How to use Cloudflare Tunnel in your Homelab (even with Traefik) 

I would so love to meet this guy and be best friends with him and every time I watch his videos I feel so influenced to dive into technology more and more it’s crazy!

Hi can you make a video for using cloudflare to have access to our SMB server, FTP and SSH from internet? 😢

How to get Android apps working on the smartphone? Like Nexcloud or Synology apps. Because of the login screen for 1-time password or verification...

I would love to see a video on the authentication recommendation and setup! Great video!

Hey Christian, just wanted to point out that your zsh history prefiller may have leaked a production token. I'm sure you probably noticed and it's all good, but just wanted to let you know

Word of warning: Streaming video or serving disproportionate amount of images is prohibited by CloudFlare. Watching your camera feeds will get your account terminated. It is actually somewhere in their Tunnels agreement.

CF Tunnel is what I'm using to expose my Matrix and Mastodon servers endpoint so they can federate. Otherwise I still prefer accessing stuff via Tailscale (which BTW recently added Tailscale Funnel). But Cloudflare is a different kind of beast if you want to combine Warp with Tunnel or Warp-to-Warp, but I digress 😃

You lost people when you decided to do something special with docker. For basic demo, should have just showed what can be done in general.

We can only load static websites. Videos and other streaming will ban the service

It would be interesteing to see how works with RPD, or CIFS/SMB works

I'd like more information on the "frontend" and "backend" networks. Seems some crucial information is missing..?

interesting video and the service is easy to set up but... even though the video is sponsored I think it would be fair to point out that according to the terms and conditions you MUST NOT use CloudFlare to upload videos and photos... it's not always clear until you get your account banned... I think it would it was fair to point out this fact :/

PERFECT Timing! I've been using CloudFlare tunnel on my server for a while, but decided to do a cleanup/consolidation on my Docker networks. Realized I had used the command line to set the tunnel up originally, but wanted to set up a stack in Portainer to handle future updates. Everything I need was in the tutorial (BTW - I think there might be a typo in the command to set up the token). THANKS!

I have à question you know if this tunnel or other we can connect with same ip but différent port. Ex: yacht app like portainer, because need always change the tunnel ip:port for access 😢. Ty

That's a great video I am soo excited for more videos about it about rdp with Cloudflare or access please continue your good work Could you do a video about authentification with Cloudflare access and a self-hosted IAM like Authelia or Keycloak (if possible with a user-friendly UI😅) or nether an existing active directory server

Great video! Can you do an in-depth video covering those settings in the cloudflare zero trust for exposing web application? How to allow mobile app api access while locking down web access.

Is it possible to combine this with authelia? When ive been trying traefik isnt pushing through authelia?

Christian, can you make some recommendations regarding how to employ "authentication providers and other security measures" due to TLS terminating at CF? What specifically have you done to mitigate this risk? Thanks!

This is a great video, Christian! Thank you for shouting out Warp in the beginning 👍

Hi great video, where can i find your video about local and external ssl and dns configuration? i like a lot that😀

@cristian Thanks for the amazing guides I whould love to see you setup and configure authentik with truenas scale seems there are not guides on this subject and will be very populat as a replacement for authellia that is complex to setup and manage

what if the self hosted setup includes both Træfik and Authelia? Is there something different to be done there? I can reach a simple Nginx container in the same network, but when I try to reach containers behind Træfik and Authelia, I cannot seem to reach them. Thanks for the great videos!

It would be nice to see a video about the authentication, Because, For example, if I setup the nextcloud using the tunnel, and I enabled the one time pin authentication, then, I am not sure if the nextcloud mobile application would still connect to this nextcloud instance, as the end point would be protected by one time pin, probably the mobile app would fail to connect. Thanks for your comments.

Great video. Finding tunnels great for home use. I would like to enable more security, but can you think of a way to do this that still allows mobile apps (nextcloud) to access the tunnel? Would like to see a video about this.

Hey Christian, Thank you for the valuable insights you share on your RU-vid channel. I have a question: Is it possible to forgo Traefik's SSL termination mechanism and instead utilize Cloudflare's HTTPS termination service to manage our certificates? I'm curious about the advantages of integrating Traefik's DNS challenge with Cloudflare, especially when we have the option to enable Cloudflare's free SSL/TLS. Thanks.

Great Videos! I have created a tunnel in the past for Plex, but recently when attempting to do so, I noticed that the localhost now ends with /web. Normally its localhost:port, but now localhost:port/web to access plex locally. Do you know how we can now tunnel with the /web, or even other's that have /ui?

If I were to self host a game server like "Project Zomboid" in a container on my ProxMox server would CloudFlare Tunnel be a good option to secure my Homelab. Or would somthing like this introduce too much latency. I have only ever seen people using this service with things that aren't that effected by latency.

Excellent, exactly what I was waiting for.

The videos on your channel have helped SO much! Any idea/question I've had, you seem to always have a video for it with answers. Awesome stuff.

hi @Christian Lempa, Thank you, I have a question, how do you install traefik plugin from Github? I also try to install it, but it's fail with invalid download

You saved my day I couldn’t thank you enough for figuring out you have to include both domain names in the traefik label I was stuck for hours.

