cloudflare/cloudflared

Cloudflared is a tunneling daemon that proxies traffic from the Cloudflare network to your origins without requiring firewall modifications.

The tool solves the problem of exposing internal services to the internet securely. It sits between the Cloudflare network and your origin servers, allowing Cloudflare to attract client requests and forward them through the daemon to your backend infrastructure. Your origin can remain behind a closed firewall since the daemon initiates outbound connections rather than requiring inbound ports to be opened. The tool also supports Layer 4 TCP traffic proxying for use cases like SSH and RDP access to protected origins, with an alternative being the WARP client for accessing private origins without requiring command-line access tools on the client side.

Cloudflared suits organizations that want to expose internal services while maintaining strict firewall policies and zero-trust network access. It works well for web servers, APIs, and other services that need to be accessible from the Cloudflare edge network. The tool requires adding a website to a Cloudflare account and changing nameservers to Cloudflare before use, though private routing is possible without a website despite this legacy requirement. Installation is straightforward through multiple channels including Homebrew, package managers for Linux distributions, Docker, standalone binaries, or building from source.

The project has a substantial base of adopters reporting real-world use, as evidenced by the fact that almost all open issues are raised by outside users rather than the core team. However, issues and pull requests often wait weeks or longer for a first response. Work in the issue tracker is dominated by normal priority bugs and feature requests from the community.