Publishing Your Website from a Home PC: Cloudflare Tunnel Without a White IP

Cloudflare Tunnel — a Cloudflare service that publishes a web server running at your home or office to the Internet without a public IP address and without port forwarding on the router. A utility called cloudflared is installed on the computer: it creates an outbound encrypted connection to the Cloudflare network, and visitors access your site by its domain name through that connection. The service used to be called Argo Tunnel.

This is convenient for a personal blog, a test project, or a small service: the ISP often does not provide a public IP address, and if it does, it may be dynamic and you need to update it via DDNS. Below — how to set up a tunnel on Linux and what to consider if the site is accessed from Russia.

Important for an audience in Russia. Since June 9, 2025, Russian ISPs have been throttling access to services behind Cloudflare: according to Cloudflare itself, users receive only the first 16 KB of each resource, and most sites effectively do not load (Cloudflare blog). If your site targets visitors in Russia, publish it via a VPS with a public IP address and a reverse proxy — for example, Caddy. More about CDNs and their availability — in the article on reserving internet egress.

What is Cloudflare Tunnel and how does it work?

Cloudflare Tunnel connects your local web server to the global Cloudflare network without the need to open inbound ports on your router. It creates an encrypted outbound tunnel between your home computer and the nearest Cloudflare server. All incoming traffic to your site will pass through Cloudflare’s infrastructure, giving you many benefits: from their CDN and caching to DDoS protection and a free SSL/TLS certificate.

How it works:

1. You install a small utility cloudflared on your Linux computer.
2. cloudflared establishes an outbound HTTPS connection to the nearest Cloudflare server, creating a persistent tunnel.
3. When someone requests your site via the domain name, Cloudflare routes that request through the established tunnel to your local web server.
4. Your web server processes the request and sends the response back through the same tunnel, and Cloudflare delivers it to the user.

What you’ll need

1. A domain name: This is required. You can buy it from any registrar; the domain must be delegated to Cloudflare’s DNS servers.
2. A Cloudflare account: The free plan is sufficient for most tasks.
3. A web server installed on your Linux computer: This can be Nginx, Apache, Caddy, a Node.js server, Python Simple HTTP Server, or any other server that can listen for HTTP requests on a local port (for example, 80, 8000, 3000, etc.).
4. A computer running Linux where the site will be hosted.

Part 1: Preparing the domain and installing Cloudflared

This section covers the initial steps to integrate your domain with Cloudflare and install the necessary software.

Step 1: Add your domain to Cloudflare

If your domain is not yet managed by Cloudflare, this is the first and most important step:

1. Log in to your Cloudflare account.
2. Click “Add a Site”.
3. Enter your domain name and choose the free plan.
4. Cloudflare will scan your current DNS records. After that you will be prompted to change your domain’s nameservers to those provided by Cloudflare (for example, xxx.ns.cloudflare.com and yyy.ns.cloudflare.com). This is a critical step — without it Cloudflare cannot manage your domain name. Instructions for changing nameservers are available from your domain registrar.

After you update the nameservers, wait some time (from a few minutes to a few hours) for the changes to propagate across the Internet. The status of your domain in Cloudflare should change to “Active”.

Step 2: Install cloudflared on your Linux computer

Cloudflare strongly recommends using their official repository to install cloudflared. This ensures you always have the latest version of the utility and can receive automatic updates.

1. For Debian/Ubuntu add the Cloudflare GPG key (for CentOS/RHEL/Fedora it’s enough to add the repo file from step 2):

   bash Copy

   sudo mkdir -p --mode=0755 /usr/share/keyrings
   curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

2. Add the Cloudflare repository to your system:

   • For Debian/Ubuntu and derivatives (using apt):
     bash Copy

     echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

   • For CentOS/RHEL/Fedora and derivatives (using yum/dnf):
     bash Copy

     curl -fsSL https://pkg.cloudflare.com/cloudflared.repo | sudo tee /etc/yum.repos.d/cloudflared.repo

3. Update the package list and install cloudflared:

   • For Debian/Ubuntu:
     bash Copy

     sudo apt update
     sudo apt install cloudflared

   • For CentOS/RHEL/Fedora:
     bash Copy

     sudo yum install cloudflared
     # Or for Fedora: sudo dnf install cloudflared

After installation you can quickly check that cloudflared is installed and available by running:

cloudflared --version

Step 3: Authenticate cloudflared with your Cloudflare account

Now you need to link the installed cloudflared utility with your Cloudflare account. Open a terminal on your Linux computer and run:

cloudflared tunnel login

This command will automatically open a web browser. You will need to log in to your Cloudflare account and select the domain for which you are creating the tunnel. After successful authentication you will see a message that the certificate was successfully saved in your home directory (usually at /root/.cloudflared/cert.pem or /home/youruser/.cloudflared/cert.pem). This certificate is used to authenticate your cloudflared agent with Cloudflare.