What are you using to draw the details out?

Can it bypass my college firewall which even bans android studio??

If I'm not mistaken here. So we don't need manually add new ingress on cloudflared tunnel dashboard ? Just label all container??

If I use the container name, I get Bad gateway error. My containers are on the same network. If I use IP, it's ok. Any ideas?

Great video. Would love to see a video on setting up the various authentication methods and creating better policies for self hosted apps (including allowing API access to them). Thanks heaps

how I can view or monitor for example IP of the machine that connects and use my tunnel expose website? I dont see a monitor for activity on cloudfare dashboard

Awesome! Thank you, Christian, again for the great motivation :D Every time I watch your videos, I feel inspired to implement your techniques into my own homelab or at least start experimenting with them. By the way, I would be more than glad to hear your recommendations for securing access to exposed services through these tunnels. Cheers!

How would you setup the custom block page as it only takes an IP and wont work with SSL. thank you

What’s the software you use while creating diagrams document in real time ? Thanks !

how to expose only certain urls from the server and not all endpoints from the server?

Please closer look at the cloudflare authentication settings

How do I connect the new tunnels with nginx proxy manager?

Interessanter Ansatz! Wieder ein Pluspunkt für Traefik. Würde aber sehr gerne beim NPM bleiben, da ich nicht alles in Docker-Containern habe mir der händische Weg mit GUI irgendwie besser gefällt. Bin nun dazu übergegangen eine separate Domain für Cloudflare Tunnel zu nehmen und eine andere, die weiterhin klassisch mit DynDNS läuft, für den Fall, dass Cloudflare mal nicht als Option in Frage kommt. Nur wie mache ich das mit Nextcloud AIO o.Ä. wo die Domain hardgecoded festgelegt ist? Da funktioniert der OR-Operator || vermutlich nicht? Bin hier noch etwas überfragt. Besonders Nextcloud möchte man ja auch lokal mit Daten bespielen, ohne gleich alles durchs Internet schieben zu müssen.

I have a question, no one wants to port forward their public ip address because china/russia/bots/whatever so they do this type of stuff. The IP address is always IPv4 when people talk about this stuff. Would it be ok to have the same services, that cloudflare would expose, hosted on one of the IPv6 addresses that a home user would have at their disposal?

Hey Christian, I tried setting up a public hostname to my local proxmox management IP, I get the cloudflare bad gateway error (host) and does it matter that the ''Origin Configurations" on the public hostnames page shows 0? Come a long way watchin your videos!

Can I use this with a FTP client ? Like Transmit ?

Hi Christian, ich steh gerade vor der Frage wie es im Okt weiter geht mit Docker Umstellung bei TrueNas Scale. Habe gerade neu installiert und scheue nun wieder alles mit TrueCharts zu machen, da iX garantieren will die eigenen Apps zu Docker zu migrieren samt Einstellungen. Hast du da schon ein Plan?

First of all, awesome guide as always! Now, what I kind of miss is your Traefik setup. Your other video with Traefik helps, but I somehow can't get certificates from Let's Encrypt. Are your Traefik settings different when you use it with Cloudflare Tunnel?

Just done this before watching this video last week. I don't mind exposing my ip address, people can already guess and I had to move ssh port higher. Because it was constantly abused. It still is, but with much lower rate. But advantage is that it somewhat helps with other stuff: you don't need nginx reverse proxy, you don't need to renew let's encrypt certificates for each service every three months, you don't need to setup port forwarding on docsys modem/router and open port 443 whenever it needs factory reset. I just haven't tried this for ssh and to have dynamic dns (script that checks local ip every 30 minutes and renews dns when it changes - which can be likely done via cloudflare api) and to for blocking access based on country.

Thanks for this. Fantastic material. Your linked video on docker networks was great also. However! 😂. It never explains your use and configuration of the backend and frontend networks. Where is that covered?

Hello Christian, I am using container name as URL in public hostname section. But it doesn't work. Only docker network IP work for me. Can i know why ? Please..

Hi Chrisitan: Got this working fine so long as everything is running inside the same docker container as Traefik. Is it a simple process to have Traefik function across multiple docker containers on different machines? I have programs on other servers that I would like to proxy, but Traefik cannot see them.

hey Christian, thanks for the great videos please I am facing the same error "404 page not found" Could you please explain more about how to change the labels as you did in the video noting that my docker containers are hosted remotely on a VPS also I am using nginx proxy manager I will try to replace it with traefik soon but i think its the same problem

Hello! Great video! Can such a solution be done without a third-party service such as cloudflare? Purpose: hosting services on the open Internet without port forwarding on the router.

Hey Christian, thank you for your dedication to each video and for your great selection of new topics as well as a very intuitive explanation process. Me personally, I'm under a CGNAT on a local ISP and I'm in need to use cloudflare tunnels and its great to see that you can still use traefik for load balancing, that was a great thing you showed me with this video. I'm curious since traefik can run in the internal network, couldn't authelia be deployed with traefik inside the internal network to provide an extra 2FA layer of security? I'm also excited to learn teleport if that's a more convenient way of exposing my services than cloudflare tunnels.

