Cloudflare Tunnel (Argo Tunnel)

Expose local/private services to the internet without opening ports — secure outbound-only tunnel.

CloudflareIntermediate

Why

Tunnel (cloudflared) creates outbound-only connections — no inbound ports, no public IP needed, NAT traversal automatic. Origin is hidden behind Cloudflare, DDoS-protected.

Free for all plans.

When

Use for homelab exposure, private API access, dev/staging without public IP, and replacing VPN for web apps. Avoid for non-HTTP protocols (use WireGuard/Tailscale).

How

1. Install — brew install cloudflared (or download binary) 2. Auth — cloudflared tunnel login (opens browser, select zone) 3. Create — cloudflared tunnel create my-tunnel (returns UUID + credentials file) 4. Config — ~/.cloudflared/config.yml: tunnel, credentials-file, ingress rules 5. Run — cloudflared tunnel run my-tunnel (outbound connection to CF edge) 6. Route — cloudflared tunnel route dns my-tunnel app.example.com 7. Service — install as systemd/launchd service for persistence

Example

# ~/.cloudflared/config.yml tunnel: a1b2c3-uuid credentials-file: /root/.cloudflared/a1b2c3-uuid.json ingress: - hostname: app.example.com service: http://localhost:3000 - hostname: api.example.com service: http://localhost:8080 originRequest: connectTimeout: 30s - service: http_status:404 # catch-all (required) # Run as service cloudflared service install systemctl start cloudflared # Quick tunnel (temporary URL, no config needed) cloudflared tunnel --url http://localhost:3000

Common Problems

⚠Tunnel disconnects on reboot — install as systemd service with restart policy
⚠config.yml catch-all required — missing http_status:404 at end causes error
⚠WebSocket needs no special config — but long-lived tunnels may hit idle timeouts

Best Practices

✓Run multiple cloudflared replicas — HA, load balances across edge connections
✓Use Tunnel with Access — add identity auth (SSO) before reaching origin service
✓Pin cloudflared version in CI — auto-updates can break config on major changes

FAQ

What is Cloudflare Tunnel (Argo Tunnel) and what problem does it solve?

Expose local/private services to the internet without opening ports — secure outbound-only tunnel. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Cloudflare Tunnel (Argo Tunnel) in 5 minutes?

Two steps to run it: (1) Install — brew install cloudflared (or download binary); (2) Auth — cloudflared tunnel login (opens browser, select zone). Validate on the free tier first, then wire into production.

What is the #1 pitfall with Cloudflare Tunnel (Argo Tunnel)?

The most frequent issue is: Tunnel disconnects on reboot — install as systemd service with restart policy. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Cloudflare Tunnel (Argo Tunnel)?

Best practices for Cloudflare Tunnel (Argo Tunnel) include: Run multiple cloudflared replicas — HA, load balances across edge connections; Use Tunnel with Access — add identity auth (SSO) before reaching origin service; Pin cloudflared version in CI — auto-updates can break config on major changes. The first one — "Run multiple cloudflared replicas — HA, load balances across edge connections" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Cloudflare Tunnel (Argo Tunnel)?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Cloudflare Tunnel (Argo Tunnel) options offer a free tier — validate within free quota before scaling.