In this guide · 8 sections
Short answer
Install cloudflared on the machine running your app. It makes outbound-only connections to Cloudflare, so you can close the inbound port on your router or firewall. Add a Cloudflare Access policy so only named emails or your Microsoft or Google login can reach it. Access is free for up to 50 users.
Why an open port is the problem
A forwarded port, say 443 for a NAS or 3389 for remote desktop, means anyone on the internet can try to connect. Automated scanners find these within hours and try stolen passwords and known bugs. Our guide to checking which server ports are open shows how to see what you are exposing today.
Port forwarding
Common today- Inbound port open on the router
- Public IP address exposed
- App's own login is the only barrier
- Every bug in the app is reachable
Best for: Nothing you can avoid exposing.
Cloudflare Tunnel + Access
Recommended- No inbound ports; cloudflared connects out
- Origin IP not published
- Cloudflare checks identity before traffic reaches the app
- Login rules managed in one dashboard
Best for: Office apps, NAS web interfaces, internal dashboards.
How Cloudflare Tunnel works
Cloudflare's Tunnel documentation describes the flow: you install a lightweight daemon called cloudflared on your server or network, it creates outbound, encrypted connections to Cloudflare, and you map a public hostname such as app.example.com to a local service such as http://localhost:8080. Traffic then reaches your app through Cloudflare, with its CDN and security features applied.
- Outbound only: Cloudflare's Zero Trust tunnel page notes that most firewalls already allow outbound traffic, which is why no firewall opening is needed.
- Redundancy built in: each tunnel keeps four long-lived connections to two Cloudflare data centres, and you can run extra cloudflared replicas for more resilience.
- More than websites: Cloudflare lists HTTP, HTTPS, TCP, SSH and RDP among supported protocols.
- Tied to your account: Cloudflare's routing docs say the tunnel's cfargotunnel.com address only proxies DNS records in the same Cloudflare account.
- Plans: the Tunnel page says it is available on all Cloudflare plans.
Adding a login with Cloudflare Access
A tunnel on its own publishes the app to the internet without an open port, but anyone with the address can still reach the app's login page. Cloudflare Access adds a check in front, so people must prove who they are to Cloudflare first.
| Access setting | What it does | Small-office example |
|---|---|---|
| Allow policy | Lets matching users in | Emails ending in @yourcompany.com |
| Identity provider | How users prove who they are | Microsoft Entra ID, Google Workspace, or a one-time PIN sent by email |
| Session duration | How long before users must sign in again | 8 or 24 hours for office staff |
| Block or Bypass | Deny, or skip checks for specific traffic | Bypass only for a health-check path, if needed |
| Service Auth | Machine-to-machine access with tokens | A script that pulls reports overnight |
Cloudflare's Access policies documentation describes the Allow, Block, Bypass and Service Auth actions. The idea is the same as our zero trust explainer: check the person and device every time, instead of trusting anyone on the office network.
Setting up a tunnel, step by step
For a single internal web app, the dashboard route takes an hour or two including testing.
Put your domain on Cloudflare
The public hostname must be a DNS record in the same Cloudflare account. Our Cloudflare set-up guide covers moving a domain's DNS.
Create the tunnel
In the Cloudflare dashboard, create a tunnel and copy the install command for your server's operating system. Cloudflare says a first tunnel takes under 5 minutes.
Install cloudflared on the server
Run the command on the machine that can reach the app, such as the app server itself or a small always-on machine on the same network.
Add a public hostname
Map, for example, portal.yourcompany.com to http://localhost:8080. Cloudflare creates the DNS record pointing to the tunnel.
Protect it with Access
Create a self-hosted application in Cloudflare Zero Trust for that hostname, pick an identity provider and add an Allow policy for your staff.
Close the old port
Remove the port forward on the router or cloud firewall, then test from a phone on mobile data that the app only opens through the tunnel.
What Cloudflare Tunnel and Access cost
For most small offices the cost is zero, as long as you stay under 50 Access users.
- Cloudflare TunnelAvailable on all Cloudflare plansIncluded
- Zero Trust Free plan (Access)Up to 50 users; community supportUS$0
- Zero Trust Pay-as-you-goNo user limit; adds uptime SLA and chat or ticket supportUS$7/user/month
- Contract planFor full SASE deploymentsCustom annual price
Typical 15-person officeUS$0 a month
Source: Cloudflare Zero Trust plans page, approximate, as of October 2026. Prices exclude GST.
See the current figures on Cloudflare's Zero Trust plans page. The server, NAS or computer running cloudflared is your own cost.
Limits and things to plan for
A tunnel is simple, but it moves your dependency to Cloudflare and to the machine running cloudflared.
Before you rely on a tunnel
A tunnel hides the app; it doesn't fix it. If the app has a known vulnerability, an authorised user can still trigger it, so keep patching. Our VPS security hardening checklist covers the server side.
Do it yourself or get help?
If you have one web app on a machine you control and you are comfortable in the Cloudflare dashboard, the steps above are a realistic afternoon job. It gets harder with remote desktop or SSH access, several apps, a NAS that updates its own ports, or an app that misbehaves behind a proxy.
Our Software & Server Protection Setup (S$590) covers one server or web app: firewall with only the ports you need, Cloudflare in front with WAF and rate-limit rules, brute-force protection, automatic security updates, daily malware scans and a written runbook. If you need a small internal portal built to sit behind Access, our Custom Tool or Dashboard (from S$1,990) is scoped in writing with a fixed quote. Cloudflare fees, if any, are paid by you.
Frequently asked questions
Cloudflare's Tunnel documentation says it is available on all plans, including the free one. If you add Cloudflare Access to require a login, the Zero Trust Free plan covers up to 50 users at no cost as of October 2026; the pay-as-you-go plan is US$7 per user per month above that.
No. cloudflared makes outbound connections from your network to Cloudflare, and traffic flows back over those connections. Cloudflare says no inbound ports or firewall changes are required. Once the tunnel works, remove any old port forwarding rule so the app is no longer reachable directly.
For web apps, dashboards and NAS interfaces, often yes: Tunnel plus Access gives staff a login page instead of a VPN client. Cloudflare's Zero Trust tunnel documentation also covers private network access and remote desktop. Some legacy apps that need a full network connection may still need Cloudflare's client or a VPN.
The tunnel goes down and the app stops being reachable through Cloudflare. Each tunnel keeps four connections to two Cloudflare data centres, which protects against Cloudflare-side problems, but not against your own machine failing. Run cloudflared as a service, and add a second replica on another machine if the app matters.
For a public hostname, yes. Cloudflare's routing documentation says the tunnel address only proxies DNS records in the same Cloudflare account, so the hostname you publish must be a DNS record in your Cloudflare account. Moving a domain's DNS to Cloudflare's free plan is usually the first step.