudflared tunnel run --url http://localhost:3000 my-app

Your local app on port 3000 is now available at myapp.example.com with HTTPS.

Example

# config.yml for persistent tunnel configuration
tunnel: my-app
credentials-file: /root/.cloudflared/my-app.json

ingress:
  - hostname: app.example.com
    service: http://localhost:3000
  - hostname: api.example.com
    service: http://localhost:8080
  - hostname: ssh.example.com
    service: ssh://localhost:22
  - service: http_status:404

# Quick expose without a named tunnel (temporary)
cloudflared tunnel --url http://localhost:8080

Related on TokRepo

• DevOps Tools -- Infrastructure and deployment tools
• Self-Hosted Solutions -- Tools for self-hosting services securely

Common pitfalls

• Quick tunnels (without tunnel create) generate random hostnames and are temporary. For persistent access, create a named tunnel and configure DNS routing.
• cloudflared must stay running for the tunnel to work. Use a process manager (systemd, launchd, PM2) to keep it alive in production.
• Cloudflare requires you to own the domain and manage its DNS through Cloudflare. You cannot route tunnel traffic to domains on other DNS providers.