![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Overview
- Replace your VPN
- Secure private apps
- Videos
- Insights
- Overview
- Analytics overview
- Network visibility
- Diagnostics
- Logs
- Overview
- Dashboard logs
- Logpush integration
- Team and resources
- Application Library
- Devices
- Overview
- Cloudflare One Client
- Device registration
- Networks
- Connectivity options
- Connectors
- Cloudflare Tunnel
- Overview
- Configure a tunnel
- Private networks
- Overview
- Connect with cloudflared
- Published applications
- Monitor tunnels
- Other tunnel types
- Overview
- Locally-managed tunnels
- Quick Tunnels
- Cloudflare WAN
- Overview
- WAN transformation
- Get started
- On-ramps
- Configuration
- Configure with Connector
- Overview
- Configure hardware Connector
- Configure Virtual Appliance
- Network options
- Device metrics
- Reference
- Troubleshooting
- Third-party integration
- Alibaba Cloud VPN Gateway
- Amazon AWS Transit Gateway
- Aruba EdgeConnect Enterprise
- Cisco IOS XE
- Cisco Meraki MX (static routing)
- Cisco SD-WAN
- Fortinet
- Furukawa Electric FITELnet
- Google Cloud VPN
- HPE Juniper Networking SRX Series Firewalls
- Microsoft Azure
- Oracle Cloud
- Palo Alto Networks NGFW
- pfSense
- SonicWall
- Sophos Firewall
- strongSwan
- Ubiquiti
- Velocloud
- VyOS
- Yamaha RTX Router
- Security filters
- Cloudflare One integration
- Network Interconnect (CNI)
- Load Balancing
- Public to private via Cloudflare WAN Beta
- Legal
- Granular permissions for Tunnels and Mesh nodes
- Resolvers and proxies
- Virtual networks
- Access controls
- Overview
- Applications
- Overview
- Choose an application type
- Add web applications
- Overview
- SaaS applications
- Overview
- Generic OIDC application
- Generic SAML application
- Adobe Acrobat Sign
- Area 1
- Asana
- Atlassian Cloud
- AWS
- Braintree
- Coupa
- Digicert
- DocuSign
- Dropbox
- GitHub Enterprise Cloud
- Google Cloud
- Google Workspace
- Grafana
- Grafana Cloud
- Greenhouse Recruiting
- Hubspot
- Ironclad
- Jamf Pro
- Miro
- PagerDuty
- Pingboard
- Salesforce (OIDC)
- Salesforce (SAML)
- ServiceNow (OIDC)
- ServiceNow (SAML)
- Slack
- Smartsheet
- SparkPost
- Tableau Cloud
- Workday
- Zendesk
- Zoom
- Self-hosted public application
- Managed OAuthBeta
- Authorization cookie
- Linked App Token
- Add bookmarks
- Service credentials
- Authenticate coding agents
- Event subscriptions
- Troubleshoot Access
- Traffic policies
- Cloud and SaaS findings
- Email security
- Overview
- Retro Scan
- Setup
- Before you begin
- Post-delivery deployment
- API deployment
- BCC/Journaling
- Pre-delivery deployment
- Manage domains
- Monitoring
- Investigation
- Settings
- Domain management
- Auto-move events
- Directories
- Overview
- Manage integrated directories
- Manage Email security directories
- PhishGuard
- Outbound Data Loss Prevention (DLP)
- Troubleshoot Email security
- Email security API API
- Data loss prevention
- Overview
- Data classification
- DLP settings
- Scan HTTP traffic
- Scan SaaS apps
- Scan AI Gateway traffic
- Troubleshoot DLP
- Reusable components
- Integrations
- Cloud and SaaS integrations
- Identity providers
- Overview
- Cloudflare as identity provider
- One-time PIN login
- Generic OIDC
- Generic SAML 2.0
- IdP federation
- Active Directory (SAML)
- Amazon Cognito
- AWS IAM (SAML)
- Centrify
- Centrify (SAML)
- Citrix ADC (SAML)
- GitHub
- Google Workspace
- JumpCloud (SAML)
- Keycloak (SAML)
- Microsoft Entra ID
- Okta
- Okta (SAML)
- OneLogin
- OneLogin (SAML)
- PingFederate
- PingOne
- PingOne (SAML)
- Signed AuthN requests (SAML)
- Yandex
- Roles and permissions
- Tutorials
- Reference architecture
- Account limits
- FAQ
- API and Terraform
- Glossary
- Home
- /Cloudflare One
- /…Networks
- /Connectors
- /Cloudflare Tunnel
Cloudflare Tunnel
Looking to expose public applications?
This documentation covers Cloudflare Tunnel use cases for private networking and Zero Trust, like VPN replacement and private network access. For publishing public web applications, APIs, and services to the Internet through Cloudflare refer to the Cloudflare Tunnel documentation.
Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. With Tunnel, you do not send traffic to an external IP instead, a lightweight daemon in your infrastructure (cloudflared) creates outbound-only connections to Cloudflare's global network. Cloudflare Tunnel can connect HTTP web servers, SSH servers, remote desktops, and other protocols safely to Cloudflare. This way, your origins can serve traffic through Cloudflare without being vulnerable to attacks that bypass Cloudflare.
Refer to our reference architecture for details on how to implement Cloudflare Tunnel into your existing infrastructure.
cloudflared establishes outbound connections (tunnels) between your resources and Cloudflare's global network. A tunnel is a persistent object identified by a UUID it serves as the logical link between your origin and Cloudflare. Within the same tunnel, you can run as many cloudflared processes (connectors) as needed. Each connector sends traffic to the nearest Cloudflare data center.
[How an HTTP request reaches a private application connected with Cloudflare Tunnel]
![[How an HTTP request reaches a private application connected with Cloudflare Tunnel]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1768,height=1102,format=webp/_astro/handshake.eh3a-Ml1.jpg){kind=link}
Cloudflare Tunnel uses an outbound-only connection model to enable bidirectional communication. When you install and run cloudflared, cloudflared initiates an outbound connection through your firewall from the origin to the Cloudflare global network.
Once the connection is established, traffic flows in both directions over the tunnel between your origin and Cloudflare. Most firewalls allow outbound traffic by default. cloudflared takes advantage of this standard by connecting out to the Cloudflare network from the server you installed cloudflared on. You can then configure your firewall to allow only these outbound connections and block all inbound traffic, effectively blocking access to your origin from anything other than Cloudflare. This setup ensures that all traffic to your origin is securely routed through the tunnel.
Authenticated Origin Pulls does not apply
Because Cloudflare Tunnel does not use an inbound listener on your origin, Authenticated Origin Pulls has no effect on hostnames routed through Cloudflare Tunnel. Origin traffic is already authenticated using your tunnel's connector credentials.
- Create a tunnel using the Cloudflare dashboard or API.
- Download
cloudflared, the server-side daemon that connects your infrastructure to Cloudflare. - Review useful Tunnel terms to familiarize yourself with the concepts used in Tunnel documentation.
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}