# Cloudflare Tunnel (cloudflared)

> Expose a service on a private box through a custom domain, without opening a port.

- Verdict: My default
- Vendor: Cloudflare
- Layer: [Networking and hosting](https://cloudlesslabs.com/stack/layers/network.md). Job: Safe public exposure
- Last reviewed: 18 October 2026, by Nicolas Dao (Cloudless Labs, Sydney)
- Web page: https://cloudlesslabs.com/stack/cloudflare-tunnel/. The whole stack in one file: https://cloudlesslabs.com/stack/brief.md

How I expose services on my own VPS.

## Use it when

- Publishing a service from a VPS or private network, optionally behind Cloudflare Access login.

## Provisioning

Official Pulumi package · Official Terraform provider

## Where it fits

- [Private access and exposing a box](https://cloudlesslabs.com/stack/use-cases/private-access.md): pick 2. A private service onto a public domain, no open ports.

## Related

- [Networking and hosting](https://cloudlesslabs.com/stack/layers/network.md): every tool in this layer, with its verdict
- [The whole stack in one file](https://cloudlesslabs.com/stack/brief.md): every use case and tool, for questions that span many
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)