Cloudflare Tunnel DNS

Cloudflare Tunnel creates a secure, outbound-only connection from your server to Cloudflare's edge network, eliminating the need to open inbound firewall ports. You run the cloudflared daemon, which establishes a persistent tunnel so your services are accessible through Cloudflare without being directly exposed to the internet. This is fundamentally different from traditional port forwarding, which opens your server to inbound traffic.

Yes, Cloudflare Tunnel is available at no additional cost as part of Cloudflare's Zero Trust platform on the free tier. You need a Cloudflare account and a domain managed through Cloudflare DNS. There are no per-tunnel or bandwidth charges for basic usage, though advanced Zero Trust features like complex access policies require paid plans.

Yes, Cloudflare Tunnel is widely used by homelab users to securely expose self-hosted services like Home Assistant, Plex, Jellyfin, and Proxmox without port forwarding. You create a tunnel, assign it to a hostname on your Cloudflare-managed domain, and optionally configure access policies through Cloudflare Access. This adds authentication layers that raw port forwarding does not provide.

If the cloudflared daemon loses its connection, your services become temporarily unreachable through the tunnel until reconnection occurs. Cloudflared includes automatic reconnection logic and will attempt to re-establish the tunnel. For high availability, you can run multiple cloudflared instances on different machines connected to the same tunnel.