Cloudflare Tunnel

Protect your web servers from direct attack

From the moment an application is deployed, developers and IT spend time locking it down: configuring ACLs, rotating IP addresses, and using clunky solutions like GRE tunnels.

There’s a simpler and more secure way to protect your applications and web servers from direct attacks: Cloudflare Tunnel.

Ensure your server is safe, no matter where it’s running: public cloud, private cloud, Kubernetes cluster, or even a Mac mini under your TV.

Challenges of protecting origin infrastructure

Your origin IP addresses and open ports are exposed and vulnerable to advanced attackers, even when they’re behind your cloud-based security services. Some common ways to stop these direct DDoS or data breach attempts include creating ACLs and allowing incoming IP addresses, or establishing GRE tunnels and enabling IP security.

These approaches are painful to setup and maintain, lack fully integrated encryption, and can be slower or more costly.

Securely connect origins directly to Cloudflare

The Tunnel daemon creates an encrypted tunnel between your origin web server and Cloudflare’s nearest data center — all without opening any public inbound ports.

After locking down all origin server ports and protocols using your firewall, any request on HTTP/S ports are dropped, including volumetric DDoS attacks. Data breach attempts — such as snooping of data in transit or brute force login attacks — are blocked entirely.

Tunnel lets you quickly secure and encrypt application traffic to any type of infrastructure, freeing you to focus on delivering great applications. Now you can encrypt origin traffic and hide your web server IP addresses so direct attacks can’t happen.

Learn more about the Tunnel story.

Protect web servers from direct attacks

After you deploy the Tunnel daemon and lock down your firewall, only inbound web traffic through Cloudflare’s network ever reaches your application’s origin servers.

Now your web server’s firewall blocks volumetric DDoS attacks and customer data breach attempts.

Secure access to internal applications

Tunnel is the perfect solution for only allowing the right people to access internal applications (including those in development environments) that you’d like to make externally facing.

When Tunnel is combined with Cloudflare Access, users are authenticated by major identity providers, like Gsuite and Okta, without a VPN.

Applications once accessible to anyone through the origin IP are now only accessible by authenticated users through Cloudflare’s network.

Accelerate origin traffic with Smart Routing

To use Tunnel, you’ll need to enable your Argo subscription in the Cloudflare dashboard. Argo includes access to: Smart Routing, Tunnel, and Tiered Caching.

Argo Smart Routing improves application performance by routing visitors through the least congested and most reliable paths, using Cloudflare's private network. Smart Routing reduces average origin traffic latency by 30% and connection errors by 27%.

Learn more

Key Features

Easy-to-install agent with low performance overhead

Command-line configuration

Load-balanced across origin pools (when used with Cloudflare Load Balancer)

Custom tags to identify tunnels

Encrypted tunnels with TLS (origin-side certificates)

Application and protocol-level error logging


Trusted by approximately 25 million Internet properties