Exposing Local Services with Cloudflare Tunnel

Published: 2024-02-28

Had a weird use case: wanted to expose my home lab services without opening ports on my router. Cloudflare Tunnel (formerly Argo Tunnel) was the answer.

Why Not Port Forwarding?

My ISP does CGNAT. No public IP. Even if they didn't, port forwarding feels like leaving a door open. Every security scan would eventually find it.

Setup

Downloaded cloudflared, ran one command:

cloudflared tunnel --url http://localhost:3000

Got a *.trycloudflare.com URL. Works immediately.

Making It Permanent

For long-term use, created a named tunnel, set up DNS, and registered it as a systemd service. Now it's always there, even after reboots.

Bonus: Zero-Trust

With Cloudflare Access, I can add authentication to any tunneled service. My internal dashboards are no longer exposed to the internet — but I can still access them from anywhere.