Skip to content

SYSTEM Cited by 4 sources

Cloudflare Tunnel

Overview

Cloudflare Tunnel is Cloudflare's connector-based private-origin connectivity product. A lightweight agent (cloudflared) running on or near the origin server establishes an outbound-only connection to the Cloudflare edge; inbound requests are then served through that tunnel. Because the connection is initiated from the origin outward, the origin needs no public inbound IP at all — the customer can close all inbound IP traffic, and there is no public address for an attacker to reach directly.

This makes Tunnel the canonical mechanism for the attack-surface-minimization move of removing the origin from the public Internet entirely, and a core building block of the Cloudflare One / Zero-Trust suite alongside Access.

Why outbound-only matters (origin-boundary enforcement)

The structural value of Tunnel is that it closes the direct-origin bypass path. Fronting an application with Access is worthless if an attacker can still reach the origin on its original IP or an alternate hostname — the access policy only guards the Cloudflare-fronted hostname. Tunnel removes the public IP, so all traffic must traverse the Cloudflare edge where the access decision and WAF inspection are enforced. It is the strongest of the origin-restriction options (stronger than source-IP allow-lists via Dedicated Egress IPs, mutual TLS via Authenticated Origin Pulls, or origin-side Access-JWT validation) because there is simply no reachable public listener to bypass. (Source: sources/2026-10-19-cloudflare-protecting-netscaler-gateway-before-the-patch)

Relationship to connector-less private origins

Tunnel is the connector-based predecessor to the connector-less private- origin routing introduced with Application Services for Private Origins. The key differentiator the 2026-06-10 post draws: customers already on WAN (IPsec / GRE / CNI) or Cloudflare Mesh can get private-origin routing without deploying cloudflared, using their existing network-layer connectivity — whereas Tunnel requires the connector running on/near the origin. Both achieve the same end: the origin accepts traffic only from Cloudflare, never from the open Internet. (Source: sources/2026-06-10-cloudflare-route-public-traffic-to-private-applications)

Browser-based RDP use case

Tunnel is also the transport beneath Cloudflare's browser-based remote desktop access: for supported Windows workloads a user connects to a Windows host through Cloudflare Tunnel with no local RDP client, which — combined with Access + Browser Isolation — can remove a virtual-desktop (ICA) dependency used only to reach web applications. (Source: sources/2026-10-19-cloudflare-protecting-netscaler-gateway-before-the-patch)

Seen in

Last updated · 854 distilled / 2,448 read