Cloudflare Tunnel

Protect your web servers from direct attack

From the moment an application is deployed, developers and IT spend time locking it down: configuring ACLs, rotating IP addresses, and using clunky solutions like GRE tunnels.

There’s a simpler and more secure way to protect your applications and web servers from direct attacks: Cloudflare Tunnel.

Ensure your server is safe, no matter where it’s running: public cloud, private cloud, Kubernetes cluster, or even a Mac mini under your TV.

Challenges of protecting origin infrastructure

Your origin IP addresses and open ports are exposed and vulnerable to advanced attackers, even when they’re behind your cloud-based security services. Some common ways to stop these direct DDoS or data breach attempts include creating ACLs and allowing incoming IP addresses, or establishing GRE tunnels and enabling IP security.

These approaches are painful to setup and maintain, lack fully integrated encryption, and can be slower or more costly.

Securely connect origins directly to Cloudflare

The Tunnel daemon creates an encrypted tunnel between your origin web server and Cloudflare’s nearest data center — all without opening any public inbound ports.

After locking down all origin server ports and protocols using your firewall, any request on HTTP/S ports are dropped, including volumetric DDoS attacks. Data breach attempts — such as snooping of data in transit or brute force login attacks — are blocked entirely.

Tunnel lets you quickly secure and encrypt application traffic to any type of infrastructure, freeing you to focus on delivering great applications. Now you can encrypt origin traffic and hide your web server IP addresses so direct attacks can’t happen.

Learn more about the Tunnel story.

Protect web servers from direct attacks

After you deploy the Tunnel daemon and lock down your firewall, only inbound web traffic through Cloudflare’s network ever reaches your application’s origin servers.

Now your web server’s firewall blocks volumetric DDoS attacks and customer data breach attempts.

Secure access to internal applications

Tunnel is the perfect solution for only allowing the right people to access internal applications (including those in development environments) that you’d like to make externally facing.

When Tunnel is combined with Cloudflare Access, users are authenticated by major identity providers, like Gsuite and Okta, without a VPN.

Applications once accessible to anyone through the origin IP are now only accessible by authenticated users through Cloudflare’s network.

Accelerate origin traffic with Smart Routing

To use Tunnel, you’ll need to enable your Argo subscription in the Cloudflare dashboard. Argo includes access to: Smart Routing, Tunnel, and Tiered Caching.

Argo Smart Routing improves application performance by routing visitors through the least congested and most reliable paths, using Cloudflare's private network. Smart Routing reduces average origin traffic latency by 30% and connection errors by 27%.

Learn more

Tunnel Walkthrough

Setting up Tunnel to protect origin servers and ports is easy

  • Install Tunnel Daemon
  • Login to Cloudflare
  • Start a Tunnel
  • Confirm Lockdown
$ brew install cloudflare/cloudflare/cloudflared
==> Installing cloudflared from
==> Downloading

Install Tunnel Daemon
Using Homebrew, run this command to install Tunnel on Mac OSX. For more installation options, and to download the daemon for Windows, Mac, or Linux, visit the Tunnel documentation.
$ cloudflared login

Login to Cloudflare
After the Tunnel daemon is installed, associate the client with your Cloudflare host by logging in and selecting the zone which you’d like to add Tunnel.
$ cloudflared --hostname
  --url http://localhost:8000

INFO Registered at

Start a Tunnel
Define a hostname with which you’d like to establish a Tunnel connection. The Tunnel software will automatically create a DNS record, appearing in your Cloudflare dashboard, making setup incredibly easy.
$ netcat -v -z [Origin IP Address] 80
[Origin IP Address] 80 (http):
Connection refused
$ netcat -v -z [Origin IP Address] 443 [Origin IP Address] 443 (https): Connection refused
Confirm Lockdown of Ports 80 & 443
By sending a request to the origin server directly using ports 80 and 443, rather than through Cloudflare, we can confirm that the connection is refused and Tunnel has been successfully activated.

Key Features

Easy-to-install agent with low performance overhead

Command-line configuration

Load-balanced across origin pools (when used with Cloudflare Load Balancer)

Custom tags to identify tunnels

Encrypted tunnels with TLS (origin-side certificates)

Application and protocol-level error logging

Trusted by approximately 25 million Internet properties