Self-hosting hits a wall the moment you try to reach your home server from outside the house. Most South African connections sit behind CGNAT, where your router has no public address to forward ports to, and even when you do have one, opening ports invites the whole internet to knock. Cloudflare Tunnel sidesteps both problems by flipping the direction of traffic: your server dials out to Cloudflare, and visitors are routed back in through that connection, with no inbound ports open at all.

Quick Answer

Cloudflare Tunnel runs a small agent called cloudflared on your host. It makes an outbound connection to Cloudflare's edge and publishes your local service at a public hostname like app.example.com. No port forwarding, no exposed IP, and it works behind CGNAT or a strict firewall. The core service is free.

Why this beats port forwarding

A traditional setup waits for inbound traffic: you open a port on the router and forward it to your server's local address. That fails completely behind CGNAT because your router shares a public IP with other customers and has nothing to forward. It is also a security exposure, since an open port is permanently reachable and scannable.

Cloudflare Tunnel reverses this. The cloudflared daemon on your machine makes an outbound, persistent connection to Cloudflare. When someone visits your hostname, Cloudflare routes the request back down that existing tunnel to your local service. Because the connection starts from inside your network, CGNAT and firewalls that block inbound traffic are no obstacle, and you never open a single port.

What you need before you start

This guide assumes you have three things: a domain managed through Cloudflare (its nameservers pointing at Cloudflare), a service already running locally such as a web app on localhost:8080, and a host that can run cloudflared, which covers Linux, a Raspberry Pi, a mini PC or a Docker container.

A low-power mini PC suits this kind of always-on service well -- it can sit quietly running cloudflared alongside your other apps with minimal fuss. Browse Evetech's mini PC selection for efficient, compact hardware that keeps your home lab running without pushing up the electricity bill.

Step-by-step setup

  1. Install cloudflared. Grab the package for your operating system and install it on the host running your service.
  2. Authenticate. Run cloudflared tunnel login. This opens a browser, you pick your domain, and it authorises the agent for that zone, saving a certificate locally.
  3. Create a named tunnel. Run cloudflared tunnel create my-tunnel. This generates a tunnel UUID and a credentials file you will reference next.
  4. Write the config file. Create config.yml mapping your hostname to the local service. It names the tunnel UUID, the path to the credentials file, and an ingress rule like a hostname of app.example.com pointing at service http://localhost:8080.
  5. Add the DNS record. Run cloudflared tunnel route dns my-tunnel app.example.com. This creates the CNAME that points your hostname at the tunnel automatically.
  6. Run it as a service. Install cloudflared as a systemd unit (cloudflared service install) so the tunnel starts on boot and survives reboots, rather than dying when you close the terminal.

Once the service is running, visit app.example.com and Cloudflare carries the request down the tunnel to your local app, served over HTTPS with no port forwarding anywhere in the chain.

Hardening and good habits

Two additions are worth making early. First, put the hostname behind Cloudflare Access if it is anything private, so a login is required before the tunnel even passes traffic through. Second, keep cloudflared updated, since it is your edge agent and you want current security fixes.

For a setup you intend to keep running, reliability of the host matters as much as the software. A machine with a decent SSD and enough memory keeps your services responsive, and the Evetech PC best sellers are worth checking when deciding what to run as a permanent home server.

Frequently Asked Questions

Does Cloudflare Tunnel work behind CGNAT?

Yes, that is one of its main strengths. Because the cloudflared agent makes an outbound connection to Cloudflare, it does not need a public IP or any inbound port, so CGNAT is no obstacle.

Is Cloudflare Tunnel free?

The core tunnel service is free for personal and small projects. You need a domain on a Cloudflare plan, and the free tier covers the tunnel itself without charge.

Do I need to open any ports on my router?

No. The whole point is that no inbound ports are opened. The connection is established outbound from your host to Cloudflare, which removes the security exposure of port forwarding entirely.

How is this different from a service like ngrok?

Both expose local services without port forwarding, but Cloudflare Tunnel ties into your own domain, runs as a persistent service for permanent hosting, and integrates with Cloudflare Access for authentication, which suits long-running self-hosted apps better than a temporary tunnel.

What can I host this way?

Almost any local service: a web app, a dashboard, a media server, a Git server, or SSH. As long as it listens on a local address, cloudflared can publish it at a public hostname.

Building a home lab worth reaching from anywhere? Browse the compact, always-on machines in the mini PC range at Evetech and set up a server ready for Cloudflare Tunnel.