Network Security

Setting Up Your First Cloudflare Zero Trust Tunnel: Stop Port Forwarding Forever

TS
By Tech Simpld
•
Available Now
•
12 Min Read

You’ve just set up your first home lab services—maybe Home Assistant for smart lights, an Obsidian note vault, or a self-hosted dashboard. Everything works beautifully when you’re connected to your home Wi-Fi.

Then you leave the house, open your phone, and realize you can't access any of it.

In the past, the standard tutorial advice was simple: "Just log into your home router and forward port 80 or 443 to your server."

While port forwarding works, it is one of the riskiest things a beginner can do to their home network. The second you open a port on your consumer router, automated internet bots, malicious port scanners (like Shodan), and brute-force scripts will start hammering your home firewall within minutes. Furthermore, if your ISP uses CGNAT (Carrier-Grade NAT, common with Starlink and 5G home internet), port forwarding won't work at all.

The modern, secure solution is a Cloudflare Zero Trust Tunnel (powered by cloudflared). In this guide, we’ll explain how tunnels work, why they make your home network practically invisible to hackers, and walk through the complete step-by-step setup in under 10 minutes.

Why Traditional Port Forwarding is Dangerous

To understand why Zero Trust is a game-changer, let’s compare how connections reach your server:

  • Port Forwarding (Inbound): You punch a hole directly through your router's firewall. Anyone on the public internet who knows or scans your public IP address can connect directly to your server hardware. If the software you are hosting has a security vulnerability, an attacker has a direct pathway into your local home network.
  • Cloudflare Tunnel (Outbound Only): A tiny, lightweight background program (cloudflared) runs on your server. It initiates an outbound encrypted connection to Cloudflare’s global edge network. Your home router firewall stays 100% locked down—zero open inbound ports!
Feature Port Forwarding Cloudflare Zero Trust Tunnel
Open Router Ports Yes (Open & Exposed) Zero (100% Closed)
Exposes Home IP Yes (Publicly visible) No (Hidden behind Cloudflare)
DDoS Protection None (Router bears load) Enterprise Cloudflare Edge
Works Behind CGNAT / 5G Fails completely Works flawlessly
Pre-Authentication (SSO/OTP) No (Hits app login directly) Yes (Google / Email OTP lock)

What You Need Before Starting

  1. A free Cloudflare Account.
  2. A custom domain name (e.g. myhomelab.com) using Cloudflare as its authoritative DNS nameservers. You can buy cheap domains on Namecheap or Cloudflare Registrar for $5–$10/year.
  3. A home server, Raspberry Pi, or Proxmox container running Docker or Linux.

Step 1: Create a Tunnel in the Zero Trust Dashboard

  1. Log into your Cloudflare Dashboard and click Zero Trust in the left navigation sidebar.
  2. In the Zero Trust console, navigate to Networks → Tunnels.
  3. Click Create a Tunnel.
  4. Select Cloudflared as the connector type and click Next.
  5. Name your tunnel (for example: homelab-main-tunnel) and click Save tunnel.

Step 2: Install the Connector on Your Home Server

Cloudflare will generate a unique token and command for your operating system (Docker, Debian/Ubuntu, Windows, macOS).

If you are running Docker (or Docker Compose), copy your unique tunnel token and paste it into a docker-compose.yml file: 

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared_tunnel
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token YOUR_CLOUDFLARE_TUNNEL_TOKEN_HERE

Start the container by running: 

docker compose up -d

Back in the Cloudflare web dashboard, you will see your connector status flip from Inactive to a glowing green ACTIVE indicator within seconds! Click Next.

Step 3: Route Your First Public Hostname

Now, tell Cloudflare which local service to link to your domain:

  • Subdomain: notes (or whatever prefix you prefer)
  • Domain: Select your domain from the dropdown (e.g. myhomelab.com)
  • Type: HTTP
  • URL: YOUR-SERVER-LOCAL-IP:PORT (e.g. 192.168.1.50:3000)

Click Save hostname. Cloudflare will automatically create the DNS CNAME record and provision a free, valid SSL/TLS certificate!

Step 4: Lock Down Access with Zero Trust Application Policies

One of the best features of Cloudflare Zero Trust is the ability to place an authentication gatekeeper in front of your applications:

  1. Go to Access → Applications in the Zero Trust sidebar.
  2. Click Add an Application → Self-hosted.
  3. Enter your application name and domain (e.g. notes.myhomelab.com).
  4. Under Policies, create an allow-list rule:
    • Rule Name: Allow My Email Only
    • Action: Allow
    • Include: Emails → Enter your personal email address (e.g. you@gmail.com).
  5. Save the application.

Now, when anyone visits notes.myhomelab.com, they are met with a sleek Cloudflare login screen. Cloudflare will email a one-time 6-digit pin code to your inbox. No one else on the entire internet can even view your application’s login page!

Important: Cloudflare Terms of Service & Video Streaming

Heads Up on Plex & Jellyfin: Cloudflare’s free tier terms of service prohibit streaming large video files (like 4K movies through Plex or Jellyfin) through their CDN proxies. Use Cloudflare Tunnels for web apps, Home Assistant, dashboards, Nextcloud, and note vaults. For heavy video streaming, consider setting up Tailscale or WireGuard instead!

Summary: Modern Security Made Simple

Setting up a Cloudflare Zero Trust Tunnel is hands-down the cleanest, safest way for rookie home lab builders to access their self-hosted projects on the go. You eliminate port scans, bypass CGNAT restrictions, get free automated SSL certificates, and protect your home network with world-class DDoS mitigation and identity authentication.

Want to learn more about containerizing your apps? Read our tutorial on Docker vs. Podman and our guide on Running Obsidian in Any Web Browser.