Zero Trust Tunnels: Retiring Port Forwarding Forever
How cloudflared tunnels combined with Cloudflare Access and OAuth allow me to securely expose home telemetry and internal dashboards without exposing public IPs.
The End of Open Firewall Ports
For years, self-hosters dealt with dynamic DNS scripts, Let’s Encrypt certbot challenges, and open port 443 forwarded on home routers. With Cloudflare Zero Trust (cloudflared), all outbound tunnels originate from inside the network, meaning zero open incoming ports on the perimeter.
Access Policies & Passkey Verification
Every protected route requires authentication via Google Workspace / Passkeys before traffic ever touches local services. Unauthenticated requests are rejected at Cloudflare’s edge PoP before packet arrival.
# cloudflared config snippet
tunnel: c4b2e8-harker-cluster
credentials-file: /etc/cloudflared/creds.json
ingress:
- hostname: lab.harkerfamily.uk
service: http://192.168.1.50:3000
- service: http_status:404Conclusion
Latency added by routing via London Cloudflare edge is under 7ms, well worth the peace of mind that no bots or scanners can poke at raw open ports.