Free tools Windows power users keep installed
One-click scans. No signup required.
Cloudflare Tunnel lets you publish a service running on your own server without forwarding an inbound port on your router. You install cloudflared on the server, create a tunnel in Cloudflare, and map a public hostname such as app.example.com to a local URL such as http://localhost:8000. Cloudflare describes this relationship simply: “The tunnel route maps a public hostname to a local service.”
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
You need a Cloudflare account, a domain managed by Cloudflare, and an Internet-connected server or virtual machine. A restrictive firewall may also need to permit the connector’s outbound traffic on port 7844. This guide covers the quickest dashboard setup, the more controllable command-line setup, multiple subdomains, persistent services, HTTPS origins, and the protocol-specific limits that matter for SSH, TCP, and RDP.
As an Amazon Associate I earn from qualifying purchases.
What a Cloudflare Tunnel actually does
A tunnel is a connection between your private server and Cloudflare’s network. The cloudflared connector runs on the same machine as your application, reaches out to Cloudflare, and keeps the tunnel available. Cloudflare then receives requests for the public hostname and sends them through that tunnel to the local service URL you configured.
The local service can be an HTTP or HTTPS application listening on the server itself, for example http://localhost:80, https://localhost:443, or an application on another local port such as http://localhost:8000. The public hostname and the local URL are separate: visitors use the hostname, while the connector uses the local address.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
This model is different from traditional port forwarding. You do not create a router rule that accepts unsolicited connections from the Internet. Instead, the server maintains the connector connection to Cloudflare. That is why the server still needs outbound Internet access even though you are not publishing an inbound port.
Cloudflare Tunnel is not the application itself. Your web server, dashboard, API, or other service must already be installed and running on the self-hosted machine. The tunnel supplies the public route to it.
Prerequisites and preflight checks
Cloudflare account and domain
Create or use a Cloudflare account and add the domain you intend to publish. For a locally managed tunnel, the domain’s nameservers must be delegated to Cloudflare so Cloudflare can create and manage the DNS route. The domain does not have to be the same name as the server’s local hostname.
An Internet-connected server or VM
Install the connector on the machine that can reach the application. It may be a physical home server, a machine in a data center, or a virtual machine. Keep the application running and note the exact local URL and port that work on that machine.
Outbound firewall access
Check the server’s egress policy before troubleshooting the tunnel itself. Cloudflare’s setup guidance identifies port 7844 as the port to check when a restrictive firewall blocks connector connectivity. You may need an outbound firewall exception even when all inbound ports remain closed.
Plan hostnames before creating routes
Decide which public hostname should reach each local service. A simple plan might look like this:
| Public hostname | Local service URL | Typical purpose |
|---|---|---|
app.example.com |
http://localhost:8000 |
Main application |
admin.example.com |
http://localhost:9000 |
Administrative interface |
secure.example.com |
https://localhost:443 |
Local HTTPS service |
These names are examples. Replace them with hostnames in your own Cloudflare-managed domain and with the ports your applications actually use.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Choose a management method
There are two supported ways to configure the route. The dashboard method is generally fastest for a first published application because Cloudflare supplies a guided form and a connector token. The locally managed method keeps the tunnel definition in a YAML file and gives you explicit command-line control over hostnames, ingress order, and credentials.
| Decision axis | Dashboard-managed published route | Locally managed tunnel |
|---|---|---|
| Initial setup | Guided Cloudflare UI and token-based connector installation | CLI commands, a credentials file, and YAML configuration |
| Where routes are edited | Cloudflare dashboard | Local config.yml |
| Several services | Add published-application routes in the dashboard | Add ordered hostname rules under ingress |
| How the connector runs | Install the token as a service or use the dashboard’s Docker option | Run the named tunnel and install the connector as a service or launch agent |
Use the dashboard path when you want one guided route with minimal local configuration. Use the locally managed path when the configuration belongs in deployment files, when one tunnel serves several hostnames, or when you want to review routing rules on the server.
Fastest setup: a published application in the dashboard
This workflow creates the tunnel and its public route through Cloudflare’s interface, then installs cloudflared on your server with a tunnel token.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Open the tunnel area. In the Cloudflare dashboard, go to Networking > Tunnels.
