Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes. A Netlify Function can call an HTTP service on a home server without router port forwarding by sending an outbound HTTPS request to a hostname published through Cloudflare Tunnel. The cloudflared connector, running on your home network, maintains outbound connections to Cloudflare and forwards matching requests to the local service. Your function calls the public hostname; it never connects directly to a private home IP address.
You still need a Cloudflare account, a domain managed by Cloudflare, an internet-connected machine running cloudflared, and an HTTP service that the connector can reach. Publishing a route makes the hostname potentially reachable from the internet, so authentication must be designed separately. Netlify runtime environment variables keep service credentials out of browser code and source configuration.
As an Amazon Associate I earn from qualifying purchases.
What does the Netlify-to-home-server architecture look like?
The request follows four distinct hops:
- The Netlify Function sends an HTTPS request to a Cloudflare-hosted public hostname, such as
api.example.com. - Cloudflare matches that hostname to a Tunnel application route.
- The
cloudflaredprocess running at home receives the routed request through its outbound tunnel connection. cloudflaredopens a connection to the configured local Service URL, such ashttp://localhost:8080, and returns the origin response to the function.
The public hostname and the local Service URL are not interchangeable. The function uses the hostname. The connector uses the local address and port. Cloudflare Tunnel initiates connections from the home network, so this path does not require an inbound firewall rule, router port-forwarding rule, or a publicly reachable home IP address.
Tunnel connectivity is only transport. It does not decide which callers may use your application. A published hostname can be reachable by anyone on the internet unless an application-level login, an access policy, or another control limits it.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What do I need before creating the tunnel?
Prepare these pieces before configuring a route:
- A Cloudflare account and domain: the domain must be managed by Cloudflare so the public hostname can be attached to the tunnel.
- An always-on connector host: this can be the home server itself or another internet-connected server or virtual machine on the same LAN. It must be able to reach the origin service over the local network.
- An HTTP origin: record the scheme, hostname or IP address, and port that work from the connector machine. For a service on the same machine, this might be
http://localhost:8080. For another LAN host, use that host’s real address and port. - Outbound firewall access: restrictive firewalls should permit the outbound connectivity required by
cloudflared; Cloudflare documents port7844for tunnel connections. Port443is also used for optional features such as update checks and Access JWT validation. - A Netlify site with Functions enabled: the function must be able to make outbound HTTPS requests to the public hostname.
Test the origin from the machine that will run cloudflared before troubleshooting Cloudflare. A successful response from another computer does not prove that the connector host can resolve the name, reach the port, or pass the origin’s TLS checks.
How do I publish the home service through Cloudflare Tunnel?
Create the tunnel, install and authenticate cloudflared on the connector host, then map a public hostname to the local Service URL. The exact dashboard labels can change, but the route always has the same two addresses: a public hostname and a local destination.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Create or select a tunnel
In Cloudflare’s tunnel management area, create a tunnel and install the connector command or package shown for the operating system of the home machine. Keep the connector process running as a service so it can reconnect after a reboot. The tunnel’s healthy state means the connector has established a connection to Cloudflare; it is not an application test.
2. Add an application route
Add a published application route for a hostname under your Cloudflare-managed domain. Choose a name that the Netlify Function will call, for example api.example.com, and set its Service URL to the origin address reachable by cloudflared:
| Origin location | Example Service URL | What to change |
|---|---|---|
Same machine as cloudflared |
http://localhost:8080 |
Use the port on which the local application listens. |
| Another device on the home LAN | http://192.0.2.1:80 |
Replace the documentation example with the device’s actual LAN address and port. |
| HTTPS origin | https://origin-host:8443 |
Make the origin certificate name and TLS verification settings agree with this address. |
The 192.0.2.1 value above is an illustrative documentation address, not a value to copy into a real deployment. Use the address that succeeds when tested locally from the connector host.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
3. Finish manual ingress rules correctly
If you configure ingress rules in a cloudflared configuration file instead of using the guided route, put the specific hostname rule before a final catch-all rule such as http_status:404. The catch-all prevents unmatched hostnames from being sent to an unintended service.
