Create and run a remotely managed tunnel

A remotely managed tunnel keeps its configuration in the Cloudflare dashboard. The host only runs the connector. You change hostnames and routes in the browser, and the connector picks them up. That’s the mode I recommend for anything you’ll operate for more than a weekend.

Start by installing cloudflared on a disposable host. On macOS:

brew install cloudflared
cloudflared --version

On Linux, use the package for your distribution from the Cloudflare docs. Check the version either way, because you’ll want to know it later when something breaks.

Create the tunnel

In the Zero Trust dashboard, go to Networks, then Tunnels, and create a tunnel. Give it a name like practice-app, pick the connector platform, and the dashboard shows you an install command:

sudo cloudflared service install eyJhIjoiNmZmNDJhZTIt...

That long string is the connector token. It is a credential. Anyone who has it can run a connector that joins your tunnel and receives its traffic. Keep it out of shell history, logs, container images, and source control. If you paste it into a terminal, clear the history line afterwards.

The command installs cloudflared as a system service and starts it. Within seconds the dashboard should show the connector as HEALTHY. Check the service too:

systemctl status cloudflared

You want active (running) and log lines about registered connections, like the ones we saw in the foundations lesson.

Verify before adding routes

Don’t add hostnames or routes until the connector is healthy. If you configure a route first and it doesn’t work, you’re now debugging two things at once. A healthy connector with zero routes is a fine place to stop for the day.

Find the revoke control while you’re in the dashboard. Every tunnel has a way to invalidate the token and issue a new one. Locate it now, when nothing is on fire, so you know where it is when a token leaks.

Record three things about your practice connector: the service status, the cloudflared version, and where the rotation control lives.

You can also create a tunnel from the terminal. That path gives you a locally managed tunnel, and the dashboard lets you move it to remote management later. It’s handy when you want to script the setup.

Authenticate cloudflared on the connector host, then create one named tunnel:

cloudflared tunnel login
cloudflared tunnel create practice-app
cloudflared tunnel list

The login flow grants account access, so use a controlled host and remove stale credentials. Record the tunnel ID separately from the display name. Run the connector as a service only after one foreground connection reaches a disposable origin.