Cloudflare · Security · VPS Guide

Cloudflare Tunnel Guide 2026: Free Secure Tunnel on VPS — No Open Ports Required

By CloudPicked Review Team · Updated September 2026 · ~12 min read

What Is Cloudflare Tunnel?

Cloudflare Tunnel (formerly Argo Tunnel) is a Cloudflare service that lets you expose services running on your server — web apps, SSH servers, Remote Desktop — through Cloudflare's global network, without configuring inbound firewall rules or owning a public IP address.

At its core is a lightweight daemon called cloudflared that you install on your server. It creates outbound-only encrypted connections to Cloudflare data centers. Cloudflare then uses those connections to proxy traffic into your services. The result is bidirectional traffic flowing over a single outbound connection.

This makes Cloudflare Tunnel ideal for:

• Developers who need to expose a local development server
• Sysadmins who want SSH access without opening port 22
• Organizations implementing Zero Trust Network Access (ZTNA)
• Home or office setups behind NAT/CGNAT without a static IP
• VPS owners who want to hide their origin IP from DDoS attacks

Cloudflare Tunnel is part of Cloudflare Zero Trust (formerly Cloudflare for Teams) and is free for basic use — data as of September 2026, verify current terms at cloudflare.com.

How It Works

Cloudflare Tunnel operates through three main components:

1. The cloudflared Daemon

The cloudflared daemon installed on your server creates persistent outbound-only connections to Cloudflare's global network using Anycast routing — automatically connecting to the nearest data center. These connections are encrypted and require zero inbound firewall rules.

2. Tunnel UUID

Each tunnel has a unique UUID acting as a logical link between your origin server and Cloudflare. You can run multiple cloudflared processes (connectors) within a single tunnel for high availability.

3. Traffic Routing

When a request arrives at your domain (e.g., app.example.com), Cloudflare receives it, routes it through the tunnel to your cloudflared daemon, which forwards it to your local service (e.g., localhost:3000). The response travels the same path back.

Key Benefits

Prerequisites

Before you begin, ensure you have the following:

• A Cloudflare account (free registration at cloudflare.com)
• A domain added to Cloudflare with its nameservers pointing to Cloudflare
• A server or VPS running Linux (Ubuntu 20.04+ / Debian 10+ recommended), macOS, or Windows
• sudo or root access on the server
• A service to expose (e.g., Nginx/Apache on port 80, or any app on any port)

Install cloudflared on Linux (Ubuntu/Debian)

Cloudflare maintains an official package repository. Install with these commands:

Method 1: apt repository (recommended)

# Add Cloudflare GPG key
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg > /dev/null

# Add repository
echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list

# Update and install
sudo apt update && sudo apt install cloudflared -y

# Verify version
cloudflared --version

Method 2: Direct binary download

# For Linux x86_64
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

For RHEL/CentOS

sudo yum install cloudflared

Create a Tunnel Step by Step

Step 1: Authenticate with Cloudflare

cloudflared tunnel login

This opens a browser window prompting you to log in to your Cloudflare account and select the domain to use. Once complete, cloudflared saves credentials to ~/.cloudflared/cert.pem.

Step 2: Create a New Tunnel

cloudflared tunnel create my-tunnel

Replace my-tunnel with your preferred name. The output shows your Tunnel UUID (e.g., xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) and credentials file path. Note both values.

Step 3: Route DNS

cloudflared tunnel route dns my-tunnel app.example.com

This automatically creates a CNAME record in Cloudflare DNS, pointing app.example.com to the tunnel endpoint with Cloudflare proxy enabled (orange cloud).

Step 4: Create Config File

mkdir -p ~/.cloudflared
nano ~/.cloudflared/config.yml

Step 5: Run the Tunnel

cloudflared tunnel run my-tunnel

Step 6: Verify

cloudflared tunnel info my-tunnel

Configure config.yml

The ~/.cloudflared/config.yml file defines where cloudflared routes traffic.

Single web app (HTTP)

tunnel: <YOUR-TUNNEL-UUID>
credentials-file: /root/.cloudflared/<YOUR-TUNNEL-UUID>.json

ingress:
  - hostname: app.example.com
    service: http://localhost:3000
  - service: http_status:404

Multiple services

tunnel: <YOUR-TUNNEL-UUID>
credentials-file: /root/.cloudflared/<YOUR-TUNNEL-UUID>.json

ingress:
  - hostname: app.example.com
    service: http://localhost:3000
  - hostname: api.example.com
    service: http://localhost:8080
  - hostname: dashboard.example.com
    service: http://localhost:8443
    originRequest:
      noTLSVerify: true
  - service: http_status:404

Run as a systemd service (auto-start on boot)

# Install systemd service
sudo cloudflared service install

# Start and enable
sudo systemctl start cloudflared
sudo systemctl enable cloudflared

# Check status
sudo systemctl status cloudflared

Common Use Cases

1. Exposing a Web App or API

The most common use case: run any web server (Nginx, Apache, Node.js, Python Flask, etc.) on localhost, then let cloudflared expose it via your domain.

ingress:
  - hostname: myapp.example.com
    service: http://localhost:3000
  - service: http_status:404

2. SSH via Browser (No Port 22 Exposed)

Cloudflare Tunnel supports browser-based SSH access combined with Cloudflare Access — no need to open port 22 to the internet at all.

ingress:
  - hostname: ssh.example.com
    service: ssh://localhost:22
  - service: http_status:404

Users connect using: cloudflared access ssh --hostname ssh.example.com after authenticating through Cloudflare Access.

3. Remote Desktop (RDP)

ingress:
  - hostname: rdp.example.com
    service: rdp://localhost:3389
  - service: http_status:404

4. Private Network (Zero Trust)

For organizations requiring ZTNA, enable warp-routing so Cloudflare WARP clients can reach the private network:

tunnel: <UUID>
credentials-file: /root/.cloudflared/<UUID>.json
warp-routing:
  enabled: true

5. Quick Development Exposure

Developers needing a temporary public URL for webhooks or demos can use:

cloudflared tunnel --url http://localhost:3000

This generates a temporary public URL instantly without any config file required.

Cloudflare Tunnel vs. Traditional VPN

In summary: Cloudflare Tunnel is better for securely exposing specific services to the internet. Traditional VPNs are better for full network access between clients.

Limitations to Know

• Requires a Cloudflare domain — domains not using Cloudflare DNS cannot use Cloudflare Tunnel
• Cloudflare sees your traffic — appropriate for public services, but consider this for highly sensitive data
• WebSocket is supported but requires additional configuration
• UDP protocols (gaming, QUIC) are not supported in standard HTTP tunnels — use WARP routing instead
• Free plan bandwidth — Cloudflare doesn't specify a hard cap but applies fair-use policy; check current ToS at cloudflare.com
• cloudflared must stay running — if the process dies, the tunnel stops; use systemd for reliability

FAQ — Frequently Asked Questions