Recommended Free Tools
Cloudflare Tunnel lets you publish a service running on your own server without opening an inbound port on your router. You install cloudflared on the server, associate a public hostname with a tunnel, and point that hostname at a local URL such as http://localhost:8000. The connector makes the outbound connection to Cloudflare; visitors use the hostname, while your application remains on the self-hosted machine.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
You need a Cloudflare account, a domain managed by Cloudflare, and an Internet-connected server or virtual machine. If the server is behind a restrictive firewall, allow outbound connectivity to port 7844. For a first application, the dashboard workflow is quickest. A locally managed tunnel is better when you need explicit YAML ingress rules, several services, or command-line control.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What Cloudflare Tunnel does
A tunnel is a named connection between Cloudflare’s network and cloudflared, the connector running on your server. Cloudflare describes the route this way: “The tunnel route maps a public hostname to a local service.” The public side is a DNS hostname such as app.example.com; the private side is the service URL listening on the server, for example http://localhost:8000 or https://localhost:443.
Because the connector initiates the connection outward, you do not configure a port-forwarding rule for the application’s listening port. The server still has to be able to reach the Internet. On networks with egress filtering, port 7844 is the first firewall check when the connector cannot establish a connection.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
A tunnel provides transport between a hostname and an origin service. It does not replace the application’s own login, authorization, patching, or backup arrangements. Keep those controls in place exactly as you would for a service reachable by any other network path.
Prerequisites and decisions
Account, domain, and server
- A Cloudflare account.
- A domain hosted by Cloudflare. For the locally managed workflow, the domain’s nameservers must be delegated to Cloudflare so the tunnel can create its DNS route.
- An Internet-connected server or virtual machine running the application you want to publish.
cloudflaredinstalled on that server.- Outbound network access. If a restrictive firewall is in use, permit the connector’s required connectivity, including port 7844.
Start the application first and verify it locally. If the service does not answer on the server itself, a tunnel will not repair the application. Confirm the exact protocol, hostname expectations, and listening port before creating the route.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Choose a management model
| Decision axis | Dashboard-managed published route | Locally managed tunnel |
|---|---|---|
| Initial setup | Guided UI and token-based connector installation. | CLI commands, a credentials file, and YAML. |
| Configuration control | Routes are edited in the Cloudflare dashboard. | Ingress rules are explicit in a local configuration file. |
| Multiple services | Add published-application routes in the dashboard. | Add ordered hostname rules in config.yml. |
| Operational model | Install the token as a service or use the Docker command supplied by the dashboard. | Run the named tunnel and install the connector as a service or launch agent. |
Use the dashboard method if you want the shortest path to one published web application. Use the locally managed method when configuration needs to live with the server, when several hostnames share one tunnel, or when you want to inspect and validate routing from the command line.
Fast setup through the Cloudflare dashboard
1. Open the tunnel creation page
- Sign in to Cloudflare and open Networking > Tunnels.
- Select Create Tunnel.
- Give the tunnel a name that identifies its server or purpose. A name such as
home-serverorgame-servicesis easier to recognize later than a generic label.
The tunnel exists as an object in Cloudflare, but it does not carry traffic until a connector is installed and running on your server.
2. Add a published application route
- Choose Published application.
- Select the domain and enter the public hostname you want visitors to use, such as
app.example.com. - Enter the local service URL, including its protocol and port. Typical examples are
http://localhost:80,https://localhost:443, or an application listening on another local port such ashttp://localhost:8000. - Save the route.
The hostname is the public address; the service URL is the origin that cloudflared reaches from the server. Make sure the protocol matches the origin. An HTTPS origin must be entered with https://, not http://.
3. Install the connector with the tunnel token
The dashboard supplies a tunnel token and an installation command. On a Linux server, the documented service-install form is:
sudo cloudflared service install <TUNNEL_TOKEN>Replace <TUNNEL_TOKEN> with the token shown for your tunnel. Treat the token as a credential: do not publish it in a forum post, commit it to a repository, or place it in a script that is readable by unrelated users.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Cloudflare also provides platform-specific instructions for Windows and a Docker command that runs the connector with the token. Use the command displayed for the operating system or container environment on which the server actually runs.
