If you’re running a service at home, like Nextcloud, and want to reach it securely from anywhere without opening ports on your router, a Cloudflare Tunnel is one of the cleanest ways to do it. The cloudflared daemon makes an outbound connection to Cloudflare, so your server stays reachable through your own domain over HTTPS, with no port forwarding and no manually managed certificates.
This guide walks through setting that up. The example uses Nextcloud on Rocky Linux, but the same steps adapt to any service you want to expose, so adjust the paths and ports to match your own setup.
Prerequisites
- A working Linux system running the service you want to access
- A domain name from any registrar (Cloudflare, Namecheap, Porkbun, and so on)
Step 1: Add Your Domain to Cloudflare
Sign in to your Cloudflare account, then choose “Add a Site” and enter your domain. Select the Free plan, which is usually at the bottom of the list and is all you need for this, and follow the prompts.
Cloudflare will then give you two nameservers. Make a note of them, since the next step is pointing your domain at them.
Step 2: Update Your Nameservers
Log in to your domain registrar, find the DNS or nameserver settings, and replace the existing nameservers with the two Cloudflare gave you. The exact location differs from one registrar to the next, but it’s a straightforward change. Once it’s saved, Cloudflare takes a little while to verify the domain, so it may not be active immediately.
Step 3: Create the Tunnel
In the Cloudflare dashboard, go to the Zero Trust section and open Networks, then Tunnels, and create a new tunnel. Choose the free Cloudflared option and give it a name.
Cloudflare then shows you an install command for your system. Copy and run it on your server, and it will install cloudflared and connect the tunnel to your account automatically. Once the tunnel shows as connected, move on to routing a hostname to your service:
- Enter the subdomain you want to use, for example
nextcloud, which becomesnextcloud.yourdomain.com. - Set the service to the local address and port your service listens on, for example
192.168.1.112:80. - Under Additional application settings, enable “Disable Chunked Encoding” and “No Happy Eyeballs”, which avoid some common upload and connection quirks with Nextcloud.
Save it, then restart cloudflared so everything is running cleanly:
sudo service cloudflared restartStep 4: Add the Domain to Nextcloud’s Trusted Domains
Nextcloud refuses connections from any hostname it doesn’t recognise, so you need to add your new domain to its trusted domains list. Open the config file:
sudo nano /var/www/html/nextcloud/config/config.phpFind the trusted_domains array and add your domain as a new entry. Increment the index number so it doesn’t clash with any existing entries:
'trusted_domains' =>
array (
0 => '192.168.1.112',
1 => 'nextcloud.yourdomain.com',
),Then make sure the file is still owned by the web server user. On Rocky Linux that’s apache, and on Debian-based systems it’s www-data, so use whichever matches your setup:
sudo chown apache:apache /var/www/html/nextcloud/config/config.phpStep 5: Set Up Automatic Updates for cloudflared
Finally, add Cloudflare’s package repository so cloudflared stays up to date through your normal system updates rather than drifting out of date:
sudo dnf config-manager --add-repo https://pkg.cloudflare.com/cloudflared-ascii.repoThat’s everything. Your service is now reachable at nextcloud.yourdomain.com over HTTPS, with no open ports on your router and no certificates to manage by hand. The same approach works for any local service, so once the tunnel is running you can route as many subdomains to as many services as you like.
Leave a Reply