Skip Navigation

ELI5 Cloudflare Tunnel

So everyone is talking about cloudflare tunnels and I decided to give it a shot.

However, I find the learning curve quite hard and would really appreciate a short introduction into how they work and how do I set them up…

In my current infrastructure I am running a reverse proxy with SSL and Authentik, but nothing is exposed outside. I access my network via a VPN but would like to try out and consider CF. Might be easier for the family.

How does authentication work? Is it really a secure way to expose internal services?

Thanks!

54 comments
  • In effect, Cloudflare would give protection against DDoS attacks before requests would even hit your servers. That much said you can implement mitigations on the reverse proxy itself. One example would be fail2ban.

    I'm sure there are additional steps that you can take. I'm not a fan of Cloudflare because their free offering has some caveats and violating these could be problematic. I have a cloud VPS with a WireGuard tunnel back to my server. I don't have to do anything ugly like port forwarding. The cloud VPS runs NGINX as a reverse proxy. It's a relatively simple and effective setup.

    • Thanks! How do you handle that with internal DNS? I suppose you’d need to setup the exact same proxies on the internal and external server, and local DNS handles which one my domain it’s being resolved to?

      • Right now the internal DNS I use has a TLD of .lan but that's pretty much for my personal convenience. I access my websites by their FQDN internally with no issue. So I am not sure what your tring to achieve. Mind elaborating?

  • Essentially it IS a tunnel, just with cloudflare's infrastructure in the middle handling auth and obscuring each end from the other.

    Auth is handled by cloudflare. That doesn't mean cloudflare necessarily is the auth provider, though. Not likely in selfhosted, but one could set up some other auth provider, like azure, and cloudflare could give tunnel access to authorized users who actually provided credentials via azure.

    The service, port, whatever being accessed via the tunnel may also require auth, and cloudflare generally doesn't handle that. For example, your cloudflare tunnel to your local sonarr instance requires auth at cloudflare first, to access the tunnel, then again at sonarr because your sonarr instance requires authentication.

    In a docker environment, you would either tunnel to the docker host or to individual Dockers. The latter is more sensible and generally a bit more secure, if only because least access = better. There's probably some cloudflare tunnels docker out there that does half the setup for you, then you just stick it and the Dockers you want exposed through the tunnel all on the same docker network interface (which you create), but that's just speculation.

    As far as setting tunnels up goes, the docs are really good at the step by step. Easiest way to learn it is to set up a VM similar to what you want and bang away at the steps until it does what you want. Some things are easy, like RDP. Other things are trickier.

    The basics of setup are that you use the cloudflared application at both ends: one server-side to expose what you want and one client-side to access the tunnel via cloudflare.

    Tailscale is the same kinda thing. I think it is way easier for a lot of people. There's a lot less setup involved. Just install the apps and make a few choices.

    For personal use, I use wireguard to access my home server. Professionally I use cloudflare tunnels for a couple of things, but mostly an enterprise vpn.

  • Basically just an easier way to get a tunnel into your server, instead of having to configure a reverse proxy or manage certs. I just have the cloud flared docker installed, then on their site under the tunnels section I just assign whatever domains or subdomains to all my services via a local ip address. Im doing a couple things that definitely break TOS lol. But imma let it ride till they stop me then I guess I'll switch to a reverse proxy

  • Lol, decided to ask chatGPT this question, turned out pretty well:

    Alright, imagine you have a magic tunnel that can connect different places together. But this is not an ordinary tunnel that you can see or walk through. It's a special tunnel that works with the internet!

    You know when you want to visit a website on your tablet or computer, you type its address in a web browser, right? Well, sometimes websites need extra protection to stay safe from bad things on the internet. That's where Cloudflare Tunnel comes in!

    Cloudflare Tunnel is like a superhero that helps keep websites safe. It creates a secret passage between the website and Cloudflare's special servers. When people try to visit the website, their requests go through this secret tunnel first.

    Now, imagine there are some bad guys who want to do bad things to the website. They try to find the website, but all they see is the secret tunnel. They can't see the website or know where it is. It's like the website is hiding!

    But good people, like you and me, can still find the website because we know the secret. We can use the magic tunnel to reach the website and see what's there. Cloudflare Tunnel helps protect the website from the bad guys and lets the good people get through.

    So, Cloudflare Tunnel is like a special secret tunnel on the internet that keeps websites safe from bad guys and helps the good people find them.

54 comments