So, I have created the tunnel and it says it is working. I added nginx container and public hostname as you suggested. I head to that URL and it says: bad gateway at host.

I still feel safer using OpenVPN on my own equipment than trust a tunnel to my network through a third party that cannot be guaranteed to not have a backdoor built in.

Cloudflare tunnels are so good. Even have a ssh tunnel with two factor. No need to expose ports.

This might be a silly question. Can I use a domain that I own which points to a Wordpress website for example with this solution?

For someone just starting down this home lab rabbit hole would you recommend going this route for exposing services to the Internet for personal and public use or would you recommend a reverse proxy?

Does Cloud-flare block plex port? Can you make a video how to use free pbx extension with cloudflare tunnel ?

I prefer using zerotier with pihole/adguard as dns server, for me it's simpler because I use 4G connection

What is the app thet you used to draw in 3:00

I used it as a VPN. For some sites that only serve certain country or regions, use Cloudflare to avoid being denied access.

As always, you are on top 👍

Any advice on allowing access to Postgres via Cloudflare tunnel??

Great video - thank you. Have you been able to use a Cloudflare Tunnel to access Apache Guacamole?

videos good . hey man i have questions how to i look domain user data usage and how to limited data ? ....... please help

You need to make a video on ZeroTier one

The home assistant does not work and I have added the ips of the proxy servers. What can be the problem?

Hi Christian, thanks for your good work on this nice topic! I use cloudflared on a separate ubuntu server in my dmz as connector. The publishing services are running on other servers (and dockers) in separate vlans. I only allow the configured ports, protocols and target-server in my firewall, so that other communication from tdmz to other internal networks isn´t allowed. One advantage over teleport is, that I do not need a cloud-server. Another point is, that cloudflare offers a kind of application firewall on top to the 2fa login, so access to my applications is further narrowed down. The other side is, that in this case we have to trust in cloudflare. I also like it to self host applications and solutions, so I would be happy if you make another video about teleport, how to install, configure and use it. Thanks a lot 🙂

Your token was visible, it was only for a few seconds but it was there.

Damn, you fixed my life with the tip of adding the double pipe for the logical OR instruction

Hi christian I have a salf hosted rust desk server that need tcp and udp ports open and exposed to the internet can this be done with a tunnel or is there a better way?

Thank you for all your videos! I did have one question, perhaps you discussed this in another video but I missed it - can you explain your rationale and usecase for your "frontend" and "backend" networks?

How much data does Cloudflare allow to go through their tunnels for free?

200 mb terminal - ok )))

But will I break the ToS with the free cloudflare account 🙄

I somehow get a 502 Bad gateway error, Host Error, any ideas?

i would look to have a look at the settings

Which local dns server do you use ? Please suggest some with gui

Yes! Yes! Yes! on the Cloudflare video, absolutely would love to go deeper, thank you

I watched this to learn more about the access control feature for self hosted, and that wildcard "*" was the answer I was looking for. Thank you!

Muss man die DNS Server von cloudflare verwenden oder kann man manuelle DNS Einträge verwenden? Ich stelle mir vor, dass das ganze über cloudflare ihre DNS Server laufen muss......

Hello , first of all, let me thank you (from France) for the excellence of your videos. As a total noob, . I followed your video on creating a tunnel with Cloudflare and it worked very well, but today my two tunnels are down and I can't find any explanation anywhere. Do you have any suggestions for me? Thanks for everything you do.

Would love to know what software you are using to do the drawing at the begining of the video (around 3 min)

What software is that at the beginning? 😅

I want to know if you can run traefik and cloudflare with the same subdomains? I’m guessing i’d need to create a record on a local DNS server to point at Traefik (instead of Cloudflare) ?

Good video, many hints on what to follow - but you missed the disclaimer that CF is able to access all the traffic due to man in the middle, might be okay for pictures wouldn't want to put my nextcloud there...

Great video! I would've really liked to see the deal with those private networks you can setup in Zero Trust. Not sure if the WARP client thing is the same as a simple custom WireGuard container/VM.

i have been using this method for about 6 months now

Hey buddy , thanks a lot for this exclellent tutorial. Your tshoot demonstrating the need for both fqdn's in the Traefik Ingress Route saved me a good deal of time to figure out why setup wasn't working. You're the best thanks a lot!!!👍😀

Cost money but don't want to pay...

amazing! The 404 cost me HOURS! I couldn't figure out why it's re-routing traffic externally but not internally in the cluster. Made the same change as you did but not with labels per service, instead added a route in the ingress. 10 seconds of gold

Thanks for your great tutorial, if I have any questions where is the best place to ask?

Hi Chris, many thanks for the detailed instructions. As always, very well explained. I wanted to ask which tool you used to create the sketches... always makes the one or other system structure a little clearer 😉, thanks in advance, greetings

21:11 would be great to see an Access setup with straight WARP / Zero Trust connection, without entering OTP or something other.

Thanks Senior, after wandering around, you solved my problem easily. Am here for good!

Even if Cloudflare Tunnel is configured you can still access to the app if you know the specific IP:PORT. Is there something which can be done to address that?