cloudflared

The cloudflared daemon opens an outbound tunnel from a host to the Cloudflare edge, publishing services running on your LAN under a public hostname without opening inbound ports. It covers HTTP and HTTPS origins, arbitrary TCP services through the Access client, and a device mode that routes all traffic through the WARP network.

Home labs expose dashboards and webhook receivers this way, and admins pair it with Access policies so a service opens only after identity checks pass.

Running the connector on your own hardware keeps the tunnel credentials and configuration in your hands, adds no per-seat or per-request charges, and leaves little state to back up.