Cloudflare Tunnels solve a problem that used to require real effort — exposing a local service to the internet without opening ports, without exposing your IP, and without touching your router or firewall. Once you've used them you'll wonder how you managed without.
The problem they solve
The traditional way to make a home-hosted service accessible from the internet is port forwarding — you open a port on your router and point it at the machine running the service. It works, but it exposes your home IP, requires router access, and leaves that port open to the entire internet. For some situations that's fine. For others it's not ideal at all.
How they actually work
You install cloudflared on the machine running your service. It establishes an outbound connection to Cloudflare's network. When a visitor hits your domain, Cloudflare routes the traffic through that tunnel to your machine. From the visitor's perspective it's just a normal HTTPS request. From your machine's perspective it's an outbound connection it already established. Nothing is exposed.
Setting one up
The setup is genuinely quick. Install cloudflared, authenticate it with your Cloudflare account, then run:
cloudflared tunnel create my-tunnel cloudflared tunnel route dns my-tunnel myservice.mydomain.com
Then point the tunnel at your local service in the config file and run it. You can also set it up as a systemd service so it starts automatically. The whole thing takes about ten minutes if you know what you're doing.
What I use them for
Anything I want to access remotely that's running on my home network goes through a tunnel. My home server monitoring stack, internal tools, services I want accessible without going through a VPS. The tunnel means I don't need to expose anything directly and my home IP stays out of it completely.
The catch
Tunnels require your machine to have an active internet connection and for the cloudflared daemon to be running. If either of those goes down, the tunnel goes down too. For critical services this matters — but for most personal use cases it's a non-issue. And it's free, which for what it does is kind of remarkable.