- Create the tunnel. Choose Create Tunnel, then give the tunnel a descriptive name. The name helps you identify it later; it is not necessarily the public hostname visitors will use.
- Add a published application. Add a Published application route. Select the hostname in your Cloudflare-managed domain and enter the local service URL. Examples include
http://localhost:80andhttps://localhost:443. For an application on another local port, enter its complete URL, such ashttp://localhost:8000. - Install the connector. Cloudflare presents an installation command containing the tunnel token. On a Linux server, run the service-install command with that token:
sudo cloudflared service install <TUNNEL_TOKEN>- Start or complete the service installation. Follow the platform-specific instructions shown for the server. Cloudflare documents service installation for Linux and Windows and a launch agent for macOS. The dashboard flow also provides a Docker command that runs the connector with the tunnel token.
- Open the hostname. Once the connector is running, visit the configured public hostname. Cloudflare routes the request to the local service URL you entered. If the application is not listening at that URL, the tunnel can be connected while the application still fails to respond.
Keep the token private. It authorizes the connector to connect to the tunnel, so place it only in the server installation command or the protected service configuration intended for that tunnel.
Locally managed setup with the CLI and YAML
The locally managed workflow creates a named tunnel, stores its credentials in a JSON file, and reads routing instructions from ~/.cloudflared/config.yml. The commands below use the names shown in the examples; substitute your own tunnel name, UUID, hostname, and local port.
1. Install cloudflared
Install cloudflared for the operating system running your server. Complete the installation before creating the tunnel, and make sure the executable is available to the account that will run it.
2. Create and identify the tunnel
Create a named tunnel:
cloudflared tunnel create my-tunnelThe command establishes the tunnel, generates a credentials file, and returns a tunnel UUID. List tunnels whenever you need to confirm the name or UUID:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
cloudflared tunnel listRecord the UUID returned by the create command. You will reference it in the configuration and in the credentials-file path.
3. Write the configuration file
Create ~/.cloudflared/config.yml. A single-service configuration can be as small as:
url: http://localhost:8000
tunnel: <TUNNEL-UUID>
credentials-file: /root/.cloudflared/<TUNNEL-UUID>.jsonReplace <TUNNEL-UUID> with the UUID printed by the create command. The url value is the local application endpoint. The tunnel value identifies the named tunnel, and credentials-file points to the JSON credentials generated for it. If you run the connector as a different user, use that user’s home directory rather than copying the example path unchanged.
4. Create the DNS route
Associate the public hostname with the tunnel:
cloudflared tunnel route dns my-tunnel app.example.comCloudflare documents that this command creates a CNAME pointing the hostname to the tunnel’s cfargotunnel.com subdomain. The DNS record is the public name visitors resolve; it does not expose the local port directly.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 115. Run the tunnel in the foreground
Start the named tunnel:
cloudflared tunnel run my-tunnelRunning it in the foreground is useful for the first verification because connection and origin errors appear in the process output. Keep the application running on localhost:8000 while you test https://app.example.com.
Route several local applications through one tunnel
One locally managed tunnel can serve several hostnames. Add an ingress list to config.yml, with one rule for each hostname and a catch-all rule last:
ingress:
- hostname: app.example.com
service: http://localhost:8000
- hostname: admin.example.com
service: http://localhost:9000
- service: http_status:404Why rule order matters
Ingress rules are evaluated in order. A request for app.example.com must match the first hostname rule before the catch-all rule. The final http_status:404 entry is required so unmatched hostnames receive an explicit response instead of falling through without a defined rule.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Validate a hostname before restarting production traffic
Ask cloudflared which rule matches a URL:
cloudflared tunnel ingress rule https://app.example.comRun the check after adding or reordering rules. It helps distinguish a routing mistake from an application that is unavailable on its local port.
Dashboard alternative for multiple services
If you use dashboard-managed routes, add additional published-application routes rather than editing a local ingress file. Each route pairs a hostname with its local service URL in the dashboard.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Using an HTTPS origin or a self-signed certificate
The local service URL must reflect the protocol spoken by the origin. If the application listens with TLS, configure an https:// service URL rather than an http:// URL. An HTTP URL pointed at an HTTPS listener, or the reverse, produces an origin connection error even when the tunnel and DNS are correct.