4. Test the hostname
Once the connector is running, open the configured hostname in a browser or the client appropriate for your application. A successful response proves that the hostname reaches the tunnel and that the tunnel can reach the local service. An origin error means you should test the service locally first, then check the protocol, port, and connector status.
Locally managed setup with the CLI
The locally managed workflow stores the tunnel identity and routing rules on the server. The commands below use a tunnel named my-tunnel and an application listening on port 8000.
1. Install cloudflared
Install the cloudflared package appropriate for the server’s operating system. Keep the executable available to the user who will create and run the tunnel. Confirm that the server can reach the Internet before proceeding; a package installation can succeed even when later connector traffic is blocked by egress policy.
2. Create and identify the tunnel
cloudflared tunnel create my-tunnel
cloudflared tunnel listThe create command establishes the named tunnel, generates a credentials file, and returns a tunnel UUID. Record the UUID and the location of the credentials file. The list command lets you confirm that the tunnel exists and see its name and identifier.
3. Write the configuration file
Create ~/.cloudflared/config.yml for the account that will run the connector. A minimal configuration is:
url: http://localhost:8000
tunnel: <TUNNEL-UUID>
credentials-file: /root/.cloudflared/<TUNNEL-UUID>.jsonReplace <TUNNEL-UUID> with the value returned by the create command. The credentials path in this example is under /root; if you run the tunnel as another user, use that user’s actual credentials-file location and ensure the service account can read it. The url line is the default origin for this configuration. When you need several origins, use an ingress block instead, as shown below.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
4. Create the DNS route
cloudflared tunnel route dns my-tunnel app.example.comThis command associates app.example.com with the tunnel. Cloudflare documents that it creates a CNAME pointing to the tunnel’s cfargotunnel.com subdomain. If the hostname already has a conflicting DNS record, resolve that conflict before testing the application route.
5. Run the tunnel
cloudflared tunnel run my-tunnelLeave the process running while you test the hostname. If the local service is reachable and the DNS route is correct, requests to app.example.com are delivered to the URL in config.yml.
Route multiple local applications through one tunnel
One tunnel can serve several hostnames. Use ordered ingress rules so each hostname selects a different local service. The catch-all rule must be last:
ingress:
- hostname: app.example.com
service: http://localhost:8000
- hostname: admin.example.com
service: http://localhost:9000
- service: http_status:404How matching works
cloudflared evaluates the rules from top to bottom. A request for app.example.com reaches port 8000; a request for admin.example.com reaches port 9000. The final rule returns HTTP 404 for any hostname that did not match an earlier rule. Do not omit that final catch-all: Cloudflare requires one, and it prevents an unintended unmatched request from being routed to an arbitrary origin.
Validate a rule before blaming the application
cloudflared tunnel ingress rule https://app.example.comThis command reports which ingress rule matches the supplied URL. Run it after editing the YAML, especially when two hostnames or patterns appear similar. A rule that matches the wrong hostname is a routing problem, not an application problem.
HTTPS origins and certificate errors
For a TLS-enabled local service, use an HTTPS service URL, for example:
service: https://localhost:8443The origin’s certificate and TLS settings still matter between cloudflared and the local application. If the origin uses a self-signed certificate, review the origin TLS options documented by Cloudflare and disable certificate verification only when that exception is intentional and appropriate for your environment. Do not change an HTTPS origin to HTTP merely to hide a certificate error; first confirm which protocol and certificate the application is designed to use.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Make the connector persistent
A tunnel that runs only in an interactive terminal stops when that session ends or the server reboots. Install it as a background service or launch agent after the route works interactively.
Linux
For the dashboard workflow, install the token as a service with:
sudo cloudflared service install <TUNNEL_TOKEN>For a locally managed tunnel, install the connector using Cloudflare’s Linux service instructions and configure it to run the named tunnel. The service must be able to read the YAML file and credentials file, and it must run under an account with the required network access.
Windows
Cloudflare documents a Windows service installation path. Use the token or locally managed configuration appropriate to your tunnel, then start the service through the operating system’s service controls. Check the service account’s access to the configuration and credentials files.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutemacOS
On macOS, Cloudflare documents a launch agent for persistent operation. Use the launch-agent setup for the same tunnel and configuration you tested in the terminal. A launch agent running as a different user may resolve ~/.cloudflared differently, so use an explicit, readable credentials path.
