Back to Blog
team@tinypod.app

Cloudflare Tunnels for Self-Hosting: No Port Forwarding Needed

Cloudflare Tunnels expose your self-hosted apps to the internet without opening ports or configuring your router.

cloudflaretunnelsnetworkingsecurity

The Port Forwarding Problem


To self-host at home, you typically need to:

1. Configure your router to forward ports 80 and 443

2. Set up dynamic DNS (home IPs change)

3. Hope your ISP doesn't block ports or use CGNAT

4. Expose your home IP address to the world


Cloudflare Tunnels: The Solution


A Cloudflare Tunnel creates an outbound connection from your server to Cloudflare's network. Traffic flows:


User → Cloudflare → Tunnel → Your Server


Your server reaches out to Cloudflare (outbound). No inbound ports needed.


Benefits


No Port Forwarding

Works behind any NAT, CGNAT, or firewall. No router configuration.


Hidden IP

Your real IP address is never exposed. Cloudflare's IPs are what the world sees.


Free

Cloudflare Tunnels are free.


DDoS Protection

Traffic goes through Cloudflare's network. Built-in DDoS mitigation.


Automatic SSL

Cloudflare handles SSL certificates.


Setup


1. Create a Cloudflare account

2. Add your domain to Cloudflare

3. Install cloudflared on your server

4. Create a tunnel: cloudflared tunnel create my-tunnel

5. Configure routing:

tunnel: my-tunnel-id

ingress:

  • hostname: app.example.com

    • service: http://localhost:3000

  • service: http_status:404

    • 6. Start the tunnel: cloudflared tunnel run my-tunnel


    When to Use Tunnels


    Home Hosting

    Perfect for home servers where port forwarding is difficult or impossible.


    ISP Restrictions

    CGNAT (Carrier-Grade NAT) means you can't port forward. Tunnels bypass this.


    Security

    Minimize exposed ports. Only the tunnel agent connects outbound.


    When NOT to Use Tunnels


    VPS Hosting

    If your server has a public IP (like a TinyPod server), direct connections are simpler and faster. Tunnels add latency.


    High-Bandwidth Applications

    Video streaming, large file transfers — the tunnel adds overhead.


    Cloudflare Tunnels vs Tailscale


  • Tunnels: Expose to the public internet
  • Tailscale: Private access for your devices only
  • Use tunnels for public-facing apps, Tailscale for private access

    • For TinyPod VPS users: use Caddy with direct connections. For home servers: Cloudflare Tunnels solve the port forwarding problem elegantly.