4. Verify the route from outside your home network
Request the public hostname from a network that is not your home LAN. A response from the origin confirms the complete path; a merely healthy tunnel confirms only the connector-to-Cloudflare portion. Do not replace the local Service URL with the public hostname. Cloudflare warns that the public name may resolve to the tunnel CNAME and is not the address the connector should use to reach the origin.
How should the Netlify Function call the tunnel hostname?
Call the public HTTPS hostname from the function, not the home server’s private address. Keep the hostname and any origin credential in Netlify environment variables with Functions scope so they are available when the function runs.
Example function request
The following example uses a generic bearer credential for an application that expects one. It is not a Cloudflare Access service-token configuration; use the authentication method your origin actually implements.
export default async (request) => {
const baseUrl = process.env.HOME_SERVICE_URL;
const token = process.env.HOME_SERVICE_TOKEN;
if (!baseUrl || !token) {
return new Response("Server configuration is incomplete", { status: 500 });
}
const upstream = await fetch(`${baseUrl}/health`, {
headers: {
"Authorization": `Bearer ${token}`,
"Accept": "application/json"
}
});
const text = await upstream.text();
return new Response(text, {
status: upstream.status,
headers: { "Content-Type": upstream.headers.get("content-type") || "text/plain" }
});
};Set HOME_SERVICE_URL to the public tunnel hostname, including its scheme, for example https://api.example.com. Do not put secrets in client-side JavaScript. Netlify specifically notes that values declared in netlify.toml are not available to Functions at runtime; define runtime variables in the site’s environment-variable settings and grant them the Functions scope where that option is available.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Handle failures without leaking credentials
Return a generic error to the browser or caller and log only the status, hostname, and a request identifier. Never include the bearer value, an Access token, or a full authorization header in logs. Add an explicit timeout or cancellation strategy appropriate to your function runtime; the materials for this setup do not establish a universal Netlify request-time limit.
How do I protect a hostname that is reachable from the internet?
Assume that a published application is public until an access policy or equivalent control says otherwise. Tunnel routing alone is not authentication.
Authenticate the origin application
Have the home service validate a credential such as a bearer token, signed request, or mutual-TLS identity. Store the secret only in Netlify’s runtime environment and on the origin. Use separate credentials for development and production, rotate them, and reject missing or malformed authorization headers.
Use Cloudflare Access when identity policy is appropriate
Cloudflare Access supports policies and non-interactive service tokens for machine-to-machine scenarios. A Netlify Function can be a machine client, but the exact token headers, policy selectors, and audience settings must match the current Access documentation and your chosen policy. The setup described here does not establish a tested, vendor-authored end-to-end recipe for presenting a Netlify Function’s token to Access, so verify that flow in a staging hostname before relying on it.
Do not assume that placing a token in a Netlify variable automatically configures Access. The variable only gives your code a secret; an Access policy must separately be configured to recognize the request, and the origin may still need its own authorization.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
What changes when the local service uses HTTPS?
An HTTPS origin adds certificate validation between cloudflared and the home service. The public hostname can use HTTPS while the local Service URL uses HTTP, or both legs can use HTTPS, but each leg has its own TLS settings.
For an HTTPS Service URL, the service URL’s hostname, the origin certificate’s name, and Cloudflare’s TLS verification configuration must agree. A certificate issued for one name will fail if the connector reaches the service by a different name unless the documented origin-server-name setting accounts for that difference. Disabling certificate verification is not a safe general fix; correct the name, trust chain, or certificate instead.
Why can a “Healthy” tunnel still return errors?
