Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use Cloudflare Tunnel to publish a Coolify application without forwarding ports or exposing the server’s public IP. The reliable setup is: run a cloudflared connector where Coolify is running, create a Cloudflare tunnel, point a published hostname at the correct Coolify-reachable service URL, and add the hostname to DNS. For several applications, route the tunnel to Coolify’s proxy (the all-resources pattern). For one application, route it directly to that application’s host-mapped port.
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
This guide covers both designs, the exact dashboard workflow, port mapping, DNS, TLS choices, ingress rules, and fixes for common 404, 502, certificate, and connection failures.
As an Amazon Associate I earn from qualifying purchases.
What a Cloudflare Tunnel changes in a Coolify deployment
Normally, a public request reaches a server through an exposed IP address and a router or firewall port-forwarding rule. A tunnel reverses that direction. A connector running beside Coolify makes an outbound connection to Cloudflare; Cloudflare then sends requests for your hostname through that connection to the local service.
The result is useful for a home server, a Raspberry Pi server, or a VM behind a restrictive router. You can publish an application without opening an inbound router port and without giving visitors the origin IP. The tunnel does not remove the need to secure Coolify, the application, or its credentials; it changes how traffic enters the network.
#1 Best Overall
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Cloudflare’s connector is called cloudflared. It must be running on the server or in a Coolify-managed resource that can reach the intended service. Cloudflare-managed DNS and a domain using Cloudflare are part of the normal published-application workflow.
Choose the tunnel scope before changing settings
Coolify’s two practical patterns differ in what the tunnel reaches. Pick one before creating routes, because the service URL and domain cleanup are different.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Pattern | Best for | Cloudflare service URL should reach | Coolify changes |
|---|---|---|---|
| All resources | Several applications or a beginner setup | Coolify’s proxy, which then selects the application by hostname | Deploy cloudflared in Coolify and route the tunnel to the proxy |
| Single resource | One application with an isolated public hostname | The application’s host-mapped port | Remove the application’s existing public domains and configure its exposed and mapped ports |
Why the all-resources pattern is usually simpler
Coolify’s proxy already understands the hostnames assigned to deployed resources. A tunnel that terminates at that proxy can serve multiple applications without creating a separate connector route for every container. This is the recommended starting point when you are learning the workflow or expect to publish more than one service.
When a single-resource route is preferable
Use a direct application route when only one service should be reachable through the tunnel, or when you deliberately want to bypass the proxy’s multi-application routing. The tunnel must still reach a port that is published on the host. A container-only port is not enough.
Prerequisites and checks
Complete these checks before creating the route:
- A Cloudflare account.
- A domain whose DNS is managed by Cloudflare.
- A running Coolify installation and a deployed target resource.
- A server or VM with internet access where
cloudflaredcan run. Coolify specifically describes local servers such as Raspberry Pis as suitable hosts. - Permission to create a tunnel, DNS record, and published hostname in the Cloudflare dashboard.
- Outbound firewall access for the connector. If egress is restricted, allow Cloudflare’s tunnel traffic on TCP or UDP port
7844as required by your connector configuration.
Do not put the tunnel token in a public repository, screenshot, issue, or article. Treat it like a password: store it as a protected environment variable and rotate it if it is exposed.
Prepare Coolify and identify the reachable port
For an all-resources tunnel
- Sign in to Coolify and verify that the proxy is running.
- Confirm each application you intend to publish is deployed and has a hostname configured in Coolify.
- Plan to run
cloudflaredas a Coolify resource on the same server or on a network path that can reach Coolify’s proxy.
The Cloudflare route will point to the proxy, not to an arbitrary container address. Use the address and port that the connector can resolve and reach from its own runtime.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
For a single-resource tunnel
- Open the target application in Coolify and remove its existing public domains if they would conflict with the new hostname.
- Check the application’s exposed container port and the port mapped on the host.
- Deploy or redeploy the application so the host mapping is active.
- Use the mapped host port in Cloudflare’s Service URL.
Coolify’s documentation uses http://localhost:4477 as an example for a mapped host port. Port 4477 is illustrative, not a universal requirement. Replace it with the port actually mapped on your server. The container’s internal listening port and the host-mapped port can be different.
Create the Cloudflare tunnel
- Open the Cloudflare dashboard and go to Networking > Tunnels.
- Select Create Tunnel.
- Give the tunnel a descriptive name, such as the server or environment it serves.
- Select the operating system and architecture on which
cloudflaredwill run. - Cloudflare will display a connector command and token. Copy the generated token into a secure password manager or deployment secret store.
