Understand the outbound connector model

The traditional way to expose a service is to give the host a public IP, open a port in the firewall, and hope your patching keeps up. Every open inbound port is attack surface that never sleeps. And behind NAT or CGNAT, you may not even have the option.

Cloudflare Tunnel flips the direction. You run the cloudflared connector next to your origin, and the connector opens outbound connections to Cloudflare’s network. Nothing connects in to your host. Your firewall can drop all inbound traffic and the tunnel still works, because the connector dialed out first and traffic rides back over those established connections.

Run it in the foreground once to see this happen:

cloudflared tunnel run practice-app

The logs show the connector registering several connections to different Cloudflare data centers:

INF Registered tunnel connection connIndex=0 location=fra01
INF Registered tunnel connection connIndex=1 location=ams02
INF Registered tunnel connection connIndex=2 location=fra05
INF Registered tunnel connection connIndex=3 location=ams07

Four connections to two cities. If one Cloudflare location has a bad day, your tunnel stays up.

Two things ride the same tunnel

For a public hostname, Cloudflare receives the visitor’s request at the edge and forwards it through those connections to a local service you configured. That service can listen only on localhost and still be reachable from the Internet.

For private networking, the connector advertises IP routes. Devices enrolled in your organization reach those internal addresses through the same outbound path. We cover both in the next lessons.

Reachability is not authorization

Tunnel changes who can reach your service. It does not decide who is allowed to use it. The moment a hostname resolves, the whole Internet can send it requests. The service behind the tunnel needs the same authentication it would need on a public server.

I say this because it’s the mistake I see most often: people treat “it’s behind a tunnel” as if it meant “it’s private”. It doesn’t, unless you add policy.

Now make the model concrete. Draw a browser, the Cloudflare edge, two connector replicas, and one loopback origin. Mark the direction of every connection. If any arrow points inbound toward your network, you drew it wrong. That is the entire point of the design.