A healthy status proves that cloudflared connects to Cloudflare. It does not test the route’s service or the local origin. Troubleshoot from the connector outward, then test the public hostname.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Symptom | Likely cause | Check and remedy |
|---|---|---|
| Healthy tunnel, 502 or connection-refused response | The Service URL is wrong, the process is stopped, or the connector cannot reach the port. | From the connector host, request the exact scheme, host, and port in the Service URL. Correct the route or start the origin service. |
| Timeout before the origin responds | A local firewall, LAN route, or restrictive outbound policy blocks the connection. | Confirm LAN reachability from the connector and permit the outbound tunnel traffic required by your firewall policy, including port 7844 where applicable. |
| TLS handshake or certificate error | The HTTPS origin certificate name, trust chain, or verification setting does not match. | Use the origin hostname covered by the certificate and configure the documented TLS verification options. Do not turn verification off as a first response. |
| Requests reach the wrong application | A hostname rule is missing, ordered incorrectly, or falls through to an unintended ingress target. | Check hostname and path matching, then retain a final catch-all rule returning HTTP 404. |
| Function gets an authorization failure | The origin or Access policy does not recognize the presented credential. | Confirm which layer rejected the request, compare the expected header and audience with the current policy, and test with a staging token. |
| Function cannot resolve or connect to the public name | DNS, hostname, or outbound HTTPS restrictions affect the Netlify runtime. | Confirm the function uses the public hostname, not a private IP, and inspect the function’s runtime error without logging secrets. |
Keep the two addresses visible during diagnosis: the public hostname is the function’s destination, while the Service URL is the connector’s destination. Mixing them is a common cause of apparently contradictory results.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does this differ from using Cloudflare Workers VPC?
Yes. Workers VPC is a Cloudflare mechanism for Cloudflare Workers to reach private services through a tunnel. It does not mean that a Netlify Function automatically runs inside Cloudflare’s network or can use Workers VPC. In this design, Netlify remains the compute platform, and it reaches the tunnel through the public HTTPS hostname.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Approach | Who initiates the connection? | Inbound port forwarding | Exposure and policy |
|---|---|---|---|
| Netlify Function plus Cloudflare Tunnel | cloudflared initiates outbound connections from home; the function calls the public hostname. |
Not required for the tunnel path. | Hostname may be public; add application authentication or an Access policy. |
| Direct router port forwarding | Internet clients connect directly to the home router and forwarded port. | Required. | Directly exposes an address and port; security depends on router and application controls. |
| Cloudflare Worker with Workers VPC | A Cloudflare Worker reaches a private service through the documented VPC integration. | Not the same Netlify arrangement. | Policy and platform behavior follow Cloudflare Workers documentation, not Netlify Functions documentation. |
The available documentation does not establish a cost, latency, uptime, or free-tier comparison among these approaches. Choose based on network exposure, platform ownership, and authentication requirements rather than an assumed performance advantage.
What should I check before putting the route into production?
- Confirm the origin responds from the connector host using the exact local scheme and port.
- Confirm the tunnel connector starts automatically and can reconnect after a home-server reboot.
- Confirm the published hostname uses HTTPS and that DNS resolves as expected from outside the LAN.
- Confirm the Netlify Function calls the public hostname and reads credentials from Functions-scope runtime variables.
- Test an unauthenticated request and verify that it is denied when your policy requires authentication.
- Test an authenticated request with a short-lived or staging credential before rotating in production secrets.
- Check origin logs, connector logs, Cloudflare route status, and Netlify function logs as separate layers.
- Document the Service URL, certificate name, firewall allowance, and credential rotation procedure for whoever maintains the home server.
Frequently Asked Questions
Can I run cloudflared on a different computer from the home server?
Yes, provided that computer can reach the service over the home LAN and remains online. Use the server’s LAN address and listening port in the Service URL, and allow any host firewall rule needed between the connector and that server.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do long-running home-server jobs work through a Netlify Function?
They may require an asynchronous design rather than holding the function request open. Return a job identifier, process work on the home service, and let a later request retrieve status; verify the current Netlify runtime limits for your selected function type before choosing a synchronous call.
What should I do if the home internet connection changes its public IP?
The connector model is designed around outbound connections from the home network, so the function does not need to know the home’s public address. Keep the connector running and monitor its reconnect status instead of hard-coding an ISP-assigned IP in the function.
Can I use the same hostname for internal and external callers?
You can, but internal clients may follow different DNS or split-horizon rules than Netlify. Test the name from both networks and ensure internal callers are not accidentally sent to a private address that the Netlify runtime cannot reach.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
