Skip to content

Cloudflare

Cloudflare Tunnel exposes services externally without opening any ports on the router: cloudflared only makes outbound connections. My live setup runs one connector that hands every public hostname to Nginx Proxy Manager, behind a wildcard Cloudflare Access application. The older one-tunnel-per-host design is kept as the alternative, with the trade-offs between the two.

  • Cloudflare Tunnel + NPM (Wildcard)

    The current setup: one connector, wildcard route to NPM, wildcard Access app, LAN names on a private CA, and how to harden the wildcard model.

  • Cloudflare Tunnel per Host

    The alternative: a cloudflared per host routing straight to containers on a shared tunnel-net network, with an Access app per service. Includes why I moved away from it.