[opensourcedex]

cloudflared is a free, open source networking & connectivity project written in Go and released under Apache-2.0. It has 15,829 GitHub stars, 1,451 forks and 545 open issues, and was last pushed 4 days ago. On this registry it ranks #10 of 23 tracked projects in Networking & Connectivity, with 5 head-to-head comparisons available.

What is cloudflared?

cloudflared is the open-source command-line client and tunneling daemon for Cloudflare Tunnel, a Go program under the Apache-2.0 licence that proxies traffic from the Cloudflare network to your origins so a webserver can stay closed to the public internet, and it is aimed at operators, platform teams and developers who need to publish HTTP services or reach private origins without opening inbound firewall ports.

What it is

cloudflared contains the command-line client for Cloudflare Tunnel. The daemon sits between the Cloudflare network and your origin, such as a webserver: Cloudflare attracts client requests and sends them to you through this daemon, without requiring you to poke holes in your firewall, so your origin can remain as closed as possible. It lives in the Cloudflare One networking ecosystem and is catalogued under Infrastructure & Operations / Networking & Connectivity, with the topics cloudflare, cloudflare-tunnel, reverse-proxy and zero-trust-network-access. The repository is written in Go, is licensed Apache-2.0, and carries 15,829 stars, 1,451 forks and 545 open issues as of its last push on 17 September 2026.

The concrete problem it replaces is the inbound-facing reverse proxy. Instead of exposing an origin port and defending it, the operator runs an outbound-only daemon that Cloudflare connects to, and the origin never accepts unsolicited inbound traffic. The same binary also covers the Layer 4 side: cloudflared can access Tunnel origins that are protected with cloudflared tunnel for TCP traffic at Layer 4 rather than HTTP or websocket, which is relevant for use cases such as SSH and RDP. Those Layer 4 usages live under cloudflared access help, and the WARP client is the alternative for reaching private origins behind Tunnels without running cloudflared access commands on the client side.

Key capabilities

  • Proxies traffic to origins from the Cloudflare network without inbound firewall holes; all origin-proxying usages are listed under cloudflared tunnel help.
  • Reaches Layer 4 TCP origins through cloudflared access, aimed at SSH, RDP and other non-HTTP protocols.
  • Authenticates into a Cloudflare account, then creates and runs Tunnels that serve traffic to origins.
  • Routes Tunnel traffic three ways: public DNS records in Cloudflare, a public hostname guided by a Cloudflare Load Balancer, or WARP client private traffic.
  • Distributes as standalone binaries, the cloudflare/cloudflared Docker image on DockerHub, and Debian, RPM and Homebrew packages, plus Windows installation steps and a latest Darwin amd64 release for macOS.
  • Builds from source with the required Go version and the make cloudflared target.
  • Offers TryCloudflare for testing Cloudflare Tunnel before adding a website to Cloudflare.

Who uses it and how

  • Operations teams that need to publish an internal webserver publicly while keeping the origin host closed, by routing a public DNS record in Cloudflare to the Tunnel.
  • Zero-trust deployments that give remote users access to private origins behind Tunnels through WARP client private traffic, rather than exposing those services directly.
  • Infrastructure and database administrators who need SSH or RDP to protected origins over Layer 4 TCP through cloudflared access.
  • Teams evaluating the service before committing a domain, using TryCloudflare when no website has been added to Cloudflare yet.
  • Teams that need resilience in front of a Tunnel and route a public hostname through a Cloudflare Load Balancer.

Getting started

Download a standalone binary from the cloudflared GitHub releases, install the Debian, RPM or Homebrew package, or pull the cloudflare/cloudflared Docker image from DockerHub. Build from source with the required Go version and make cloudflared. Before use, add a website to your Cloudflare account and change your domain nameservers to Cloudflare; for private routing a website is not strictly needed, but the requirement persists for legacy reasons.

How it compares

The facts name no third-party equivalent, only Cloudflare's own adjacent components: the WARP client for Layer 4 private-origin access without client-side cloudflared access, TryCloudflare for pre-domain testing, and Cloudflare Load Balancer for public hostname routing. Within this registry cloudflared stands alone as the Cloudflare Tunnel client, and it is distinct from those components in that it is the daemon and CLI that the operator installs and runs.

When to use it — and when not to

A self-hoster must accept operational coupling to Cloudflare: an account, a website added to Cloudflare, and nameservers moved to Cloudflare, plus the daemon itself running alongside each origin. Anyone who wants a tunnel provider that runs entirely without a third-party control plane, or who cannot move DNS authority, should not pick this. The repository shows 545 open issues and a README excerpt that includes a truncated breaking-changes section beginning with the removal of CLI flags, so pinning a known version and reading the release notes before upgrading is prudent.

project readme (upstream, from github) — read inline

Cloudflare Tunnel client

Contains the command-line client for Cloudflare Tunnel, a tunneling daemon that proxies traffic from the Cloudflare network to your origins. This daemon sits between Cloudflare network and your origin (e.g. a webserver). Cloudflare attracts client requests and sends them to you via this daemon, without requiring you to poke holes on your firewall --- your origin can remain as closed as possible. Extensive documentation can be found in the Cloudflare Tunnel section of the Cloudflare Docs. All usages related with proxying to your origins are available under cloudflared tunnel help.

You can also use cloudflared to access Tunnel origins (that are protected with cloudflared tunnel) for TCP traffic at Layer 4 (i.e., not HTTP/websocket), which is relevant for use cases such as SSH, RDP, etc. Such usages are available under cloudflared access help.

You can instead use WARP client to access private origins behind Tunnels for Layer 4 traffic without requiring cloudflared access commands on the client side.

Before you get started

Before you use Cloudflare Tunnel, you'll need to complete a few steps in the Cloudflare dashboard: you need to add a website to your Cloudflare account. Note that today it is possible to use Tunnel without a website (e.g. for private routing), but for legacy reasons this requirement is still necessary:

  1. Add a website to Cloudflare
  2. Change your domain nameservers to Cloudflare

Installing cloudflared

Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases here on the cloudflared GitHub repository.

User documentation for Cloudflare Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/

Creating Tunnels and routing traffic

Once installed, you can authenticate cloudflared into your Cloudflare account and begin creating Tunnels to serve traffic to your origins.

TryCloudflare

Want to test Cloudflare Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation available here.

Breaking Changes

Removal of CLI flags, environment variables, configuration keys, or commands is a breaking change. Such removals must be announced in the Cloudflare Tunnel changelog before the release that removes them.

Deprecated versions

Cloudflare currently supports versions of cloudflared that are within one year of the most recent release. Breaking changes unrelated to feature availability may be introduced that will impact versions released more than one year ago. You can read more about upgrading cloudflared in our developer documentation.

For example, as of January 2023 Cloudflare will support cloudflared version 2023.1.1 to cloudflared 2022.1.1.

Development

Requirements

Build

To build cloudflared locally run make cloudflared

Test

To locally run the tests run make test

Linting

To format the code and keep a good code quality use make fmt and make lint

Mocks

After changes on interfaces you might need to regenerate the mocks, so run make mocks

Git Hooks

To avoid CI errors, you can install pre-push hooks that run linting and tests before each push:

make install-hooks

This will configure git to use the hooks in .githooks/ that run make fmt-check lint test before each push.

Frequently asked questions

Is cloudflared free to use?

cloudflared is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does cloudflared do?

Cloudflare Tunnel client

What is cloudflared written in?

cloudflared is primarily written in Go. Its source is publicly available at https://github.com/cloudflare/cloudflared, and it has 15,829 GitHub stars.