Separate public hostnames and private routes

A tunnel can publish services in two ways, and they serve different audiences. Mixing them up is how internal tools end up on the public Internet.

Public hostnames

A public hostname maps a DNS name to a service through the tunnel. Cloudflare creates a DNS record like app.flaviocopes.com that points at the tunnel. Any browser in the world can resolve it and send a request:

cloudflared tunnel route dns practice-app app.flaviocopes.com

The hostname can be open to everyone, or protected by Cloudflare Access, which puts an identity check at the edge before requests reach your origin. Either way, the name itself is discoverable. Certificate transparency logs announce it the moment the certificate is issued. Assume bots know about it within minutes.

Private network routes

A private network route advertises a CIDR, a range of IP addresses, to enrolled Cloudflare One clients:

cloudflared tunnel route ip add 10.0.0.0/24 practice-app

This is not a website. There is no DNS record, no certificate, nothing for a stranger to type into a browser. Only devices enrolled in your organization and running the client can send packets to those addresses.

Start from the audience

Don’t start from the mechanism. Start from who needs to get in: Internet visitors, authenticated application users, or people on enrolled devices.

Internet visitors get a public hostname. Authenticated application users get a public hostname behind Access. Private device users, like operators reaching SSH, databases, or internal dashboards, get a private route.

The realistic mistake is publishing an admin panel as a public hostname because it was faster than enrolling devices. Now its login form is exposed to every credential-stuffing bot with a certificate-transparency feed. If the audience is “four people on my team”, it should not have a public name at all.

Practice the classification on four services: an internal SSH server, a public marketing site, an employee admin panel, and a private database subnet. Decide the audience for each, then the mechanism. The SSH server and the database subnet want private routes. The marketing site wants a public hostname. The admin panel is the judgment call: a public hostname behind Access, or a private route if every user is enrolled.