Docker
The dashboard offers a Docker command that starts cloudflared with the tunnel token. Keep the token out of public image layers and source control, and ensure the container can reach both Cloudflare and the local service. If the application is in another container, use the service name and network arrangement that actually expose it to the connector rather than assuming that localhost refers to the application container.
Verification checklist
- The application responds directly on the server at the configured local URL.
- The tunnel appears in the Cloudflare dashboard or in
cloudflared tunnel list. - The connector process or service is running under the intended user.
- The hostname route exists and points to the tunnel; for a CLI-created route, inspect the CNAME target associated with the tunnel’s
cfargotunnel.comaddress. - The hostname uses the same spelling as the dashboard route or ingress rule.
- The origin protocol and port match the application’s listener.
- Outbound connectivity is allowed, including port 7844 where a restrictive firewall requires an explicit rule.
- For a multi-service configuration, the catch-all ingress rule is last.
For a locally managed tunnel, inspect its state with:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
cloudflared tunnel info my-tunnelTest in this order: local URL first, then the tunnel process, then DNS and the public hostname. This sequence isolates an origin failure from a connector failure and a DNS mismatch.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshooting common failures
The hostname does not connect
Check that the server has Internet access and that outbound port 7844 is not blocked by the host firewall, perimeter firewall, or network policy. Confirm that the connector service is actually running rather than merely installed. If the process exits immediately, run the tunnel interactively to expose configuration or credential errors.
The request reaches the wrong application
Inspect the hostname spelling and the order of the ingress rules. A broad rule placed before a specific hostname can capture traffic intended for another service. Run cloudflared tunnel ingress rule with the full URL to see which rule wins, then move the specific rule above the broader one. Keep the required http_status:404 catch-all at the end.
HTTPS origin errors appear
Verify that the service URL begins with https:// when the local application expects TLS and that the port is correct. Check the origin certificate and the TLS settings in the tunnel configuration. Self-signed certificates may require the documented certificate-verification exception; apply it deliberately rather than ignoring every certificate failure.
DNS points somewhere unexpected
Confirm that the hostname was routed to the intended tunnel and that its DNS record targets the tunnel subdomain. In the CLI workflow, rerun the DNS route command only after checking for an existing conflicting record. Also confirm that you are testing the exact hostname configured in the dashboard or YAML.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSSH, TCP, or RDP does not work from a normal client
Browser-based HTTP access and non-HTTP protocols have different client requirements. Cloudflare’s guidance states that SSH, TCP, and RDP connections require cloudflared on the client side. Installing the connector only on the server is therefore insufficient for those protocols; configure the client-side component according to the protocol and tunnel route you selected.
Operational choices and limitations
One tunnel or several
A single tunnel with ordered ingress rules is useful when several hostnames terminate on the same server and you want one connector process. Separate tunnels can make ownership, credentials, and failure boundaries easier to reason about, but no universal best choice is established. Base the decision on how independently the services are administered and recovered.
Dashboard control or configuration files
Dashboard-managed routes are convenient for a first publication and for teams that prefer a central UI. Locally managed tunnels make every hostname-to-service mapping visible in a versionable YAML file and provide CLI validation. Choose one operational source of truth for each tunnel so that a dashboard edit does not silently diverge from local configuration.
Availability expectations
The tunnel cannot make an offline server available. The machine, application, DNS route, connector process, and outbound network path all have to be functioning. Install the connector as a service or launch agent, monitor the application separately, and document how to restore the credentials file and configuration after a rebuild.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Final setup sequence
- Put the domain on Cloudflare and verify nameserver delegation when using the locally managed workflow.
- Start the local application and test its URL on the server.
- Choose the dashboard or CLI workflow.
- Create the tunnel and publish a hostname.
- Install
cloudflaredand connect it with the token or credentials file. - For multiple services, add ordered ingress rules and a final 404 catch-all.
- Route DNS to the tunnel and verify the public hostname.
- Install the connector as a persistent service or launch agent.
- Use
cloudflared tunnel info, ingress-rule validation, and local-origin tests whenever a change fails.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
