pranavv

· 6 min

Public access without opening a port

Remember in my last blog when I mentioned Tailscale was amazing for accessing my servers remotely, but had one major limitation? Yeah, the whole "it's private only" thing. Well, I promised I'd show you how to get around that, and here we are.

Enter Cloudflare Tunnels, the solution that lets you expose your local services to the public internet without any of the traditional headaches. No port forwarding, no exposing your home IP, no begging your ISP to stop blocking ports (looking at you again, Airtel). Just pure, secure magic.

The Problem (Again)

So picture this: you've got your home server running some cool project, maybe a personal website, a Discord bot, or even a small API you built for fun. You want to share it with friends, or maybe you just want to access it from anywhere without being tied to your Tailnet. With traditional setups, you'd have to:

  1. Forward ports on your router (ugh)
  2. Deal with dynamic IP addresses
  3. Worry about your home IP being exposed to the internet
  4. Fight with your ISP's restrictions (seriously, why do they block everything?)
  5. Set up SSL certificates manually
  6. Pray nothing breaks

It's a mess. And honestly, it's just not worth the security risks for most people.

What is Cloudflare Tunnel?

Cloudflare Tunnel is basically a secure way to connect your local services to the internet through Cloudflare's network. Instead of opening ports on your router, you create an encrypted tunnel from your server to Cloudflare's edge servers. When someone visits your domain, Cloudflare routes the traffic through this tunnel to your local service.

Think of it like this: instead of opening your front door to the street, you're building a secret underground tunnel that connects your house to a secure checkpoint. People can visit the checkpoint, but they never actually know where your house is or how to get there directly.

The best part? It's completely free for basic use, includes SSL certificates automatically, and works with any domain you own (or even subdomains of Cloudflare's own domains).

How I Set It Up

Alright, let's get into the actual setup. Fair warning: this might seem a bit involved at first, but once you get the hang of it, it's actually pretty straightforward.

Step 1: Get Your Domain Ready

First things first, you need a domain. If you don't have one, you can grab a cheap one from any registrar. I personally use Namecheap, but honestly, any registrar works fine.

Once you have your domain, you need to add it to Cloudflare:

  1. Go to cloudflare.com↗ and create a free account
  2. Add your domain by clicking "Add a Site"
  3. Choose the free plan (seriously, it's more than enough for most people)
  4. Follow the instructions to change your nameservers to Cloudflare's

This part might take a few hours to propagate, so grab some coffee and be patient.

Step 2: Install Cloudflared

On your server (the one you want to expose to the internet), you need to install cloudflared. Since I'm running Ubuntu on most of my servers, here's what I did:

# Download and install cloudflared
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb 
sudo dpkg -i cloudflared.deb

If you're on a different platform, just check Cloudflare's documentation↗, they have instructions for pretty much everything.

Step 3: Authenticate Cloudflared

Now you need to connect your server to your Cloudflare account:

cloudflared tunnel login

This will open a browser window where you need to log in to Cloudflare and authorize the connection. Once you do that, it'll download a certificate to your server.

Step 4: Create a Tunnel

Time to create your actual tunnel:

cloudflared tunnel create my-awesome-tunnel

Replace "my-awesome-tunnel" with whatever name you want. This creates a tunnel and gives you a tunnel ID—make sure to save this, you'll need it.

Step 5: Configure Your Tunnel

Create a configuration file for your tunnel:

sudo nano ~/.cloudflared/config.yml

Here's what mine looks like:

tunnel: your-tunnel-id-here
credentials-file: /home/yourusername/.cloudflared/your-tunnel-id.json

ingress:
  - hostname: myproject.yourdomain.com
    service: http://localhost:3000
  - hostname: api.yourdomain.com
    service: http://localhost:8080
  - service: http_status:404

Let me break this down:

  • tunnel: Your tunnel ID from step 4
  • credentials-file: Path to the JSON file that was created when you made the tunnel
  • ingress: This is where the magic happens. You map hostnames to local services

In my example, I'm exposing:

  • A web app running on port 3000 at myproject.yourdomain.com
  • An API running on port 8080 at api.yourdomain.com
  • The last line is a catch-all that returns 404 for anything else

Step 6: Create DNS Records

Back in your Cloudflare dashboard, you need to create CNAME records for each hostname you want to use:

  1. Go to the DNS section of your domain
  2. Add a CNAME record:
    • Name: myproject (or whatever subdomain you want)
    • Target: your-tunnel-id.cfargotunnel.com
    • Make sure the proxy is enabled (orange cloud icon)

Repeat this for each hostname in your config.

