Separate public hostnames and private routes

A tunnel can publish services in two ways, and they serve different audiences. Mixing them up is how internal tools end up on the public Internet.

Public hostnames

A public hostname maps a DNS name to a service through the tunnel. Cloudflare creates a DNS record like app.flaviocopes.com pointing at the tunnel, and any browser in the world can resolve it and send a request:

cloudflared tunnel route dns practice-app app.flaviocopes.com

It can be public or protected by Cloudflare Access, which puts an identity check at the edge before requests reach your origin. But the name itself is discoverable. Certificate transparency logs announce it the moment the certificate is issued.

Private network routes

A private network route advertises a CIDR to enrolled Cloudflare One clients:

cloudflared tunnel route ip add 10.0.0.0/24 practice-app

It is not a public website route. There is no DNS record, no certificate, nothing for a stranger to type into a browser. Only devices enrolled in your organization and running the client can send packets to those addresses.

Start from the audience

Start from the audience, not the mechanism: Internet visitors, authenticated application users, or private device users.

Internet visitors get a public hostname. Authenticated application users get a public hostname behind Access. Private device users — operators reaching SSH, databases, internal dashboards — get a private route.

The realistic mistake is publishing an admin panel as a public hostname because it was faster than enrolling devices. Now its login form is exposed to every credential-stuffing bot with a certificate-transparency feed. If the audience is “four people on my team,” it should not have a public name at all.

Practice the classification on four services: an internal SSH server, a public marketing site, an employee admin panel, and a private database subnet. Decide the audience for each, then the mechanism. The SSH server and database subnet want private routes. The marketing site wants a public hostname. The admin panel is the judgment call: public hostname behind Access, or private route if all users are enrolled.