The token identifies this connector to Cloudflare. It is not a hostname, DNS value, or application password. Never substitute the domain name for the token, and do not publish the token in a Compose file committed to source control.
Run cloudflared with Coolify
Deploying it as a Coolify resource
- Create the Cloudflared resource in Coolify using the deployment method appropriate for your server.
- Add the tunnel token as the resource’s environment variable, using the variable name requested by the Cloudflare-generated command or Coolify’s Cloudflared resource template.
- Deploy the resource and wait for its logs to show a connected or healthy state.
- In Cloudflare’s tunnel page, confirm the connector is online before adding application routes.
Keep the connector on a network that can reach the selected Service URL. A connector in one isolated container network may not be able to reach localhost in another container; in that case, use a reachable host address or network alias that matches your deployment layout.
Installing cloudflared directly on the server
You can install cloudflared on the host instead of deploying it through Coolify. Follow Cloudflare’s generated installation command for the selected operating system and run it with the tunnel token. The same reachability rule applies: the process must be able to connect to the proxy or host-mapped application port you specify later.
Recommended Free Tools
Add a published hostname route
- Open the tunnel in Cloudflare and go to its Routes area.
- Choose Add a published application route (the wording may appear as a published application route in the dashboard).
- Choose the subdomain and the Cloudflare-managed domain that visitors will use, such as
app.example.com. - Enter the Service URL that the connector can actually reach.
- Save the route and repeat only for additional hostnames you intentionally want to publish.
Service URL for all resources
Point the route to Coolify’s proxy endpoint. The exact address depends on how Coolify and the connector are deployed; use the proxy address visible and reachable from the cloudflared runtime. The proxy then uses the request hostname to select the matching Coolify application.
Service URL for one resource
Point the route to the application’s host-mapped port, for example http://localhost:4477 when the connector runs on the same host and that port is the real mapping. If the connector runs in a separate container, localhost refers to that connector container, not necessarily the host; choose a host address or network name that reaches the mapping instead.
Rank #3
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
Use http:// when the basic pattern terminates HTTPS at Cloudflare and sends HTTP across the tunnel. Do not add https:// merely because visitors use HTTPS; the origin protocol is a separate setting.
Configure DNS for the tunnel hostname
After adding the published route, create or confirm the DNS record for the hostname in the same Cloudflare zone. The record should be proxied and target the tunnel address Cloudflare provides, using the documented cfargotunnel.com destination format. Cloudflare’s dashboard may create this record as part of the route wizard; verify it rather than creating a second, conflicting record.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Use the exact hostname selected in the tunnel route.
- Keep the record proxied so requests enter through Cloudflare.
- Remove an old A or CNAME record for the same name if it points to the former origin and would override the tunnel.
- Allow DNS changes time to propagate before diagnosing an application error.
Do not point a public DNS record directly at the server’s public IP when the objective is to keep that origin address undisclosed.
Ingress rules: put the catch-all last
If you manage the tunnel configuration locally rather than entirely in the dashboard, define an ingress rule for each hostname and finish with a catch-all rule. Cloudflare explicitly requires a final catch-all so an unmatched hostname does not fall through to an unintended service.
ingress:
- hostname: app.example.com
service: http://localhost:4477
- service: http_status:404Replace the hostname and port with your values. The http_status:404 rule is intentionally last. Putting it earlier prevents later application rules from ever matching. If you publish several applications, add each specific hostname before the catch-all.
Choose the TLS arrangement deliberately
Cloudflare edge HTTPS with HTTP to Coolify
The basic Coolify pattern uses HTTPS between the visitor and Cloudflare, while the tunnel forwards HTTP to the Coolify proxy or application. This is often the least complicated configuration for an internal origin because the public certificate is handled at the edge.
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Full TLS to the origin
Use origin HTTPS when the application requires encrypted traffic all the way to the service, or when its cookies, login flow, webhook validation, or protocol settings require an HTTPS origin. Follow Coolify’s full-TLS configuration and ensure the certificate name matches the hostname configured at the origin. A zone SSL mode change by itself does not fix a certificate-name mismatch.
Decide the origin protocol before writing the Service URL. An HTTPS URL pointed at a service that only speaks HTTP produces a TLS or handshake failure; an HTTP URL pointed at a service that requires TLS produces a connection or protocol error.
Test the published hostname in a controlled order
- In Cloudflare, verify that the tunnel connector is healthy or connected.
- Confirm the published route shows the intended hostname and Service URL.
- Check the DNS record for the hostname and verify that it is proxied and targets the tunnel address.
- Open the hostname in a private browser window to avoid cached redirects or authentication state.