Part 2: Creating and configuring the Cloudflare Tunnel

At this stage we’ll create the tunnel itself and configure its routing.

Step 4: Create the Cloudflare Tunnel

Time to create your first tunnel! Choose a unique and memorable name for it, for example my-website-tunnel.

cloudflared tunnel create my-website-tunnel

In response you will receive the UUID of your tunnel (a long string like a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6) and the path to the credentials file (for example, /root/.cloudflared/a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6.json). Be sure to save this UUID and the path to the file, you will need them in the next step.

Step 5: Configure the tunnel (the config.yml file)

Now create a configuration file for your tunnel that defines how Cloudflare should route traffic to your local web server. Cloudflare recommends placing this file in /etc/cloudflared/.

Create a file named config.yml (or any other name with a .yml extension):

sudo nano /etc/cloudflared/config.yml

Example contents of config.yml:

tunnel: <UUID of your tunnel>
credentials-file: /root/.cloudflared/<UUID of your tunnel>.json # Specify the full path to the JSON file from Step 4

ingress:
  - hostname: your-domain.com # Replace with your domain, for example, myblog.ru
    service: http://localhost:80 # Port your web server listens on locally
  - hostname: www.your-domain.com # If you want it to work with www as well, e.g., www.myblog.ru
    service: http://localhost:80
  - service: http_status:404 # Mandatory rule to catch all other requests

Notes on config.yml:

• tunnel: This is the UUID you received in the previous step.
• credentials-file: The full path to the JSON file that contains the tunnel credentials. Double-check and specify the correct path to this file on your system.
• ingress: This is an array of rules that determine how Cloudflare will route incoming requests. Rules are processed top to bottom.
  • hostname: The domain name (or subdomain) the rule applies to.
  • service: The address of your local web server and the port it listens on. For example, if your web server listens on port 3000, change it to http://localhost:3000.
  • service: http_status:404: This is the required last rule in the list. It ensures that any request that does not match previous hostname rules receives an HTTP 404 (Not Found), preventing potential unwanted access.

After editing, save and close the file (for nano: Ctrl+O, Enter, then Ctrl+X).

Step 6: Configure DNS records in Cloudflare for the tunnel

So that Cloudflare knows your domain should use the created tunnel, you need to create a special CNAME DNS record.

1. Go to the “DNS” section of your domain in the Cloudflare dashboard.
2. Click “Add record”.
3. Choose the record type: CNAME.
4. In the “Name” field enter:
   • @ – for the root domain (e.g., your-domain.com).
   • www – for the www subdomain (e.g., www.your-domain.com).
5. In the “Target” field enter: <UUID of your tunnel>.cfargotunnel.com.
   • Important: Replace <UUID of your tunnel> with the real UUID obtained in Step 4.
6. Make sure the “Proxy status” icon is orange (Full Proxy) — this means traffic will go through Cloudflare.
7. Click “Save”.

Repeat this step for the www subdomain if you want your site to be accessible both at www.your-domain.com and your-domain.com.

Part 3: Running and verifying the tunnel

Final steps — run cloudflared as a system service and verify everything works.

Step 7: Run the tunnel as a system service

Cloudflare recommends running cloudflared as a system service (systemd on most modern Linux systems). This ensures it starts automatically at boot and runs stably in the background.

In the terminal run:

sudo cloudflared tunnel service install

This command will install cloudflared as a system service, using the configuration file you created at /etc/cloudflared/config.yml.

After installation you can manage the service with standard systemctl commands:

sudo systemctl start cloudflared     # Start the tunnel
sudo systemctl status cloudflared    # Check the current status of the tunnel
sudo systemctl enable cloudflared    # Enable the tunnel to start at boot
sudo systemctl stop cloudflared      # Stop the tunnel
sudo systemctl restart cloudflared   # Restart the tunnel (useful after changes to config.yml)

Step 8: Verify it works!

Everything should be configured now! Your local web server must be running, cloudflared should be running as a service, and the DNS records in Cloudflare should point to your tunnel.

Open a web browser and enter your domain name (for example, your-domain.com). If all steps were performed correctly, you should see your site served directly from your home Linux computer!

Important notes and recommendations

• Local web server: Make sure your web server on the Linux machine is running and listening on the port specified in config.yml. For example, if you use Python for quick testing: python3 -m http.server 8000 and set service: http://localhost:8000 in the config.
• Security: Cloudflare Tunnel greatly improves security by removing the need to open ports. However, always maintain the security of the Linux server itself.
• Monitoring: Cloudflare provides basic traffic analytics. For more detailed monitoring of your local server use standard Linux tools (htop, netstat, your web server logs).
• Internet speed: The performance of your site will of course depend on the upload speed of your home Internet connection. Cloudflare’s CDN can help cache static content, but dynamic requests will traverse the tunnel.

Cloudflare Tunnel is suitable for personal projects, test environments, and small services when you don’t have a public IP address. For sites targeting visitors in Russia, consider the Cloudflare throttling and opt to publish via your own VPS.