How to Expose Your Home Server with Cloudflare Tunnel

Introduction

By following this guide you will have a publicly reachable URL that forwards traffic to a service running on your home server without opening any inbound ports on your router. Cloudflare Access will protect that URL so only authorized identities can reach sensitive admin panels such as Grafana, Portainer or Home Assistant. The cloudflared tunnel will run as a persistent systemd service, automatically reconnecting if your ISP changes your public IP. You will also learn how to verify the setup, troubleshoot the most common issues, and optionally add HTTP‑to‑HTTPS redirects or expose additional services via sub‑domains. Expect to spend roughly 30‑45 minutes on the process, depending on how familiar you are with Linux and the Cloudflare dashboard.

More Tutorials & Self-Hosting guides on TechPulseMind →

Prerequisites

Step‑by‑step procedure

1. First, install the cloudflared binary. Cloudflare provides a tarball for each architecture that always points to the latest release, so you do not need to hard‑code a version number. Determine your machine’s architecture with uname -m; the output will be something like x86_64 or aarch64. Use that to build the download URL.

   ARCH=$(uname -m)
   if [ "$ARCH" = "x86_64" ]; then
       URL="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.tgz"
   elif [ "$ARCH" = "aarch64" ]; then
       URL="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.tgz"
   else
       echo "Unsupported architecture: $ARCH"
       exit 1
   fi
   curl -L "$URL" -o cloudflared.tgz
   tar -xzf cloudflared.tgz
   sudo cp cloudflared /usr/local/bin/
   sudo chmod +x /usr/local/bin/cloudflared
   rm cloudflared.tgz cloudflared
   

   This sequence detects the architecture, downloads the appropriate tarball, extracts it, copies the binary to /usr/local/bin and makes it executable. The temporary files are cleaned up at the end.

2. Next, authenticate cloudflared with your Cloudflare account. This step creates a certificate file that allows the client to act on your behalf. Running the command will open a browser window; you must log in to Cloudflare and select the account that owns the DNS zone.

   sudo cloudflared tunnel login
   

   After a successful login you will see a message indicating that a certificate was saved to ~/.cloudflared/cert.pem. Keep this file safe; it is required for all subsequent tunnel operations.

3. Create a named tunnel. The name is purely for your convenience; the underlying identifier is a UUID that Cloudflare generates. Run the command below, replacing with a descriptive label such as home‑server.

   sudo cloudflared tunnel create 
   

   The output will display a UUID (the Tunnel ID) and confirm that a credentials file has been written to ~/.cloudflared/.json. Make a note of the UUID; you will need it in the configuration file.

4. Now create a configuration file that tells cloudflared how to forward traffic to your local service. The file uses YAML syntax; indentation matters. Open your preferred editor and create ~/.cloudflared/config.yml with the following contents, substituting the placeholders with your own values.

   tunnel: 
   credentials-file: /home//.cloudflared/.json
   
   ingress:
     - hostname: .
       service: http://localhost:
     - service: http_status:404
   

   Explanation: the tunnel line ties the config to the UUID you saved earlier. The credentials-file points to the JSON file created in step 3. The ingresslocalhost:. The final rule returns a 404 for any hostname that does not match a specific rule, preventing accidental exposure of other services.

5. Test the tunnel manually before installing it as a service. This helps you catch configuration errors early. Run the tunnel in the foreground; you should see log lines indicating a successful connection to Cloudflare’s edge.

   sudo cloudflared tunnel run 
   

   Leave this command running in a separate terminal or background session while you proceed to the next step. If you see errors, double‑check the UUID, the credentials file path, and the ingress

6. Bind the tunnel to a DNS record. This creates a CNAME record that points your chosen subdomain to a Cloudflare‑generated address (*.cfargotunnel.com). Traffic to that hostname will be proxied through the tunnel.

   sudo cloudflared tunnel route dns  .
   

   After the command finishes, log in to the Cloudflare dashboard, navigate to DNS for your zone, and verify that a CNAME record exists for . pointing to something like .cfargotunnel.com.

7. Confirm that the service is reachable over HTTPS. Cloudflare automatically provisions a certificate for the hostname at its edge, so you do not need to manage TLS on the home server. Open a browser and visit https://.. You should see your application load with a padlock icon indicating a valid Cloudflare certificate.

8. Install cloudflared as a persistent systemd service so the tunnel starts automatically on boot and restarts if it fails. First, copy the sample service unit file to the systemd directory.

   sudo cp /usr/local/bin/cloudflared /etc/systemd/system/cloudflared.service
   

   Now edit the file to contain the correct execution line. Replace with the name you chose in step 3.

   [Unit]
   Description=Cloudflare Tunnel
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   Type=simple
   User=root
   ExecStart=/usr/local/bin/cloudflared tunnel run 
   Restart=on-failure
   RestartSec=5
   
   [Install]
   WantedBy=multi-user.target
   

   Explanation: the unit waits for the network to be online, runs cloudflared as root (so it can read the credentials file in /root/.cloudflared if you prefer, or adjust the User line to match the account that owns the credentials), and restarts the process on failure after a five‑second delay.

9. Reload the systemd manager configuration, enable the service to start at boot, and start it immediately.

   sudo systemctl daemon-reload
   sudo systemctl enable --now cloudflared.service
   

10. Verify that the service is active and healthy.

    sudo systemctl status cloudflared.service
    

    You should see active (running). For a live view of logs, run:

    sudo journalctl -u cloudflared.service -f
    

    Look for lines that say “Connection established” and “healthy”. If you see repeated restarts, check the journal for error messages and revisit the configuration file.

11. Set up Cloudflare Access to protect the exposed hostname. In the Zero Trust dashboard:

    1. Navigate to **Access → Applications**.
    2. Click **Add an application**, choose **Self‑hosted**, and enter the same hostname you used in step 6 (.).
    3. Under **Access Policies**, create a new policy:
    • **Action:** Allow
    • **Include:** Select your Identity Provider (e.g., Google Workspace) or list specific email addresses.
    • Optional: add a requirement for a security key, IP range, or device posture.
    4. Create a second policy (or change the default) to **Block** everyone else.
    5. Save the application.

12. Test the Access enforcement. From a browser logged in with an authorized identity, visit https://.; you should reach the service. Then open an incognito window or log out of the IdP and try again; you should see a Cloudflare Access “Access denied” page.

13. (Optional) Redirect plain HTTP traffic to HTTPS. This ensures that anyone who accidentally types the HTTP version ends up on the secure page.

    1. In the Cloudflare dashboard go to **SSL/TLS → Edge Certificates** and enable **Automatic HTTPS Rewrites** (this will rewrite HTTP to HTTPS for all hostnames in the zone).
    2. Alternatively, create a Page Rule: http://./* → Forwarding URL → https://$1 with status 301.