Step 7: Start Your Tunnel

Finally, run your tunnel:

cloudflared tunnel run my-awesome-tunnel

If everything is set up correctly, you should see some logs indicating the tunnel is connected. Now try visiting your domain—you should see your local service!

Step 8: Run as a Service (Optional but Recommended)

You probably want this tunnel to start automatically and keep running. Install it as a service:

sudo cloudflared service install

Now your tunnel will start automatically when your server boots up.

How It Works with Tailscale

Here's where things get really cool. I'm running both Tailscale and Cloudflare Tunnels on my servers, and they work together perfectly.

  • Tailscale handles all my private access: SSH, internal services, file sharing, etc.
  • Cloudflare Tunnel handles the public stuff: websites, APIs, anything I want to share

It's like having a private VPN for personal use and a public gateway for sharing projects. The security is amazing because:

  1. My home IP is never exposed
  2. Only the services I specifically tunnel are accessible
  3. Everything goes through Cloudflare's DDoS protection
  4. SSL is handled automatically
  5. I can use Cloudflare's firewall rules to block bad people

The Best Part: It's Free!

Seriously, Cloudflare Tunnels are completely free for personal use. You get:

  • Unlimited bandwidth (within reason)
  • Automatic SSL certificates
  • DDoS protection
  • Global CDN
  • Basic firewall rules

There are paid features if you need them (like advanced security rules or higher limits), but for most self-hosted projects, the free tier is more than enough.

Some Cool Use Cases

Since setting this up, I've been using Cloudflare Tunnels for:

  • Personal portfolio: My main website that showcases my projects
  • Discord bots: Hosting bot dashboards and webhooks
  • API endpoints: For mobile apps I'm building
  • Game servers: Minecraft, among others (though you need TCP tunnels for this)
  • Development previews: Quickly sharing work-in-progress projects with friends

The flexibility is insane. I can spin up a local development server, add it to my tunnel config, and instantly share it with anyone without worrying about firewalls or port forwarding.

Things to Watch Out For

It's not all perfect, though. Here are a few things to keep in mind:

Cloudflare's Terms of Service: Don't use tunnels for anything that violates their ToS. This includes things like serving large files, running certain types of services, or doing anything illegal. Read their terms—they're pretty reasonable.

Latency: Since your traffic goes through Cloudflare's network, you might notice a tiny bit of extra latency compared to direct connections. It's usually not noticeable for web apps, but it might matter for real-time applications.

Dependency: You're now dependent on Cloudflare's service. If they have issues, your publicly accessible services go down too. (Though to be fair, Cloudflare's uptime is pretty stellar.)

Configuration complexity: While the basic setup is straightforward, advanced configurations can get complex. But honestly, that's true for most networking stuff.

Combining with Other Tools

One thing I love about this setup is how well it plays with other tools:

  • Tailscale + Cloudflare Tunnel: Perfect combo for private and public access
  • Docker: You can easily tunnel containerized services
  • Reverse proxies: Works great with Nginx, Caddy, or Traefik
  • Monitoring: Cloudflare's analytics give you insights into your traffic

TL;DR

Cloudflare Tunnels let you expose your local services to the internet securely and for free, without port forwarding or exposing your home IP.

Setup involves: adding your domain to Cloudflare, installing cloudflared, creating a tunnel, configuring DNS, and running the tunnel.

It works perfectly alongside Tailscale—private access through Tailscale, public access through Cloudflare Tunnels.

Free tier includes unlimited bandwidth, SSL certificates, DDoS protection, and global CDN.

Great for personal websites, APIs, Discord bots, development previews, and more.

Just follow Cloudflare's ToS and you're good to go!

Comments

Loading comments…

All writing