← Act 2: Network Services & Zero Trust

Cloudflare Tunnel

What is it?

Cloudflare Tunnel is a connectivity tool that creates a secure, outbound-only connection from your infrastructure to Cloudflare's global network. Instead of exposing a public IP address and opening inbound firewall ports, you install a lightweight daemon called cloudflared on your server. It dials out to Cloudflare using post-quantum encrypted connections — so your origin server is never directly reachable from the internet. No public IPs. No open ports. No attack surface.

What problem does it solve?

Traditionally, exposing an application to the internet (or to internal users) requires a public IP address and open firewall ports — both of which create security risks:

  • Origin exposure: If an attacker discovers your server's IP address, they can bypass Cloudflare entirely and attack the origin directly. Tunnel eliminates this by removing the public IP entirely.
  • Firewall complexity: Managing inbound firewall rules across multiple servers, clouds, and environments is error-prone. One misconfigured rule can expose internal services. Tunnel requires zero inbound rules.
  • VPN dependency: For internal applications, organizations historically rely on VPNs to give employees access. VPNs are slow, over-permissive, and a top attack target. Tunnel provides per-application access without a VPN when paired with Cloudflare Access.
  • Multi-cloud connectivity: Organizations running workloads across AWS, GCP, Azure, and on-prem need a consistent way to connect everything. Tunnel works the same everywhere cloudflared can run.

How does it work?

  1. You install cloudflared on your server, VM, or Kubernetes cluster. It's a single binary — lightweight and easy to deploy.
  2. cloudflared creates outbound-only connections to Cloudflare's nearest data centers over port 7844 (TCP/UDP) using HTTP/2 or QUIC, encrypted with post-quantum cryptography.
  3. You configure routes that map public hostnames (like app.example.com) or private network CIDRs to local services (like localhost:8080).
  4. When a request arrives at Cloudflare for that hostname, Cloudflare routes it through the tunnel to your origin. All of Cloudflare's security products (WAF, DDoS, Bot Management) are applied automatically.

Tunnel supports two primary use cases:

  • Public applications: Expose web apps, APIs, and services to the internet through Cloudflare without a public IP. CDN caching, WAF, and DDoS protection apply automatically.
  • Private networking (Zero Trust): Connect internal apps, SSH servers, RDP desktops, and entire private networks to Cloudflare. Users access them through Access policies and the WARP client — no VPN needed.

Why it matters strategically

Tunnel is the connective tissue of Cloudflare's Zero Trust architecture. Without Tunnel, customers still need public IPs and firewall rules — meaning Cloudflare is just a layer on top. With Tunnel, Cloudflare becomes the only way to reach the application, making the customer's entire security posture dependent on Cloudflare's network. It's also the on-ramp for private networking: once a customer connects their infrastructure via Tunnel, adding Access, Gateway, and the rest of the SASE stack is a natural next step.

Learn more

← Cloudflare Gateway Magic Transit →