Skip to content

Create a locally-managed tunnel (CLI)

Follow this step-by-step guide to get your first tunnel up and running using the CLI.

Prerequisites

Before you start, make sure you:

1. Download and install cloudflared

  1. Download cloudflared on your machine. Visit the downloads page to find the right package for your OS.

  2. Rename the executable to cloudflared.exe

  3. In PowerShell, change directory to your Downloads folder and run .\cloudflared.exe --version. It should output the version of cloudflared. Note that cloudflared.exe could be cloudflared-windows-amd64.exe or cloudflared-windows-386.exe if you have not renamed it.

PowerShell
PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe --version

2. Authenticate cloudflared

Terminal window
cloudflared tunnel login

Running this command will:

  • Open a browser window and prompt you to log in to your Cloudflare account. After logging in to your account, select your hostname.
  • Generate an account certificate, the cert.pem file, in the default cloudflared directory.

3. Create a tunnel and give it a name

Terminal window
cloudflared tunnel create <NAME>

Running this command will:

From the output of the command, take note of the tunnel’s UUID and the path to your tunnel’s credentials file.

Confirm that the tunnel has been successfully created by running:

Terminal window
cloudflared tunnel list

4. Create a configuration file

  1. In your .cloudflared directory, create a config.yml file using any text editor. This file will configure the tunnel to route traffic from a given origin to the hostname of your choice.

  2. Add the following fields to the file:

If you are connecting an application:

url: http://localhost:8000
tunnel: <Tunnel-UUID>
credentials-file: /root/.cloudflared/<Tunnel-UUID>.json

If you are connecting a private network:

tunnel: <Tunnel-UUID>
credentials-file: /root/.cloudflared/<Tunnel-UUID>.json
warp-routing:
enabled: true
  1. Confirm that the configuration file has been successfully created by running:

    Terminal window
    cat config.yml

5. Start routing traffic

  1. Now assign a CNAME record that points traffic to your tunnel subdomain:

    • If you are connecting an application, route the service to a public hostname:
    Terminal window
    cloudflared tunnel route dns <UUID or NAME> <hostname>
    • If you are connecting a private network, route an IP address or CIDR through the tunnel:
    Terminal window
    cloudflared tunnel route ip add <IP/CIDR> <UUID or NAME>
  2. Confirm that the route has been successfully established:

    Terminal window
    cloudflared tunnel route ip show

6. Run the tunnel

Run the tunnel to proxy incoming traffic from the tunnel to any number of services running locally on your origin.

Terminal window
cloudflared tunnel run <UUID or NAME>

If your configuration file has a custom name or is not in the .cloudflared directory, add the --config flag and specify the path.

Terminal window
cloudflared tunnel --config /path/your-config-file.yml run <UUID or NAME>

7. Check the tunnel

Your tunnel configuration is complete! If you want to get information on the tunnel you just created, you can run:

Terminal window
cloudflared tunnel info <UUID or NAME>

You can now route traffic to your tunnel using Cloudflare DNS or determine who can reach your tunnel with Cloudflare Access.

To secure your origin, you must validate the application token issued by Cloudflare Access. Token validation ensures that any requests which bypass Cloudflare Access (for example, due to a network misconfiguration) are rejected.

One option is to configure the Cloudflare Tunnel daemon, cloudflared, to validate the token on your behalf. This is done by enabling Protect with Access in your Cloudflare Tunnel settings. Alternatively, if you do not wish to perform automatic validation with Cloudflare Tunnel, you can instead manually configure your origin to check all requests for a valid token.