Cloudflare’s origin configuration guidance also covers self-signed certificates. When a private origin uses a self-signed certificate, the documented origin setting can disable TLS verification for that origin when appropriate. Treat that as an explicit origin choice: apply it only when you understand why the certificate cannot be validated and when the local service is the one you intend to reach.
Recommended Free Tools
Run cloudflared continuously
A foreground cloudflared tunnel run process ends when its shell session ends. For a persistent server, install the connector as a system service or platform launch agent.
Linux and Windows
Cloudflare documents service installation for both Linux and Windows. In the dashboard workflow, the token-based command is:
sudo cloudflared service install <TUNNEL_TOKEN>For a locally managed tunnel, install the service using the platform’s cloudflared service instructions so it starts the named tunnel with the intended configuration and credentials file.
macOS
On macOS, Cloudflare documents a launch agent rather than a Linux-style system service. Use the macOS launch-agent procedure and ensure the agent points to the same tunnel configuration you tested interactively.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Docker
The dashboard setup supplies a Docker command that runs the connector with the tunnel token. Use the command shown for the tunnel rather than substituting a token from another tunnel. The container still needs outbound access to Cloudflare and must be able to reach the local service URL from its own network context.
Inspect a running tunnel
For a named tunnel, query its status information with:
cloudflared tunnel info my-tunnelUse this check when the DNS record exists but the hostname is unavailable. It confirms that you are inspecting the same tunnel name you configured in the route.
Troubleshoot in the order the failure occurs
No connection from the connector
- Confirm the server can reach the Internet.
- Check whether an egress firewall blocks port 7844.
- Verify that the connector was installed with the correct token or is reading the intended credentials file.
- Use
cloudflared tunnel info my-tunnelfor a locally managed tunnel.
If the connector cannot establish its Cloudflare connection, changing an ingress rule will not fix the problem; restore outbound connectivity first.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The hostname reaches the wrong application
- Review the hostname spelling in the dashboard route or
config.yml. - For multiple services, check the order of the ingress entries.
- Ensure the final catch-all rule is last.
- Run
cloudflared tunnel ingress rule https://app.example.comto see which rule matches.
The DNS record does not point to the tunnel
Confirm that you ran cloudflared tunnel route dns for the intended tunnel and hostname. Inspect the hostname’s CNAME target and verify that it points to the tunnel’s cfargotunnel.com subdomain. A correct local application cannot be reached through a hostname routed to a different tunnel.
HTTPS origin errors
- Use
https://in the service URL when the origin expects TLS. - Check the origin certificate and TLS settings.
- If the origin uses a self-signed certificate, review Cloudflare’s documented option to disable TLS verification for that origin when that exception is appropriate.
The tunnel is connected but the application is unavailable
Check the local service independently on the server and confirm that it is listening on the port in the tunnel configuration. A connected tunnel only proves that the connector can reach Cloudflare; it does not start, repair, or reconfigure the application behind it.
SSH, TCP, and RDP are different from browser traffic
Ordinary browser access to an HTTP application uses the public hostname and the tunnel route. SSH, generic TCP, and RDP have an additional requirement: the client side must also use cloudflared. Installing the connector only on the server is not enough for those protocols.
Plan the client installation before publishing a non-HTTP service. Users who connect from an unmanaged computer or a device where they cannot install the client will not have the same experience as someone opening a browser-based application. The tunnel can still provide the route, but the client-side cloudflared requirement remains.
Operational checklist
- Cloudflare account is available.
- The domain is added to Cloudflare; for locally managed tunnels, its nameservers are delegated there.
- The self-hosted server or VM is online and the application is listening at the selected local URL.
- Outbound connectivity is available, including port 7844 when a restrictive firewall requires an exception.
- The tunnel was created through either the dashboard or
cloudflared tunnel create. - The public hostname is mapped to the intended tunnel.
- A single-service configuration has the correct
url; a multi-service configuration has orderedingressrules and a final catch-all. - HTTPS origins use an
https://service URL and the appropriate origin TLS settings. cloudflaredis installed as a persistent service, launch agent, or token-based Docker container.- SSH, TCP, or RDP users have
cloudflaredon their client devices.
Cloudflare’s setup documentation was updated September 30, 2026. It does not publish a benchmark, adoption statistic, reliability percentage, or performance figure for this setup; port 7844 is the operational number specifically identified in the setup guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
