cloudflare/cloudflared

cloudflared is worth trying if you already route a domain through Cloudflare and want to expose a service on a private machine without inbound firewall rules. It is an outbound tunnel daemon tied to Cloudflare's network, not a standalone reverse proxy you can host yourself.

The problem

You have a web app, SSH host or RDP endpoint running on a machine you would rather not expose directly to the internet, and poking holes in the firewall means an open port and a public IP to defend. With Cloudflare Tunnel, the daemon makes outbound connections to Cloudflare, which forwards client requests back through that tunnel to your origin. You keep your firewall closed and get a public hostname wired to the origin instead. The step that changes is ingress: clients no longer reach your machine directly, and the Cloudflare network becomes the public entry point.

What's different

This is a managed connector rather than a self-contained tunnelling server. You add a domain to a Cloudflare account, point its nameservers at Cloudflare, create a tunnel, and route traffic to it through DNS records, a Cloudflare Load Balancer, or WARP private traffic. Authentication happens through the Cloudflare account, so the operational control plane sits outside your machine. That is the central trade-off: less public attack surface and less router configuration, in exchange for dependence on Cloudflare's account, DNS and network. The README says origins can stay "as closed as possible", which is a framing claim, not evidence that your origin is secure against every path.

The client also handles Layer 4 access for TCP protocols such as SSH and RDP through cloudflared access. Alternatively, the WARP client can reach private origins behind tunnels without running cloudflared access on the client side. That choice matters: one approach keeps a CLI on each connecting user's machine, the other moves access management into a WARP deployment. Some setup is still required before any of it works, which is covered below.

Who should try it

A good fit is someone with a domain already managed in Cloudflare who wants to reach a home lab, internal admin tool or SSH box through a public hostname while keeping the origin firewall closed. The managed control plane reduces the moving parts you operate yourself. A poor fit is someone who wants a tunnel that works without a Cloudflare account or DNS delegation, or who needs the ingress layer to run entirely on their own infrastructure. If you want to evaluate the tunnel first, TryCloudflare is documented as a way to test without adding a website, which opens the project to a quick trial rather than a full domain migration.

Requirements and limitations

The README states that adding a website to Cloudflare and changing its nameservers to Cloudflare is still required before use, even though tunnels can now be used without a public website for private routing. That legacy requirement is the largest adoption hurdle: you cannot treat this as a drop-in local proxy on an arbitrary domain. Tunnels and routing are configured through the Cloudflare dashboard and documentation, and the client is a connector, not the routing service itself.

Support is tied to releases within one year of the most recent version, and breaking changes unrelated to feature availability may affect older releases. In practice that means an upgrade cadence is part of ongoing upkeep, not a one-time install. The project documents standalone binaries, a Docker image, and Debian, RPM and Homebrew packages, plus source builds with Go and Cap'n Proto. Note that the repository is the client: the network side is Cloudflare's, so local testing cannot reproduce the whole path. Consult the download and update guidance rather than assuming an old install will remain supported.

HotRepo's take

HotRepo's only dated observation is a single daily-board appearance on 2026-10-27, when the repository had 16,292 stars and gained 45 that day; with one recorded date, interest persistence cannot be judged. The project itself dates to 2017, so the client is not new. Before adopting, verify your domain and DNS setup against the documented Cloudflare Tunnel requirements, since the domain prerequisite is the decision point for many private-network users.