- Check the Cloudflared logs for connection and origin errors.
- Check Coolify’s proxy and application logs at the same time.
- If the page fails, test the Service URL from the connector’s network context, not only from your laptop. A URL that works on the host may fail inside the connector container.
This order separates Cloudflare control-plane problems from DNS, connector reachability, port mapping, and application responses.
Troubleshoot by the symptom
404 Not Found
- Compare the browser hostname character-for-character with the hostname in the tunnel route or ingress rule.
- If using local ingress configuration, confirm the catch-all rule is present and is the final rule.
- For an all-resources design, verify that the request reaches Coolify’s proxy and that the same hostname is assigned to a deployed application there.
- Check that an older DNS record or another tunnel is not receiving the request.
502, connection refused, or an origin-unreachable message
- Check the Service URL’s port first.
- Use the host-mapped port, not only the container’s internal port. Coolify’s single-resource example uses
http://localhost:4477to illustrate this distinction. - Confirm the application is deployed and listening on the mapped port.
- If Cloudflared is containerized, replace an inappropriate
localhostwith a host address or network alias reachable from that container. - Verify that the origin protocol in the URL matches the service: HTTP for an HTTP listener, HTTPS for a correctly configured TLS listener.
TLS or certificate-name mismatch
- Determine whether the failure is between the visitor and Cloudflare or between Cloudflare and the origin.
- For origin HTTPS, confirm that the certificate covers the hostname Cloudflare uses to connect and that Coolify’s origin TLS settings use the same name.
- Do not expect changing only the zone’s SSL mode to repair an origin certificate whose name does not match.
The tunnel will not connect
- Check that the complete token was copied, with no missing characters or shell quoting errors.
- Confirm the token is stored in the running Cloudflared resource, not only in a stopped or un-deployed configuration.
- Check outbound firewall and egress policy for port
7844. - Review Cloudflared logs for authentication, DNS, or network errors.
SSH or another non-HTTP protocol does not work
Published application routes are intended for HTTP-style traffic. SSH and other TCP protocols require cloudflared on the server side and a Cloudflared client on the user’s device. Installing the connector only on the Coolify server does not make a normal SSH client understand the tunnel.
Operational and security practices
Limit the published surface
Create routes only for hostnames that need to be public. An all-resources tunnel can make adding another Coolify hostname easy, but each new DNS record is still a new public entry point. Keep administrative panels, databases, and internal dashboards private unless there is a specific access-control design for them.
Keep the token and logs private
Use Coolify’s secret or environment-variable mechanism for the token. Restrict access to deployment logs because startup output can reveal hostnames, internal ports, and configuration details. Rotate the token after accidental disclosure.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Separate edge encryption from origin policy
Document whether each route uses HTTP or HTTPS between Cloudflare and Coolify. This avoids later confusion when an application begins enforcing secure cookies or redirects based on its perceived scheme.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Monitor both sides
A green tunnel status proves that the connector can reach Cloudflare; it does not prove that the selected origin port, hostname, or application is healthy. Keep Cloudflared, Coolify proxy, and application logs available during deployments and DNS changes.
Reference architecture examples
Several apps on one Raspberry Pi server
Run Coolify and Cloudflared on the Raspberry Pi, create one tunnel, and route it to Coolify’s proxy. Add a separate published hostname for each deployed application, with Coolify’s proxy selecting the app by hostname. This avoids exposing individual container ports and keeps routing in one place.
One app on a home server
Remove the app’s old public domains in Coolify, map its container listening port to a host port, and deploy. Create one published route to that host-mapped port. If the connector and app share the host network, a URL such as http://localhost:4477 can work when 4477 is the actual mapping; otherwise use a reachable network address.
Origin-required HTTPS
Keep the same tunnel and DNS structure, but configure the application and Coolify origin with a matching certificate and use an HTTPS Service URL. Validate the certificate hostname from the connector’s network path rather than relying only on the browser’s edge certificate.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Decision checklist
- Multiple Coolify applications: choose the all-resources pattern and route to the Coolify proxy.
- One isolated application: choose the single-resource pattern and route to its host-mapped port.
- Visitors need HTTPS only: edge HTTPS with HTTP to the origin is the basic pattern.
- The application requires origin HTTPS: configure full TLS and a matching origin certificate.
- You see 404: check hostname matching and the final catch-all rule.
- You see 502 or refusal: check host mapping, connector network reachability, and the HTTP/HTTPS choice.
- The connector is offline: check the complete token and outbound port
7844. - You need SSH or raw TCP: plan for a Cloudflared client on the connecting device as well as the server connector.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
