If you want to access something on your home server — Jellyfin, Immich, a Home Assistant dashboard — from outside your house, the traditional approach is port forwarding on your router. That works, but it also means opening a direct hole through your firewall straight to a device on your network, which is exactly the kind of thing security-conscious people try to avoid. Cloudflare Tunnel solves this by letting you publish a service to the internet without opening a single port. This guide explains what it is, how it works, and when it makes sense to use.
What Is Cloudflare Tunnel?
Cloudflare Tunnel (formerly known as Argo Tunnel) is a free service from Cloudflare that creates a secure, outbound-only connection between a small piece of software on your server (called `cloudflared`) and Cloudflare’s network. Once that connection exists, Cloudflare can route traffic from a public domain name straight through to your service, without your router needing any inbound ports open at all.
The key difference from traditional port forwarding is the direction of the connection. With port forwarding, your router accepts incoming connections from anyone on the internet who reaches that port. With Cloudflare Tunnel, the connection is always initiated from inside your network out to Cloudflare — nothing on the internet can connect directly to your server, because there is no open port for it to connect to.
How Cloudflare Tunnel Works
- You install the lightweight `cloudflared` daemon on your server, NAS, or a small container alongside your other self-hosted services
- It authenticates with your Cloudflare account and establishes an outbound, encrypted connection to Cloudflare’s edge network
- You configure which internal service (for example, Jellyfin running on port 8096) should be reachable through which public hostname (for example, jellyfin.yourdomain.com)
- When someone visits that hostname, Cloudflare routes the request through the existing tunnel connection to your server, and the response travels back the same way
- Your router’s firewall never needs an inbound rule for this to work
Why Use Cloudflare Tunnel Instead of Port Forwarding?
- No open ports: There is nothing for an attacker to scan for or connect to directly on your router.
- Hides your home IP address: Traffic is routed through Cloudflare, so your public IP is never exposed to visitors of the service.
- Built-in DDoS protection: Since traffic passes through Cloudflare’s network, it benefits from the same protections Cloudflare provides to its other customers.
- Works behind CGNAT: If your ISP does not give you a real public IP address (common with many mobile and some broadband providers), port forwarding often will not work at all — Cloudflare Tunnel does not need one, since the connection is outbound.
- Free: The core tunnel service has no cost for personal or small business use.
Cloudflare Tunnel vs Tailscale: Which Should You Use?
Both avoid port forwarding, but they solve slightly different problems. Tailscale creates a private mesh network between your own devices — ideal when only you (and people you trust) need access, such as remotely managing a Proxmox server or accessing Immich from your phone while travelling. Cloudflare Tunnel is built for publishing something to the public internet under a real domain name, such as sharing a Jellyfin library with family members who are not on your Tailscale network, or running a public-facing website from home hardware.
Many home lab setups use both together: Tailscale for private access to admin dashboards and management tools, and Cloudflare Tunnel for anything that needs a proper public URL.
What You Need to Set Up Cloudflare Tunnel
- A free Cloudflare account
- A domain name added to Cloudflare (Cloudflare’s free plan covers this comfortably)
- The `cloudflared` daemon installed on the server hosting your service, either directly or as a Docker container
- Optionally, Cloudflare Access configured in front of the tunnel, to add a login prompt or restrict access to specific email addresses before anyone can reach the service at all
Frequently Asked Questions
Is Cloudflare Tunnel free?
Yes, for personal and small business use, Cloudflare Tunnel itself has no charge. You do need a domain name added to a Cloudflare account, which can also be on Cloudflare’s free plan.
Does Cloudflare Tunnel slow down my connection?
There is a small amount of added latency since traffic routes through Cloudflare’s network rather than connecting directly, but for most home lab uses — streaming, dashboards, web apps — this is not noticeable in practice.
Can Cloudflare see my traffic?
Cloudflare’s network handles the encrypted connection routing, similar to how it works for any website using Cloudflare’s CDN. If this is a concern for particularly sensitive internal tools, a private mesh VPN like Tailscale, which does not route traffic through a third party’s public edge network in the same way, may be a better fit.
Do I need a static IP address to use Cloudflare Tunnel?
No — this is one of its biggest advantages. Because the connection is always initiated outbound from your server to Cloudflare, it works even if your ISP changes your IP address regularly or puts you behind CGNAT with no public IP at all.
