Understand the outbound connector model

The traditional way to expose a service is to give the host a public IP, open a port in the firewall, and hope your patching keeps up. Every open inbound port is standing attack surface, and behind NAT or CGNAT you may not even have that option.

Cloudflare Tunnel inverts the direction. You run the cloudflared connector near an origin or private network, and the connector opens outbound connections to Cloudflare’s network. Nothing connects in to your host. Your firewall can drop all inbound traffic and the tunnel still works, because the connector dialed out first and traffic rides back over those established connections.

Run it in the foreground once to see the model:

cloudflared tunnel run practice-app

The logs show the connector registering multiple connections to different Cloudflare data centers:

INF Registered tunnel connection connIndex=0 location=fra01
INF Registered tunnel connection connIndex=1 location=ams02
INF Registered tunnel connection connIndex=2 location=fra05
INF Registered tunnel connection connIndex=3 location=ams07

Several connections to more than one data center means a single Cloudflare location having a bad day does not drop your tunnel.

Two things ride the same tunnel

For a public hostname, Cloudflare receives the visitor request at the edge and forwards it through those connections to a configured local service, even one listening only on localhost.

For private networking, the connector advertises IP routes, and enrolled devices reach internal addresses through the same outbound path.

Reachability is not authorization

Tunnel changes reachability, but application identity and authorization still need deliberate policy. The moment a hostname resolves, the whole Internet can request it. The service behind the tunnel needs the same authentication it would need on a public server.

Now make the model concrete. Draw a browser, Cloudflare edge, two connector replicas, and one loopback origin. Mark every connection direction. If any arrow points inbound toward your network, you have drawn it wrong — that is the entire point of the design.